Web Exploitation
Difficulty: Hard
Flag Format
vhuCTF{...}
Target
Loading...
Reset
Every 60 minutes at :00
Next Reset
--:--
▸ Description
A WordPress instance is running on the target server. Your objective is to chain multiple vulnerabilities to achieve Remote Code Execution and read the flag.
The challenge requires you to demonstrate skills in:
- Web application reconnaissance & version fingerprinting
- REST API analysis & route confusion
- Blind SQL injection exploitation
- Credential enumeration & cracking
- Post-authentication RCE techniques
▸ Rules
- Only attack the provided target URL.
- Do not attack the VPS, reverse proxy, or other lab instances.
- No Denial of Service, flooding, or intentional disruption of service.
- Do not share flags with other teams.
- The lab resets automatically at the start of every hour.
▸ Hints
Click each hint to reveal. Try solving without hints first!
Hint 1
Check the REST API and batch endpoint of WordPress.
Hint 2
A route handling flaw can cause requests to reach WP_Query in unintended ways.
Hint 3
The SQL injection channel does not return data directly; observe response timing.
Hint 4
After finding the highest-privilege account, use the password hint below.
Hint 5
Password hint: challenge name in lowercase + @ + the vulnerable WordPress version.