DC-2 capture the flag
WordPress box · class CTF · Feb 2026
Day one: the front door
This one was a WordPress box on the class network. The part I’m
happiest with: I was one of the few to complete the stretch challenge. Instead of pulling
a generic password list, I used cewl, which is a tool that
scrapes a website and builds a wordlist out of the words it actually
contains. People’s passwords usually show up in their own writing,
so cewl -d 3 -w passwords http://dc-2 gave me a candidate
list tailored to this box.
After that I used nikto, it’s a web server
scanner that probes for known vulnerabilities and leftover default
files. It pointed me at wp-login.php, which told me the
box was worth attacking through WordPress rather than the server.
That’s where wpscan comes in, it’s a scanner built
specifically for WordPress. It can enumerate all information from the site. Themes,
plugins, and, importantly, usernames. wpscan --no-update
--enumerate --url http://dc-2 pulled two out of the site:
Jerry and Tom. Then it does double duty as a brute-forcer, so feeding
the cewl list back in cracked both in one pass:
jerry : adipiscingtom : parturient
The quick port scan only checks the common ports, so a full
nmap sweep of all 65,535 (sudo nmap -p-
<target>) was worth the wait: ssh was hiding on
7744, not the default 22. Jerry’s password
didn’t work over ssh, but Tom’s
did:
ssh -p 7744 tom@<target>
Breaking out of the restricted shell
Tom’s shell turned out to be rbash, a restricted bash
that only lets you use a handful of commands. I figured it out the
boring way: half of what I typed just wasn’t there.
echo $PATH showed why. The shell was only looking
in /home/tom/usr/bin. less flag3.txt did
work, and the flag basically said “use su.”
The way out was vi. It has a setting that tells it which shell to
spawn: :set shell=/bin/sh, then :shell, and
vi hands you a shell from inside the editor. From there,
/bin/bash for a proper shell, then export
PATH=/bin:/usr/bin:/usr/local/bin:$PATH so anything I spawned
could find commands. This took longer than I want to admit, I
kept trying things before I’d actually fixed the PATH.
Poor old Tom is always running after Jerry. Perhaps he should su for all the stress he causes.
su jerry worked with the wpscan password previously discovered,
and flag4 was sitting in his home directory:
Good to see that you’ve made it this far — but you’re not home yet. You still need to get the final flag (the only flag that really counts!!!). No hints here — you’re on your own now. Go on — git outta here!!!!
The pun is the hint. sudo -l lists which
commands a user is allowed to run as root, and jerry can run
/usr/bin/git, no password. git’s help command opens
a pager, and pagers like less let you shell out:
sudo git help status, then !/bin/bash from
inside it, and suddenly whoami says root. The final flag was found there and the ctf completed.
Stretch goal: deface the site with a rickroll
WordPress stores its database credentials in plain text in
wp-config.php (wpadmin : 4uTiLL), so I
logged into mysql and asked the wp_options table which
theme the site was actually using called twentyseventeen. All that
was left was to replace its front page with an embedded video.
The box had no internet, which turned a quick link embed into a
small logistics chain: grab the video on my mac, convert it to mp4
with yt-dlc and ffmpeg, scp it to the jumpbox,
scp it again to dc-2, drop it in the uploads folder, give
the web server ownership, and embed it in the php. When it finally
played, it was absolutely worth the effort.
