Nmap output
Nmap scan report for 192.168.239.229
Host is up (0.061s latency).
Not shown: 65506 filtered tcp ports (no-response), 26 closed tcp ports (conn-refused)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.5
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 f2:5a:a9:66:65:3e:d0:b8:9d:a5:16:8c:e8:16:37:e2 (ECDSA)
|_ 256 9b:2d:1d:f8:13:74:ce:96:82:4e:19:35:f9:7e:1b:68 (ED25519)
80/tcp open http nginx 1.24.0 (Ubuntu)
|_http-generator: WordPress 6.7.2
|_http-trane-info: Problem with XML parsing of /evox/about
|_http-title: Workaholic
|_http-favicon: Unknown favicon MD5: 6BD852FF8C391FD56DF5A8EF4C2DB7FC
|_http-server-header: nginx/1.24.0 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD POST
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
We have a wordpress site running on port 80
We ran wpscan and got to know that wp-advanced-search version 3.3.8 is installed
We found a sql injection vulnerability for this version of plugin
Ran the payload and got password hashes for wp_users
We got password by cracking hash : okadamat17 & chrish20 and rU)tJnTw5*ShDt4nOx from wp-config.php
Tried ssh bruteforce and we got charlie & wp-config password working
Got access as charlie
Got local.txt (2ba5cbd98b00e848562cde3c97d78aa0)
We have a wp-monitor SUID
After checking strings of the binary we see that it’s looking for /home/ted/.lib/libsecurity.so but didn’t found that library
We have write access to ted directory
So I followed this guide https://amanisher.medium.com/suid-sgid-shared-object-injection-linux-privilege-escalation-ecda5b05649b to create malicious .so file.
Created libsecurity.c file
Created .lib directory and moved libsecurity.so in it
Currently we don’t have any privilege as sudo
Ran the wp-monitor SUID binary & now we have ALL access as sudo
Got root
Got proof.txt (6cd6fc3eeae20db0f411e563a8e3d05c)
More walkthroughs
Full walkthrough of the BitForge box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 3306/mysql. Foothold to root using evil-winrm, kerberoasting, linpeas.
Full walkthrough of the CLUE box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Full walkthrough of the Cockpit box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.
Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.
Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.