04 / LINUX SECURITY REVIEW
Linux Environment & Credential Discovery
Used an interactive Linux shell to profile the compromised target, inspect system information and locate sensitive WordPress configuration data.
Lab environment
EH vulnerable machine (192.168.56.105), Ubuntu 24.04 Attackbox (192.168.56.104).
Assessment highlights
- Confirmed bash as the interactive shell and reviewed PATH and filesystem navigation.
- Collected kernel, user, process, memory, disk and network information.
- Located /var/www/html/blog/wp-config.php using find.
- The configuration file contained live database credentials in plaintext.
- The report also notes that WordPress secret keys and salts stored in the same file should be rotated.
Security impact
Sensitive configuration files can expose credentials and application secrets when filesystem permissions and application isolation are weak.
Recommendations
- Protect configuration files with restrictive permissions.
- Avoid storing plaintext secrets where possible and use secure secret management.
- Rotate exposed credentials and WordPress salts/keys after an incident.
- Run application processes with the minimum required privileges.
Lab scope: This case study describes coursework performed against intentionally vulnerable systems in an isolated environment.