Vulnhub: Raven 1 Writeup (OSCP PREP) [by dollarboysushil]

Link to Raven 1: https://www.vulnhub.com/entry/raven-1,256/
Raven is a Beginner/Intermediate boot2root machine. There are four flags to find and two intended ways of getting root. Built with VMware and tested on Virtual Box. Set up to use NAT networking.
Note: I will be focusing on getting the root of the machine, I will not be focusing on getting the flag.
Disclaimer: Personally I didn’t like this machine
Nmap Scan

port 22
shh
port 80
http
port 111
rpcbind


Nikto scan result.

Running gobuster gives /wordpress
hidden directory.

Since we have wordpress running , lets use wpscan

didn’t gave much info.

Then I tried enumerating the users by adding — enumerate u
option

Which reveals two users michael
and steven

Then I saved this usernames into username.txt

After running hydra to bruteforce , password is revealed.

and we have shell as user michael


while digging around , i came across flag 2.

visiting /var/www/html/wordpress
we can see wp-config
which can have juice info.

And jackpot, we have mysql database credentials


and we have username and hashed password.

Then I used hash-identifier
to identify hash type.

Running john
gives us the password pink84

switch user to steven
Privilege Escalation

running sudo -l
shows that user steven can run /usr/bin/python
as raven

Looking at https://gtfobins.github.io/.
we can run command sudo python -c 'import os; os.system("/bin/sh")'
to get root access.

and we got the root access.
For any correction / query /suggestion contact on
Instagram dollarboysushil
Twitter (X) dollarboysushil
Youtube dollarboysushil