FLAG 1 IN PAGE SOURCE

Some more looking around....

Some more looking around....

Some more looking around....

SOME DIRECTORY BUSTING BCOZ WHY NOT ..

dirb http://10.0.9.129

SOME DIRECTORY BUSTING BCOZ WHY NOT ..

dirb http://10.0.9.129

Interesting WordPress running on our server

FTPing the  server  as we know vftpd is running

ftp://10.0.9.129

FTPing the  server  as we know vftpd is running

ftp 10.0.9.129

WPScan the weblog directory

wpscan --url http://derpnstink.local/weblog/ --enumerate p --enumerate t --enumerate u --enumerate tt

And More

WPScan the weblog directory

wpscan --url http://derpnstink.local/weblog/ --enumerate p --enumerate t --enumerate u --enumerate tt

WPScan the weblog directory

wpscan --url http://derpnstink.local/weblog/ --enumerate p --enumerate t --enumerate u --enumerate tt

Users and Password of one

Metasploit have it

search Slideshow Gallery

Metasploit have it

exploit/unix/webapp/wp_slideshowgallery_upload

Metasploit have it

All options set

Metasploit have it

All options set

Metasploit have it

All options set

MySQL database

MySQL database

Bruteforceing

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

Bruteforceing

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

Accessing Wordpress panel

http://derpnstink.local/weblog/wp-login.php

Accessing Wordpress panel

http://derpnstink.local/weblog/wp-login.php

Now Escalate

Now Escalate

Now Escalate

Now Escalate

Now Escalate

Now ENUM

Now ENUM

Now ENUM

wedgie57

Now ENUM

Now ENUM

and chmod 400 stinky.key

Now ENUM

Now ENUM on the PCAP 

http.request.method == POST

LETS GET ROOT !

YOU GOT PWNED