Loly Walkthrough | Offensive Security Proving Grounds | CTF

Steps to be performed after nmap scan.
1. On directory enumeration we find that the server runs wordpress site.
2. On running wpscan we find user loly exist and on bruteforce we find users password.
3. On logging in to wordpress admin panel we find adrotate has a functionality which allows the upload of zip files,, which later unzips the zip file content to /banner folder. This features helps us to bypass the file format checks in place and upload a reverse shell.
4. We get the location of the uploaded file from adrotate settings.
6. On 'uname -a' comment we find that the kernel version is vulnerable and can be exploited to obtain root access.
7. On successful execution of the exploit you get root access.

#Loly #Lolywriteup #walkthroughLoly #Lolybox #indianhacker #htb #vulnhub #oscp #ndia #hindi #hackforfun #hack #ospg #penetrationtesting