[ｍＯｂｉＩｅ]

[img]http://santahacker.com/wp-content/uploads/2012/08/SantaHackerHeaderFINALsmall.png[/img]

YES! Get over it, NONE of you made Santa's "Nice" list this year. 😭 But don't lose hope because Santa Hacker is here, making a "Naughty" list and checking that bitch twice. Seeing who's naughty and who's nice?

Oh! Look! .. Santa Hacker has left you a Christmas Present.


Spoiler (Click to View)
2 vulnerable linux servers with a bunch of Wordpress sites that you can hack via symlink. 👍

198.154.232.12 <--Click me


192.254.133.100 <--Click me



Most veterans will get this by JUST the IP ..but being xmas and all Santa Hacker has also left you some clues and a tutorial on how to upload your shell on Wordpress websites, once you've symlinked.

Try and Challenge yourself and only open one clue at a time. If you're outta clues and STILL having trouble ..then you Don't make the Naughty list and get you NOTHING! =P


Spoiler (Click to View)

/OptimizePress/

Spoiler (Click to View)



Spoiler (Click to View)
Vulnerable:

PHP Code


<?php include "../../../../../wp-config.php"; ?>
<?php get_template_directory(); ?>

Patched:

PHP Code


<?php include "../../../../../wp-config.php";
if ( !current_user_can('add_users') ) {
echo 'You cannot access this file. Sorry.';
exit;
}
?>
<?php get_template_directory(); ?>

Spoiler (Click to View)
WordPress Tutorials:

https://hackforums.net/showthread.php?tid=2667946
https://hackforums.net/showthread.php?tid=2312449

DEMO on Target IP:



Shell:

http://bestrestaurantsinlosangeles.net/w...en/404.php

To make the naughty list PM me with a link to your shell. And Please show Respect by not posting clues.

HACKER SANTA's Naughty List:
1.) huju
2.) blanc1234
3.)
4.)
5.)

Merry Christmas Website and Forum Hacking Section!! ..And Thanks to all the HF members who comment in my threads. 🤝

[MyLittlePony]

I am about to deliver a shitload of coal to these silly wordpress sites.

[huji]

check your private message.cool challenge

[PickledHax]

Well, I'm stuck :P Have no idea what to do... Nice challenge though. Others should see this.

[Tinkernut]

I Dont Get This What Are We Suppose To do?

[MyLittlePony]

I Dont Get This What Are We Suppose To do?

Upload a shell to the servers (or just one of them)...

[PickledHax]

I'm still stuck... I think this challenge has beaten me. Thanks for the challenge man.

[banc1234]

auu sorry :) i just add some clue ok delete it :)

---

Ok having problems with symlink but the rest seem's to work :) do i have to symlink it ? or

[SIM-1980240]

What a cool thread, It's a really fun idea! :D MERRY CHRISTMAS!

[banc1234]

someone put us out of bussiness :) 35 ...