---
# System prepended metadata

title: Web Range-128
tags: [linux, CPENT]

---

# Web Range-128
## Challenge 128
## Challenge 129
![image](https://hackmd.io/_uploads/rJkEX8tFgg.png)


* Rustscan
    * ![image](https://hackmd.io/_uploads/HkY1IN5Ygx.png)

* Nmap
    * ![image](https://hackmd.io/_uploads/B14SLEqFgg.png)


* Wordpress website
    * ![image](https://hackmd.io/_uploads/rJtb849Fgl.png)
    * ![image](https://hackmd.io/_uploads/BkzfIVctlx.png)

* dirsearch
    * ![image](https://hackmd.io/_uploads/Bk68LEcFeg.png)

* WPScan
    * ![image](https://hackmd.io/_uploads/BJyyvV5Flg.png)

```zsh=
wpscan --url http://10.10.1.62/ -e vp vt u
```

* Wpadmin
    * ![image](https://hackmd.io/_uploads/Bymfw45Kxg.png)

* Using hydra got wpadmin's password
    * ![image](https://hackmd.io/_uploads/B1laDN9Kxe.png)
    * ![image](https://hackmd.io/_uploads/BkTFd49Yxe.png)
    * `admin:@6h$ER$*l3z`
```zsh=
hydra -l admin -P Passwords.txt 10.10.1.62 http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:The password you entered for the username"
```

* 後台上傳plugin, 成功上傳phpinfo到`/wp-content/uploads/2025/08/info.php`
    * ![image](https://hackmd.io/_uploads/S1SlsV5Feg.png)
    * ![image](https://hackmd.io/_uploads/ryyziNcFgl.png)

* Upload webshell and got shell as `www-data`
    * ![image](https://hackmd.io/_uploads/rJyPjN5tee.png)
    * ![image](https://hackmd.io/_uploads/H1huiN5tex.png)
    * ![image](https://hackmd.io/_uploads/Hy8njN9txx.png)

* `data.sh` has permission 777
    * ![image](https://hackmd.io/_uploads/BJLH24qFgx.png)

* 有root的排程
    * ![image](https://hackmd.io/_uploads/BkT_1Bqtgg.png)

* flag
    * ![image](https://hackmd.io/_uploads/Bkj6Frctex.png)

## Answer
* Challenge 128:`data.sh`
* Challenge 129:`GfsgEE4FV`



