Loly Vulnhub Walkthrough

Hello, guys Today we are going to solve another boot to root challenge called Loly: 1.  It’s available at VulnHub for developing our penetration testing skill and you can download it from here. this is easy level machine.

Network Scanning

Let’s get started with network scanning first we run the nmap ping scan discovering our target IP address.

now we have an IP address for our target machine. Let’s start the Nmap service and version discovering the open port’s target machine.

Enumeration

After trying some different URLs I found a WordPress page but there we see the error we navigate the admin page URL and again our URL IP is changed to loly.lc then we add the domain our hosts file

this is a simple page nothing is there useful. we try to log in admin page but didn’t found any correct username and password

we try manual some common password but we fail to log in then we run the wpscan first we enumerate the username and try password brute-forcing using the wpscan command.

As we see our password brute-forcing attack is successful we found a valid password combination again we navigate the word-press login URL and try to login again

After enumeration the word press panel we try uploading PHP file but they are blocked for security reason and we going to install a buggy plugin but there is no option to upload plugin and themes after checking the pre-install plugin

w found a vulnerable plugin( AdRotate ) we upload a shell by compressing our payload a zip file as a new banners file.

Now our shell is uploaded the target website successful after a second this is automatic unzip in the banners directory let’s star the netcat listener and using the curl command we call our shell.

Now we move the system enumeration step first we check the word-press config.php file and we try DB_PASSWORD for Linux user login and we successfully change our current shell WWW-DATA to loly user

Privilege Escalation

we run the uname -r command and we see the target machine kernel version we search the following kernel version on exploit-db and we found a local privilege exploit. ( /exploits/45010 ) then we download the exploit target system and compile the exploit

before executing the exploit we need to add execute permission our exploit and then we execute the exploit

After run the following command and we obtain the root shell and finished the challenge by reading the root flag

ONsystem Shelldredd Vulnhub Walkthrough link