TryHackMe | CTF | WebDevelopers
Can you root this Wordpress style machine? This CTF is all about hacking Wordpress. Developers watch out for this one!! TryHackMe has this amazing box at : https://tryhackme.com/room/webdeveloper. You can always LogIn on TryHackMe, go to rooms → webdeveloper.
1. Enumeration
Let’s find out the open ports on the machine. Port 22 and port 80 seem to be interesting ports. When I checked out the website on port 80, Wordpress website!!
I tried to view page source to make sure if there was anything useful, but I didn't get anything. Next, let’s start crawling using the gobuster.
Gobuster command needed some amendments, since the usual wordlist did not suffice my needs. I had to keep on changing the wordlists to make sure that I got some useful hints. I got the directory /ipdata which was insightful.
Additionally, later you will see why wp-content directory is also useful which I found after crawling through the wordlist common.txt
2. Brute Forcing
In this directory, I found there was a tcp dump and I downloaded it. The dump was .cap file, wireshark here we go. Therefore, I saved the .cap file on my kali linux machine.
After saving the .cap file, I was wondering what could I possibly find on the tcp dump? Credentials isn't it?? Someone must have logged in into something. A post request, I decided to use the filter http.request.method == “POST”
Look what I found, credentials… I got the username and password of the login account. Username: WebDeveloper, Password:Te5eQg%264sBS%21Yr%24%29wf%25%28DcAd
I used the cyberchef to input the encoded password that I found from the .cap file. After URL Decoding, I found the login password.
Let’s try to put the username and password to use. Woop Woop!! Wordpress hacker in the making.
3. Reverse Shell
After viewing the dashboard, I decided to go to the appearance section.
After heading to the appearance section, I went to the Editor section and decided to edit the themes. I would use this editing section for php reverse shell. You can find the reverse shell here: https://github.com/pentestmonkey/php-reverse-shell
You need to be able to check which theme is editable and edit that particular theme. For me, twentyfifteen theme worked well. Under that section, I used the archives.php to edit the theme with the php reverse shell. After editing, got the confirmation that the php file has been successfully updated.
Make sure that the listner is on for port 4444, since php reverse shell says so, using net cat.
Reverse shell was found by <IP Address>/wp-content/themes/twentyfifteen/archive.php
Never disappoint a blog reader😂. Reverse shell found!!
4. Privilege Escalation
Get Kapish Kuchroo’s stories in your inbox
Join Medium for free to get updates from this writer.
Wordpress often has a configuration file, usually it is found under /var/www/html. Configuration file is needed because I don’t have the password for the www-data user. Since I don’t have the password for that user, I can’t do sudo-l and check the privilege escalation possibility.
I found the configuration file and read the contents of the file using the cat command. I found the username and password for the mysql database.
I almost forgot about the port 22 and started using the new found credentials by switching the user. I was able to switch the user but it wouldn’t yield results, I will elaborate why later.
I realised that I should use the username and password for the ssh on port 22. I did that and logged in using using the credentials for webdeveloper.
I could now see the possibility of the privilege escalation using the sudo-l command. I found that the command tcpdump can bee used by the user webdeveloper. How cool is that?
I went to GTFO bins for the privilege escalation and I found an insightful information on how should I use the sudo permissions and escalate my privileges on the machine.
Here’s why I suggested not to do su <username> <password > earlier. If I want to get a reverse shell with root access, I would have to stop the shell which was currently running using the PHP reverse shell script. In doing so I would not be able to get another shell since the netcat listener wouldn’t be
able to pawn the shell on the same port 4444.
Privilege Escalation:
I made a new binary file called .batch3 in the /tmp folder.
I echoed the path where my reverse shell php is stored. It was stored on /var/www/html/wp-content/themes/twentyfifteen/archive.php. Remember this ?? Where we edited php reverse shell and used it to get a shell initially?
I check the contents in the /tmp folder, make sure that I can run the binary using chmod 755 on .batch3
That’s right so the binary file that I made just now has the path of the reverse shell and I will execute it and get a root shell using the information on GTFO bins.
Using the information on GTFO bins , I executed the binary and changed the file name as required.
Listener should be on before you run the command on port 4444.
WHOAMI?? ROOT ROOT ROOT!! Flag Found!!
