Aes-Gcm

Overview Stack: Ubuntu 24, WordPress 7.0, SQLite. 1 2 3 4 5 6 7 8 9 10 11 12 13 reconnaissance v audio file discloses Jake's password (a restricted WP user) v hardcoded client-side AES-GCM key -> stored XSS in the admin panel v XSS creates an administrator account v admin -> Theme File Editor -> PHP webshell -> RCE (www-data) v wp-config.php -> walter's credentials -> SSH -> user.txt v local OCR service (PHP as root) -> write PHP -> RCE as root -> root.txt Reconnaissance 1 2 3 4 nmap -sV -p- 10.10.10.x --min-rate 5000 # open: 22/tcp (SSH), 443/tcp (HTTPS) wpscan --url https://makesense.htb --enumerate u,vp,vt --disable-tls-checks Key wpscan findings: ...