Skip to content

Paper.md

Latest commit

 

History

History
153 lines (85 loc) · 4.66 KB

Paper.md

File metadata and controls

153 lines (85 loc) · 4.66 KB
Raw

HTB - Paper

Introduction

This penetration test report documents the assessment of a target with IP address 10.10.11.143. The target had three open ports: 22 (SSH), 80 (HTTP), and 443 (SSL/HTTP). The report details the techniques and commands used during the assessment.

Initial Enumeration

Nmap Scan

The initial port scan was performed using Nmap to identify open ports on the target:

nmap -sV 10.10.11.143 -p-
  • Port 22/tcp: Open SSH (OpenSSH 8.0, protocol 2.0)
  • Port 80/tcp: Open HTTP (Apache httpd 2.4.37, CentOS)
  • Port 443/tcp: Open SSL/HTTP (Apache httpd 2.4.37, CentOS)

Web Application Assessment

Directory Enumeration with Dirb

Dirb was used to enumerate directories and files on the webserver:

dirb http://10.10.11.143/

Exploring "office.paper"

Using Sn1per:

image

The suggestion to use "wfuff" for subdomain scanning was followed, and the domain "office.paper" was added to the hosts file for further investigation.

echo "10.10.11.143 office.paper" >> /etc/hosts

WordPress Enumeration

A WordPress installation was discovered on the "office.paper" domain:

image

WPScan was used to enumerate WordPress users:

wpscan --url http://office.paper --disable-tls-checks --enumerate u

image

This identified several users, including "prisonmike," "nick," and "creedthoughts"

Vulnerable Plugins Enumeration

The enumeration of vulnerable plugins was performed using WPScan:

wpscan --url http://office.paper --disable-tls-checks --enumerate vp

no result

WordPress Draft Exploitation

An insecure draft was found on the WordPress site. A Google search led to the discovery of a WordPress draft exploit:

image

https://www.exploit-db.com/exploits/47690

By appending "?static=1" to a WordPress URL, the secret content of the draft was exposed:

http://office.paper/?static=1

The URL found in the insecure draft was accessed, requiring an addition to the hosts file

The hosts file was updated:

sudo sed -i 's/10.10.11.143/10.10.11.143 chat.office.paper/g' /etc/hosts

image

Rocket.Chat Exploitation

Upon registering an account on the new "chat.office.paper" URL, a bot named "recyclops" was discovered in the chat. A conversation with the bot revealed that it could fetch files.

Commands such as 'recyclops get me the file test.txt' or 'recyclops file test.txt' were used to fetch files. The bot responded by sending back file content.

image

image

clear password in file ../hubot/.env (the bots send back file content)

image

The bot revealed sensitive information, including credentials:

  • Queenofblad3s: Dwight's password

    image

Privilege Escalation

To escalate privileges, the following steps were taken:

  1. Connecting via SSH as user "dwight" using the obtained password.
  2. Launching LinEnum (lse) to enumerate system information.

LinEnum results highlighted:

  • Uncommon setuid binaries.
  • GIT/SVN repositories.
  • The presence of SELinux.
  • Services listening only on localhost.
  • Apache modules.
  • Write access to a gpg-agent socket.
  • Processes running with root permissions.

Polkit pwnkit was identified as a vulnerability. CVE-2021-3560 was exploited using the provided PoC script:

image

https://raw.githubusercontent.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation/main/poc.sh

The user "secnigma" was escalated to root privileges:

su - secnigma
sudo su

We are root.

Conclusion

In conclusion, this penetration test successfully identified vulnerabilities in the target system, allowing for WordPress enumeration, Rocket.Chat exploitation, and ultimately, privilege escalation through CVE-2021-3560. The report provides a detailed account of the techniques and commands used during the assessment.