┌──(kali㉿kali)-[~] └─$ sudo nmap --min-rate 10000 -p- 192.1.1.153 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-18 01:26 EDT Nmap scan report for 192.1.1.153 Host is up (0.00062s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:96:CA:48 (VMware)
┌──(kali㉿kali)-[~] └─$ sudo nmap -sT -sV -sC -O -p21,22,80 192.1.1.153 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-18 01:27 EDT Nmap scan report for 192.1.1.153 Host is up (0.00035s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:192.1.1.128 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeoutin seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 1 | vsFTPd 3.0.3 - secure, fast, stable |_End of status |_ftp-anon: Anonymous FTP login allowed (FTP code 230) 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 08:ee:e3:ff:31:20:87:6c:12:e7:1c:aa:c4:e7:54:f2 (RSA) | 256 ad:e1:1c:7d:e7:86:76:be:9a:a8:bd:b9:68:92:77:87 (ECDSA) |_ 256 0c:e1:eb:06:0c:5c:b5:cc:1b:d1:fa:56:06:22:31:67 (ED25519) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Site doesn\'t have a title (text/html). | http-robots.txt: 1 disallowed entry |_Hackers MAC Address: 00:0C:29:96:CA:48 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
WordPress Security Scanner by the WPScan Team Version 3.8.24 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[+] XML-RPC seems to be enabled: http://btrisk.com/wordpress/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://btrisk.com/wordpress/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] Upload directory has listing enabled: http://btrisk.com/wordpress/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://btrisk.com/wordpress/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 3.9.14 identified (Insecure, released on 2016-09-07). | Found By: Rss Generator (Passive Detection) | - http://btrisk.com/wordpress/?feed=rss2, <generator>http://wordpress.org/?v=3.9.14</generator> | - http://btrisk.com/wordpress/?feed=comments-rss2, <generator>http://wordpress.org/?v=3.9.14</generator>
[+] WordPress theme in use: twentyfourteen | Location: http://btrisk.com/wordpress/wp-content/themes/twentyfourteen/ | Latest Version: 3.6 | Last Updated: 2023-03-29T00:00:00.000Z | Style URL: http://btrisk.com/wordpress/wp-content/themes/twentyfourteen/style.css?ver=3.9.14 | | Found By: Css Style In Homepage (Passive Detection) | | The version could not be determined.
[+] Enumerating All Plugins (via Passive Methods) [+] Checking Plugin Versions (via Passive and Aggressive Methods)
[i] Plugin(s) Identified:
[+] mail-masta | Location: http://btrisk.com/wordpress/wp-content/plugins/mail-masta/ | Latest Version: 1.0 (up to date) | Last Updated: 2014-09-19T07:52:00.000Z | | Found By: Urls In Homepage (Passive Detection) | | Version: 1.0 (80% confidence) | Found By: Readme - Stable Tag (Aggressive Detection) | - http://btrisk.com/wordpress/wp-content/plugins/mail-masta/readme.txt
www-data@ubuntu:/var/www/html/wordpress$ cat wp-config.php cat wp-config.php <?php /** * The base configurations of the WordPress. * * This file has the following configurations: MySQL settings, Table Prefix, * Secret Keys, WordPress Language, and ABSPATH. You can find more information * by visiting {@link http://codex.wordpress.org/Editing_wp-config.php Editing * wp-config.php} Codex page. You can get the MySQL settings from your web host. * * This file is used by the wp-config.php creation script during the * installation. You don\'t have to use the web site, you can just copy this file * to "wp-config.php" and fill in the values. * * @package WordPress */
// ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'wordpress');
/** MySQL database username */ define('DB_USER', 'root');
/** MySQL database password */ define('DB_PASSWORD', 'rootpassword!');
/** MySQL hostname */ define('DB_HOST', 'localhost');
/** Database Charset to use in creating database tables. */ define('DB_CHARSET', 'utf8'); www-data@ubuntu:/var/www/html/upload$ su su Password: rootpassword!
mysql> use wordpress use wordpress Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
