ipaddress:192.168.110.11
### information_gathering
open-port:
```
Discovered open port 80/tcp on 192.168.110.11
Discovered open port 21/tcp on 192.168.110.11
Discovered open port 22/tcp on 192.168.110.11
```
view the port of 80 webpage->can find
[http://192.168.110.11/robots.txt](http://192.168.110.11/robots.txt)
```
User-agent: *
Disallow: /php/
Disallow: /temporary/
```
use dirbuster and wfuzz can find:
[http://192.168.110.11//weblog/](http://192.168.110.11//weblog/)
```
wpscan --url [http://192.168.110.11//weblog/](http://192.168.110.11//weblog/) -e u
```
find user:
```
unclestinky
admin
```
gedit /etc/hosts -> add 192.168.110.11 [derpnstink.local](http://derpnstink.local/weblog/wp-content/uploads/slideshow-gallery/)
### Establish a foothold
and view [http://derpnstink.local/weblog/wp-admin](http://derpnstink.local/weblog/wp-admin/admin.php?page=slideshow-slides&Galleryupdated=true&Gallerymessage=Slide+has+been+saved)
use admin admin to login
and reverse a shell ->
can read wp-config:root mysql
username:stinky
pwd:wedgie57
### Privilege Escalation
mrderp
derpderpderpderpderpderpderp
login it:
okay~ we get the root!
