> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/facil/escolares.md).

# Escolares

## Maquina

<figure><img src="/files/oQcU67E4Ibtv7mcoxiTZ" alt=""><figcaption></figcaption></figure>

## Reconocimiento

### Nmap

```bash
sudo nmap -p- --open -sS -sC -sV --min-rate 5000 -vvv -n -Pn 172.17.0.2 -oN nmap.txt
```

```
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.6p1 Ubuntu 3ubuntu13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 42:24:24:f5:66:68:a4:ad:8e:24:0d:70:4a:a5:e3:4f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJpzsBdS7+/16sAwAB6NLHrChW8GYQNAM7w+wJ/TacFehCfLyWepCBKXHXDqwhGs4yeZV+ny9eI2+boawC8AIaM=
|   256 29:42:2e:b6:85:ae:fb:09:89:8d:b9:c1:dc:4d:fc:1e (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHaknDwhdf9aeQuv8ehUJqqDpVhR04TUjp+GegAIv5iq
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.58 ((Ubuntu))
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-title: P\xC3\xA1gina Escolar Universitaria
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
MAC Address: 02:42:AC:11:00:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Gobuster

```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/assets               (Status: 301) [Size: 309] [--> http://172.17.0.2/assets/]
/wordpress            (Status: 301) [Size: 312] [--> http://172.17.0.2/wordpress/]
/javascript           (Status: 301) [Size: 313] [--> http://172.17.0.2/javascript/]
/phpmyadmin           (Status: 301) [Size: 313] [--> http://172.17.0.2/phpmyadmin/]
/server-status        (Status: 403) [Size: 275]
Progress: 219391 / 220561 (99.47%)
===============================================================
Finished
===============================================================
```

#### Wordpress

```bash
sudo gobuster dir -u 172.17.0.2/wordpress -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobusterWordpress.txt
```

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2/wordpress
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/wp-content           (Status: 301) [Size: 323] [--> http://172.17.0.2/wordpress/wp-content/]
/wp-includes          (Status: 301) [Size: 324] [--> http://172.17.0.2/wordpress/wp-includes/]
/wp-admin             (Status: 301) [Size: 321] [--> http://172.17.0.2/wordpress/wp-admin/]

===============================================================
Finished
===============================================================
```

#### PHP

```bash
sudo gobuster dir -u 172.17.0.2/phpmyadmin -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2/phpmyadmin
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/templates            (Status: 403) [Size: 275]
/themes               (Status: 301) [Size: 320] [--> http://172.17.0.2/phpmyadmin/themes/]
/doc                  (Status: 301) [Size: 317] [--> http://172.17.0.2/phpmyadmin/doc/]
/js                   (Status: 301) [Size: 316] [--> http://172.17.0.2/phpmyadmin/js/]
/libraries            (Status: 403) [Size: 275]
/sql                  (Status: 301) [Size: 317] [--> http://172.17.0.2/phpmyadmin/sql/]
/locale               (Status: 301) [Size: 320] [--> http://172.17.0.2/phpmyadmin/locale/]
Progress: 220560 / 220561 (100.00%)
===============================================================
Finished
===============================================================
```

### Wpscan

```bash
sudo wpscan --url http://172.17.0.2:80/wordpress/ -e u
```

{% hint style="info" %}
La opción *`-e`* sirve para enumerar, *`-e u`* enumera usuarios.
{% endhint %}

```
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.25
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://172.17.0.2/wordpress/ [172.17.0.2]
[+] Started: Wed Aug 14 23:10:50 2024

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.58 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://172.17.0.2/wordpress/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://172.17.0.2/wordpress/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://172.17.0.2/wordpress/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://172.17.0.2/wordpress/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.5.4 identified (Insecure, released on 2024-06-05).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://172.17.0.2/wordpress/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.4'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://172.17.0.2/wordpress/, Match: 'WordPress 6.5.4'

[+] WordPress theme in use: twentytwentyfour
 | Location: http://172.17.0.2/wordpress/wp-content/themes/twentytwentyfour/
 | Last Updated: 2024-07-16T00:00:00.000Z
 | Readme: http://172.17.0.2/wordpress/wp-content/themes/twentytwentyfour/readme.txt
 | [!] The version is out of date, the latest version is 1.2
 | [!] Directory listing is enabled
 | Style URL: http://172.17.0.2/wordpress/wp-content/themes/twentytwentyfour/style.css
 | Style Name: Twenty Twenty-Four
 | Style URI: https://wordpress.org/themes/twentytwentyfour/
 | Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.1 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://172.17.0.2/wordpress/wp-content/themes/twentytwentyfour/style.css, Match: 'Version: 1.1'


[i] User(s) Identified:

[+] luisillo
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
```

## Explotación

Gracias a wpscan hemos sacado un usuario, `luisillo`, por lo que procedemos a sacar la contraseña de este usuario, en este caso usamos la misma herramienta.

```bash
sudo wpscan --url http://172.17.0.2/wordpress/ -U luisillo -P /usr/share/wordlists/rockyou.txt
```

{% hint style="info" %}
La opción `-U` sirve para decirle el usuario, y la opción *-P* para pasarle una lista con la que probar contraseñas
{% endhint %}

Este proceso lleva mucho tiempo, por lo que en vez de usar este diccionario crearemos uno con la herramienta [Cupp](https://github.com/Mebus/cupp), que es un generador de contraseñas comunes.

Los datos para este usuario los podemos encontrar aqui:

<figure><img src="/files/KfCTPecHDFEWFLAVDxgh" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/PjPIxZBBMUsTulU5JVGt" alt=""><figcaption></figcaption></figure>

```bash
sudo wpscan --url http://172.17.0.2/wordpress/ -U luisillo -P luis.txt
```

<figure><img src="/files/sJ6eV1AGEnOalat4eVKg" alt=""><figcaption></figcaption></figure>

Una vez sacamos la contraseña de este usuario, nos metemos en `/wp-admin`

<figure><img src="/files/kXZ8wzfqGSOJ3KikopcU" alt=""><figcaption></figcaption></figure>

Nos da error por lo que tenemos que meter este dominio en `/etc/hosts`&#x20;

<figure><img src="/files/OpaCuwn7TUfTJi5Ynno5" alt=""><figcaption></figcaption></figure>

Ahora ya podemos iniciar sesión como el usuario `luisillo` y la contraseña que hemos sacado antes

<figure><img src="/files/8r37PPx6QESNufs9ri1h" alt=""><figcaption></figcaption></figure>

Una vez dentro si buscamos veremos que hay una opción que nos permite subir plugins hechos por nosotros

<figure><img src="/files/XZCCvTknYTMdi4ZBOeQ3" alt=""><figcaption></figcaption></figure>

Si subimos una shell de php comprimida en `.zip` nos dará error

<figure><img src="/files/m7BEiOMV9mtDsRwhWgTD" alt=""><figcaption></figcaption></figure>

Por lo que si buscamos en internet "[Reverse shell wordpress plugin](https://www.sevenlayers.com/index.php/179-wordpress-plugin-reverse-shell)", daremos con una pagina que nos dará una parecida a esta:

<figure><img src="/files/cHrD7IsBREePlsAMLRWQ" alt=""><figcaption></figcaption></figure>

Si la comprimimos y la subimos ya nos funcionara, importante activar el plugin, que si no no funcionara

<figure><img src="/files/PGsJHFS2G1a5NIlWOyLO" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/LB3n77L3f31i9Xf7BsKe" alt=""><figcaption></figcaption></figure>

## Escalado de privilegios

Buscando tardaremos poco en encontrar el archivo `secret.txt`, el cual contiene la contraseña del usuario `luisillo`

<figure><img src="/files/HLJHkuAM7IpJQbXPmiBw" alt=""><figcaption></figcaption></figure>

Miramos los permisos de luisillo, y [explotamos el binario](https://gtfobins.github.io/gtfobins/awk/) que podemos utilizar y de esta forma seremos root

<figure><img src="/files/LkasROjutMBwWJJvITf9" alt=""><figcaption></figcaption></figure>

## Conclusion

Una maquina muy interesante que nos sirve para practicar las explotaciones a WordPress&#x20;