🔥SoSimple Walkthrough (Proving Ground-play-OSCP)

By cyber_public_school | Cyber Security Researcher

Preparing for OSCP | Sharing Practical Labs & Real-World Attack Analysis

Step 1: Reconnaissance

Nmap Scan

nmap -A — min-rate 1000 target_ip -Pn

Web Service Discovery

Navigate to the discovered HTTP port in a browser. The site reveals a WordPress installation — our primary attack vector.

WordPress Login — Bruteforce Setup

Prepare a credential stuffing / bruteforce attack against the WordPress login page using a common wordlist.

wpscan — url http://<target-ip> — enumerate u

Confirm WordPress in Browser

Verify the WordPress admin panel is accessible at /wp-admin and note the login form for targeted attacks.

[05] WPScan — User Enumeration

Use WPScan to enumerate valid WordPress usernames. This narrows our brute-force target significantly.

wpscan — url http://<target-ip> — enumerate u — plugins-detection aggressive

WPScan Results Review

WPScan identifies the username “max”. We now have a confirmed target for password bruteforcing.

Password Bruteforce

Run WPScan with rockyou.txt wordlist against the discovered user “max” to crack the WordPress password.

wpscan — url http://<target-ip>

— passwords /usr/share/wordlists/rockyou.txt

— usernames max

Password Found

WPScan successfully cracks the password. Credentials are now confirmed and ready to use.

🔑 Username: max Password: opensesame

PHASE 3 EXPLOITATION

WordPress Admin Login & Shell Upload

Log in to the WordPress dashboard using the discovered credentials. Navigate to Appearance → Theme Editor (or use a plugin) to upload a PHP reverse shell payload.

Create a minimal PHP reverse shell saved as simple.txt, then host it via Python HTTP server for delivery.

Start Python HTTP Server

Spin up a local HTTP server to serve the reverse shell payload to the target machine.

Terminal 1

python3 -m http.server 80

Netcat Listener — Catch the Shell

In a second terminal, start a netcat listener on the chosen callback port to receive the incoming reverse shell connection.

Terminal 2

nc -lvnp 4444

Trigger the Reverse Shell

Execute the payload via the WordPress editor or uploaded file. The connection fires back to our netcat listener.

Navigate to User Directory

With shell access gained, navigate to /home/max to enumerate user files and look for further privilege escalation vectors.

cd /home/max && ls -la

PHASE 4 PRIVILEGE ESCALATION

Enumerate Sudo & SUID Permissions

Check what commands the current user can run with elevated privileges. Look for SUID binaries and misconfigured sudo rules.

sudo -l

find / -perm -4000 -type f 2>/dev/null

Discover SSH Private Key (id_rsa)

An SSH private key is found in the user’s home directory or accessible via the current shell. Extract the full key content for local use.

Save SSH Key Locally

Copy the private key to your attacker machine, set correct permissions, and prepare it for SSH authentication.

echo “<paste-key-content>” > id_rsa

chmod 600 id_rsa

[17] SSH Login as max

Use the extracted private key to authenticate via SSH as user “max” — achieving a stable, fully-interactive session.

ssh -i id_rsa max@<victim-ip>

Escalate to Root

Leverage the sudo misconfiguration or SUID binary discovered earlier to escalate privileges to root.

Root Achieved — Flags

Full root access confirmed. Retrieve user.txt and root.txt flags to complete the room.

LESSONS LEARNED

⚠️ **Weak Credentials: **WordPress “opensesame” password was crackable from rockyou.txt — enforce strong password policies.

⚠️ **SSH Key Exposure: **Private keys should never be world-readable or stored in web-accessible directories.

⚠️ **Sudo Misconfiguration: **Over-privileged sudo rules allowed full privilege escalation — follow principle of least privilege.