MetaTwo
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.228.95
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 05:13 EDT
Nmap scan report for 10.129.228.95
Host is up (0.0077s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open httpFTP doesn't support anonymous logins, so let's move on to port 80. We have to add metapress.htb to access it.
Metapress -> SQLI -> XXE
The website was a blog of some sorts:
Reading a bit of the page source reveals this is a Wordpress site, so let's use wpscan with the API token to enumerate plugins and the version.
This was the main exploit I found interesting because the version running on metapress.htb is version 5.6.2, while this was patched in 5.6.3. However, I don't have any credentials. Also, wpscan didn't pick up on any plugins for whatever reason.
While clicking on the URL within the blog post, I noticed that it was using a certain plugin.
This is a plugin that has a lot of vulnerabilities:
The traffic reveals that this is version 1.0.10. Googling for exploits related to this plugin returns this page with a PoC:
Using the exact PoC doesn't work though:
It seems that the wpnonce variable is incorrectly set. After changing it to a relevant one, we get confirmation that this works:
With this, we can retrieve the user hashes:
There were 2 hashes, and one of them could be cracked.
Now that we have credentials, we can run the authenticated XXE injection.
How this exploit works is by using the credentails to make the Wordpress site requests for a .dtd file. This is done by uploading a malicious .wav file via New Media, making the site request and execute the .dtd file. This would allow us to get LFI on the machine.
Following the PoC from the repo above, I was able to replicate it.
Using this .dtd file, we can grab the wp-config.php file:
Within that file, we can find FTP credentials:
We can login to FTP using metapress.htb:9NYS_ii@FyL_p5M2NvJ.
FTP Enum
After logging in to FTP, we can find a few directories:
Within the mailer directory, there are some PHP files:
Within the send_email.php file, there are some credentials for jnelson.
With these credentials, we can ssh in as jnelson.
Privilege Escalation
Passpie
Within the user's directory, there's a .passpie file present:
passpie is a command-line password manager:
The .keys directory contains a PGP key pair, which I'm assuming is used to decrypt the root.pass file. I took the private key from the .keys file, and cracked it using gpg2john > john.
With this password, we can decrypt the root.pass file:
Last updated