Hi, within this lecture, we're going to continue solving our mystery about CTF, and now we know a
user name called Aleut exists, OK, but we don't know the password.
So we got that from the society that the file and this is a dictionary and this is the only dictionary
that we're ever going to get in this CTF.
So I'm going to use that and I'm going to close this down.
Of course, we can use burb, so in order to brute force the password as well, and we can use Hydra
again in order to brute force the password as well.
But I suggest we go for Weepie Skemp because we have to learn how Weepies scan works because it's a
good idea to learn about WordPress penetration test as well.
So first of all, you're going to have to supply the URL parameter like this.
So this is Tero 215 for our your URL.
OK, so of course you're going to have to write your own IP address over there.
And don't worry about the V.P. login extension.
We're going to write that in another parameter.
First, I'm going to give the word this parameter over here, which is F Society Dot DC and over here
we are inside of the Mr. Robot.
So if society FDIC is in the Mr. Robot, so I don't have to specify the full part.
So make sure you run this comment in that.
And by the way, so that Dick and make sure you run that comment in the same folder and user name will
be Elliott.
And if I hit Enter.
Here you go.
It's it actually complains about the word list and we have to make this something else because it doesn't
accept the word list.
I believe it should be something like word lists or something like that.
So let me try and see whether this so I'm going to come over here, we Schenn, Dashty, Shehab and
see.
Yeah.
If this is password's and the user names.
So let me just see it one more time.
So we have given wordlist as a parameter so it should have been password's and not the user name.
I believe it's user names.
So let me just check that one more time.
Yeah.
Here you go.
This is user names so I'm going to change it to user names and hit enter and here you go.
It says that.
Do you want to update now.
It's a good idea to update about.
I'm just going to say no in order not to make you wait.
OK, so maybe you can say yes and wait for it to update its database.
And we are not actually searching for any vulnerability in the vert press right now.
And the tool is doing that for us.
OK, I'm not looking for a vulnerability actually at this point.
I just want to get in by finding the password.
But maybe it's an alternative way for us.
We can search for the WordPress users, we can search for the WordPress exploits version exploits.
So it would be better for us.
So I'm going to go into my CTF document, the Mr. Robot over here.
And for some reason it doesn't work because I put an extra slash over here.
So it should have been KDDI documents, CTF and Mr. Robot, if we run, unless we can see we have the
that you see and if socity that dick and we have the hydro restart, we can run hydro one more time
from this hydro data restore file.
By the way, if we want to, if you don't want to, you don't have to do anything about it.
So let me just kept that socity that deck and just make it into sort and with that you so that we can
see if there is any duplicates over here because it's taking some time in the other terminal, DTAP.
So as you can see there, kind of maybe uppercase, lowercase, but there are a couple of duplicates
over here.
So maybe we can try to get rid of these duplicates as we have done before, like we can take the Unix
of that and we can just search with that or we can just start with that in order to shorten the period
of waiting.
So you can do this right.
You can pipe this into unit and see what happens.
You can just do this because we have seen how to do this in the Bendit section.
Right?
So if we get rid of the duplicate values, then we will.
Some kind of maybe much more smaller file over there, so let me just run this into a file, just write
this into a file called Until the FDIC and see how this is going to work out.
So I'm going to run that SLA.
And here you go.
Until that this is actually much more smaller than if socity that the ICI.
Right.
So I believe there was like a couple of duplicates and maybe thousands of different because I don't
know, and we got rid of them.
So maybe waiting here is just a waste of time.
As you can see, the estimated time of arrival, these two hours, at least three hours, I believe.
So I'm going to stop this with controversy and I'm going to come over here and just replace this with
a tool that the ICC.
So this will give me the same result back, but in a much more Qaderi.
So as you can see now the let's see what is the estimated time.
Yeah, here you go.
Now, this is two minutes.
Comparing it with three hours.
This is much more faster.
So if you get a wordlist in an initial ETF, then make sure you check the same command that I had.
Dommett OK, just run that command and see if you can get a much more smaller wordlist over a day.
Of course, if we waited long enough that would have been successful as well.
That will be successful.
If we success if we get success over here, then it must mean that we can.
We were going to get the success over there as well, but we were going to get it in three hours rather
than two minutes.
Now we're going to have to wait and see what happens.
So it's trying to pass over here.
And this replug in, that is I'm a regular in website, very regular Logi, the extension.
That's how it actually understands the login and just go over there and try it.
So let me come over here.
As you can see, we are in the past of 50 percent and it's done.
Let's see.
Yeah.
Developed Combination's font username, Elliot, and there is a password over here and we found it under
one and a half minutes, maybe one minutes and 10 seconds.
So let me see if this is correct.
I'm going to copy and paste is over here as a login and proxy servers are using connections.
So I believe we have to turn off the folks you see over here and close down the street if you have it
open.
And here you go.
We are inside of the WordPress.
So now we found the password of the Aleut.
So, OK, so we haven't hacked into the server yet, right?
We we just came over here.
So let me go to Elliot Elders, whose profile and see what kind of user this is.
And here you go.
Elliot is actually administrator.
So this is the administrator of the WordPress, actually, not the administrator of server.
But again, this will bring us joy because it will make our job very easy compared to logging in with
a regular user.
So if you know WordPress, then it's going to be a piece of cake for you.
But if you don't know it, just follow along with me.
As you can see, we get a lot of things over there.
We can just try to analyze and scan if we have some kind of vulnerability in the WordPress itself.
I believe this is WordPress four point three point twenty five.
And you can search for this in the Web as well, not just with the WordPress scan.
You can just come over here and write VPE and three points, four point three point twenty five exploit
and see if there is any exposure related to that particular version.
OK, and there is one over here, but it's again, about four point three point three.
Yeah, it's exercise scripting, the kind of thing I don't think that's going to make us into the server.
Let me come over here and check a little bit.
As you can see, they're all exercice vulnerabilities.
So we're going to have to find something that will lead us to server.
And I don't see it, but of course, not only we can get access with version vulnerabilities, but we're
going to have to try so much more in this case.
So.
Well, they will try actually.
I will come over here and I will just take a look at the files and I will see if we can make a post
or upload something like even.
You can upload a reverse shell over here, then it would be great, and if the left hand side, we see
all the menus like pages of previous posts, media dashboard.
So you can just come over here and scroll down a little bit and just wander around to get a feeling
of the WordPress if you have never used it before.
Let's do that and let's meet in the next lecture.