Metasploit Revealed: Secrets of the Expert Pentester

Summary of the attack

Summarizing the entire test, we performed the following operations:

1. Port scan on 192.168.10.110 (port 80 open).
2. Brute-forced directories on port 80 (WordPress and PHP Utility Belt found).
3. Exploited PHP Utility Belt to gain PHP meterpreter access.
4. Escalated to Windows meterpreter.
5. Post-exploitation to figure out the presence of an internal network.
6. Added routes to the internal network (Metasploit only).
7. Port scan on the internal network 172.28.128.0.
8. Discovered 3306 (MySQL) and 80 (Apache) on 172.28.128.3.
9. Fingerprinted, gained access to MySQL, and harvested the credentials for the WordPress domain running on 192.168.10.110.
10. Cracked hashes for the WordPress website using hashcat.
11. Brute-forced directories on port 80