While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here:
https://www.exploit-db.com/exploits/45439/
I used it and got access to the etc/passwd
file (which doesn't tell me anything that I do not already know). As well as some other files that do not give any info.
I have tried to access the files that contain important info like the files in folders var/log, etc/shadow, proc/self, etc.
all I get is either permission denied or a 404...
Should I keep looking at this exploit or just forget about it? I can't execute any code so far, not even ls -a or anything
system info:
- ubuntu server
- wordpress
- directory listing enabled
- 3 users on wordpress and i identified the ssh user
- mysql db (doesn't show on nmap)
Any help or hint would be appreciated. thanks.