search

Colddbox - Easy

As the machine description says - this is a WordPress machine with an easy level of difficulty. Machine can be found here : vulnhubarrow-up-right. It's an interesting room and I enjoyed the Privilege escalation part most.

hashtag
Enumeration:

1) First I need to discover machines IP. I have used netdiscover and found the IP : 10.0.2.44

netdiscover -i eth0 -r 10.0.0.0/16

2) First, searching all port using nmap: nmap -p- -v -T5 -Pn 10.0.2.44

PORT     STATE SERVICE
80/tcp   open  http
4512/tcp open  unknown

3) Now scanning the services are running: nmap -sV -A -p 80,4512 -v 10.0.2.44

PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-generator: WordPress 4.1.31
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: ColddBox | One more machine
4512/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4e:bf:98:c0:9b:c5:36:80:8c:96:e8:96:95:65:97:3b (RSA)
|   256 88:17:f1:a8:44:f7:f8:06:2f:d3:4f:73:32:98:c7:c5 (ECDSA)
|_  256 f2:fc:6c:75:08:20:b1:b2:51:2d:94:d6:94:d7:51:4f (ED25519)

4) For Further enumeration, I have used another tool: enum4linux. Nothing found.

enum4linux -v 10.0.2.44

Default web page

5) As the site is running WordPress, so I scan it. This scan gives me valuable info

wpscan -e -v --url http://10.0.2.44/arrow-up-right

6) I need some more info in order to start any attack. So, enumerate the web more. I have tried directory listing using gobuster:

gobuster dir -u http://10.0.2.44/arrow-up-right -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

hashtag
Exploitation:

7) I have found some interesting directory and username. So first try brute force the /wp-admin login page: wpscan --url http://10.0.2.44arrow-up-right -e u -t 50 -P /usr/share/wordlists/rockyou.txt

This attack give me a - username: c0ldd and password: 9876543210

Now I can log in with them.

8) There are 4 ways to get a reverse shell from the WordPress site.

  • Upload shell through the Theme

  • Upload shell through the Plugin

  • Themes template into 404.php

  • Using pre-installed Plugins into header.php

After some googling, I have found 2 well written article about getting a reverse shell. Reading them won't waste your time

I have modified the code below (given my VM IP to connect back) and uploaded as a zip. This code successfully works as a plugin.

Modified shell

9) In my attack box I have started a listener and then just 'Activated' it from WordPress dashboard. And I get user access.

hashtag
Privilege escalation:

(Failed attempt) I have tried these ways below and failed. So I noted them.

I was able to create folder in /tmp. So downloaded linpeas in /tmp but failed to execute. SUID finding command works: find / -perm -u=s -type f 2>/dev/null, but not useful. Python3 is running there.

10) After so many failed attempt, I have tried the command below. Database leaked some info there: cat wp-config.php | grep DB

11) DB password could work. So I started to try it, but neither there was any terminal open nor the sudo run access. So then I created a terminal using python3. I have marked them in the picture below

12) Further enumeration says, 3 service running as root: sudo -l

13) Running Vim can also give me root access, but I have tried FTP. Running ftp and then /bin/bash.

Thanks for reading. Hope this amazing CTF and write up will help you a lot.

Last updated