SoSimple

Summary

This machine initial access is based on enumeration of wordpress and identifying a public exploit for deprecated plugin version this leads to initial shell access. with shell access the user can move laterally to second user by locating sensitive access file. from the second user sensitive permission can lead to access to third user and almost the same thing that lead eventually from this last user to root.

Nmap Scan

Enuemration

Only SSH and HTTP services are present so let’s start looking at HTTP since SSH is rarely vulnerable

A quick look at the website shows only and image on the main page

I will try to find any other page or directories on this website, to do that I will run a directory/file bruteforce

as Showing above I was able to identify a wordpress website, looking at it I also identified a user “admin”

Let’s run WPscan and see what we can find more

this scan identified another user “max”

Foothold

With only usernames found I go for password bruteforce and starting with user “max” I use WPscan again to do the attack

This leads to the user password

Initial Access

Using the identified credentials for user “max” I can now login to wordpress so let’s see if we can elevate this to shell access

This did not show an obvious path to escalate since the user is not admin but looking back at WPscan results I see this

which leads to this page showing a plugin that exists on the server

this pluging seems to be vulnerable

so I will try these exploits but again without success, so I fall back to the other WPscan finding

this plugin also have exploits on searchsploit which successfully worked to get rev shell after fixing the URL and attacker IP in the script

from user www-data I was able to get local.txt flag

Privilege Escalation

I was able to find the SSH id_rsa key for user max

this let me login with this user

now from this user I find steven can run service command with sudo so let’s see how this is exploitable

I can find that on GTFObins

So with that I can move to user steven

the executable that steven can run with sudo does not exist but steven have permission to write the parent directory so I can just create the script

doing just that I was able to get shell as root and get the last flag proof.txt