> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/tryhackme/linux/all-in-one.md).

# All in One

https\://tryhackme.com/room/allinonemj

## Nmap

```
sudo nmap 10.10.140.124 -p- -sS -sV

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
```

Checking FTP shows we have access as an anonymous user. However, we have no files to display and are unable to write to the FTP directory.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-4be5f05f715cf9f54e42227cb506510380cac590%2Fimage.png?alt=media)

Over on port 80 the root page takes us to the Apache default install root page.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-0292efae03d8a12f0500f0a9150e9411a992fe0f%2Fimage.png?alt=media)

Running dirsearch.py against the target reveals the `/wordpress/` directory.

```
python3 dirsearch.py -u http://10.10.140.124 -w /usr/share/seclists/Discovery/Web-Content/big.txt --full-url -t 30
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-dd5a40cc5c880994575c73bca337cc58bdd8c993%2Fimage.png?alt=media)

And then over on the Wordpress root page:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-823a6936a921b8b5f991bbde5ce9f1909183228a%2Fimage.png?alt=media)

We can see straight away the user elyana which we can take a note off for now. From here we can run WP-Scan against the target to help identify issues on this Wordpress page.

```
wpscan --url http://10.10.140.124/wordpress/ -t 40 --detection-mode mixed --enumerate ap --plugins-detection aggressive 
```

From this WP-Scan finds some interesting and out of date plugins as shown below:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-31e2c2d6c02633e460ea6c45b861e19de6980235%2Fimage.png?alt=media)

Looking up exploits on exploit-db.com for Mail-masta shows that the latest version (1.0) is vulnerable to a local file inclusion vulnerability.

{% embed url="<https://www.exploit-db.com/exploits/40290>" %}

The proof of context the exploit author has shown is as follows:

`http://server/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd`

Performing the same PoC with the target server we can reveals the `/etc/passwd` file.

```bash
curl 'http://<IP>/wordpress/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd' 
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-0da9daca7c7a9363738f8c8a4993d270fb1bbd86%2Fimage.png?alt=media)

This again reveals the user elyana. I tried to brute force and attempted LFI on common files in her home directory where I was unable to find any information of interest.

Knowing that Wordpress is isntalled we can attempt to read the wp-config.php file usiing a base64 filter.

```bash
curl http://10.10.140.124/wordpress/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=php://filter/convert.base64-encode/resource=../../../../../wp-config.php
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-520ea239e5ed3a912253c12718522c9656bc0bdc%2Fimage.png?alt=media)

Taking the output and decoding with base64 reveals the configuration information we need.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-a993db91c0f0db13815e74c094e93a877a2b0434%2Fimage.png?alt=media)

With the credentials we now have I was then able to login to the Wordpress admin login.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-d84260eae97b29d052048d9935a39ad786dcb7ec%2Fimage.png?alt=media)

From here I was ableto use the Theme editor under the 'Appearance' menu to edit the main index.php webpage to be replaced with a reverse shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cf88456d001ea80bc83297fa9ea34f8d62acfdc8%2Fimage.png?alt=media)

I then updated the page and started a `netcat` listener to my specified port. Then after reloading the main index at `http://<IP>/wordpress/index.php` I was able to land a reverse shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-38df1847649083b46bbee3c26c29ff7de1ec1f2f%2Fimage.png?alt=media)

From here running Linpeas against the host shows multiple points of escalation. I will only be covering one in this instance which is the SUID bit being set on the bash binary.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-00e124d6977d1287feeb54ec7965ec5560cda2b7%2Fimage.png?alt=media)

Running the following command will call a 'sh' shell with bash under root privileges.

```bash
/bin/bash -p
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-59fa6e261b7ed611e8c40ddbb45aaf0fc2cf1145%2Fimage.png?alt=media)

From here we can grab the user and root flags. The flags are Base64 encoded and will need to be decoded to reveals the correct value.