SunsetMidnight
Last updated
Last updated
Add the machine IP to map to sunset-midnight in /etc/hosts.
After making the above changes when browsing to port 80 we come to a Wordpress page.
After scanning with WPScan I was unable to proceed with the found admin accout. Instead turning our attention to MySQL which we find does not block remote connections we can begin to brute force the root account.
We can then log into MySQL with the discovered credentials:
From here we can list databases then select the Wordpress database and extract information from the wp_users table.
We now have the admin hash of: $P$BaWk4oeAmrdn453hR6O6BvDqoF9yy6/ I tried cracking with hashcat using rockyou.txt and had no lucky. Luckily we are root on this session so we can actually update the table and change the password to something that we know.
The following website can be used to generate a has for wordpress: https://www.useotools.com/wordpress-password-hash-generator/output.
After doing so run the commands below in MySQL to update the password for the admin account.
We can then move to the /wp-admin/ directory on the webserver and login with our new credentials.
From here we are going to upload a malicious plug-in that will give us a reverse shell. We will be using wordpwn.py to achieve this: https://github.com/wetw0rk/malicious-wordpress-plugin.
After download run the scripts as per instructions on the GitHub page and then once created upload the malicious.zip over at: http://sunset-midnight/wp-admin/plugin-install.php.
Once uploaded activate the plug-in on the plug-in page then browse to the following to execute: http://sunset-midnight/wp-content/plugins/malicious/wetw0rk_maybe.php.
We are now 'www-data'.
Manually enumerating the target machine we know Wordpress is installed and as such the wp-config.php exists.
Reading the contents of wp-config.php gives us credentials for the user jose.
Whilst the password does look like a MD5 its important to note that this file the credentials are normally stored in plaintext. Given this we can attempt to switch to the jose user with these.
From here wen can use ssh-keygen to create a RSA key so we can then sign in with SSH for a much more usable shell.
Keep hitting enter until the key is generated. Once done so copy the contents of the key from /home/jose/.ssh/id_rsa over to the attacking machine.
We can then use the following command to set the correct permissions on key on the attacking machine:
Then login as jose over SSH.
Running linpeas on the target shows the binary /usr/bin/status has the SUID bit set.
Running strings on the binary
Looks like the binary is trying to run 'service' without the full path of the binary. Knowing this we can create a malicious service binary and export the path so our malicious binary is executed first.
In the home directory of jose run the following:
Once completed export the new path where /home/jose: is the starting path.
Once completed execute status and we should land a root shell.
