Maria

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.243.167
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-17 21:28 +08
Nmap scan report for 192.168.243.167
Host is up (0.17s latency).
Not shown: 65520 filtered tcp ports (no-response)
PORT      STATE  SERVICE
21/tcp    open   ftp
22/tcp    open   ssh
80/tcp    open   http
3306/tcp  open   mysql

Did a detailed scan too:

$ nmap -p 21,22,80,3306 -sC -sV --min-rate 3000 -Pn 192.168.243.167 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-17 21:30 +08
Nmap scan report for 192.168.243.167
Host is up (0.18s latency).

PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    5 0        0            4096 Sep 21  2018 automysqlbackup
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 192.168.45.231
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 74ba2023899262029fe73d3b83d4d96c (RSA)
|   256 548f79555ab03a695ad5723964fd074e (ECDSA)
|_  256 7f5d102762ba75e9bcc84fe27287d4e2 (ED25519)
80/tcp   open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Maria
|_http-server-header: Apache/2.4.38 (Debian)
|_http-generator: WordPress 5.7.1
3306/tcp open  mysql   MySQL 5.5.5-10.3.27-MariaDB-0+deb10u1

So port 21 has a file anonymous access, while port 80 is running Wordpress.

FTP Anonymous Creds

We can first enumerate this:

The /usr directory contained a automysqlbackup script:

I cannot download this file, but we can take note of the directory its in. The /etc folder also contained one:

Wordpress LFI -> SQL Creds

I ran an nmap script against Wordpress and it found this:

For some reason wpscan doesn't pick up on these. Anyways, this version of Duplicator is vulnerable to an LFI.

It works!

From this, we can read the automysqlbackup file. It turns out to be a very long bash script with a lot of irrelevant stuff. We can read the /etc/default/automysqlbackup file to find some credentials:

With this, we can login to the MySQL instance.

MySQL Enum -> WP Plugins -> Reset Mail

Let's enumerate wordpress and get the administrator hash:

However, this hash was unable to be cracked. I also could not overwrite it in anyway. I tried to reset the password of the admin user, but I could not get the confirmation link:

Seems like the only way to exploit this is to somehow capture that reset link. Within the wp_options table, I found another active plugin:

It seems that easy-wp-smtp.php is also enabled. And within the swpsmtp_options part of the options, we can find a directory present:

This file is located at /wp-content/plugins/easy-wp-smtp/, and from it we can get the password reset link:

Once visited, we can reset the password of the admin and login:

The exploit path to getting RCE from Wordpress is the same. (Appearance > Theme Editor > Replace 404.php with a PHP Web shell > Profit).

I reset the box here, so the IP addresses are different.

From here, we can easily get a reverse shell.

Privilege Escalation

Cronjob -> Binary Hijack

I ran pspy64 to enumerate the processes that were being run, and it found this:

I tried running the automysqlbackup, but it resulted in loads of errors. Within the errors, I saw this:

Seems that backup-post is a binary run that is not present within a directory that we have write access to. We can easily create a reverse shell like this:

Then we can place this within the /var/www/html/wordpress/backup_scripts directory as backup-post after running chmod 777 on it. We would get a reverse shell as root after waiting for a bit:

PreviousMantisNextMatrimony

Last updated