Using netdiscover as routine to detect the target's IP address and then run NMAP scan to detect opening ports/running services on the target. From the result, TCP port 80, 443 and 8080 have been discovered and the web server is apache 2.4.7 running on Ubuntu Linux.
An login page has been found by nikto and I access http://10.10.10.134/login.php on firefox, it shows a login form with username and password input box.
Simply try some weak passwords such as admin/admin and get 0 responded which means login failed.
Then I tested simple SQL injection statements such as ' or 1=1 -- - in username box and anything in password box, this time the server response 1 which means login successful.
Based on the test result, I know here is SQL injection vulnerability.
Now fire up SQLMAP to exploit it automatically.
Next, modify the pentestmonkey's PHP reverse shell' IP and port to my Kali's port 5555 and setup NC to listen on this port.
Then by using the collected admin credential, I successfully logged in wordpress dashboard on server's port 8080.
Now we got a shell with limited privilege. After poking around the file system, I read the passwd file which the secrets saved in the file too. Surprisingly, the shadow file also can be read.
Bingo! the root user use the same password as wordpress admin.
In the meantime of cracking the passwords, I create and upload linux meterpreter reverse shell (lmp443) to target server in order to get a better interactive shell.
Then trigger the shell and get a meterpreter shell back to my Kali. Finally, use su command with cracked root password to get ROOT.