User Flag

First, I used wpscan (you can get a free API token at https://wpscan.com/register).

I had to scan more aggressively or wpscan would find anything.

It looks like the ebook-download plugin is vulnerable to path transversal, as described in CVE-2016-10924.

Since I couldn’t find any proof of concept, I instead searched for the source code of the vulnerable plugin which I found here https://wordpress.org/plugins/ebook-download/#developers.

Looking through the revisions, I found the same version that is installed on the server (v1.1) : https://plugins.trac.wordpress.org/browser/ebook-download/trunk?rev=1379105&order=name.

I then downloaded it and decided to inspect the source code using Snyk Code.

Snyk found the path traversal vulnerability that we were looking for. While you should be able to find vulnerabilities in source code without the help of an automated tool (because it might miss things), I like to review code myself, and then run Snyk to see if we both find the same things.

So, in filedownload.php, it looks like the script just takes any file specified by the ebookdownloadurl argument and sends it back without any verification.

Let’s try to download /etc/passwd.

I then tried to get the content of /home/user/.ssh/id_rsa but I didn’t get any result back.

I don’t get any result either when I try to get the content of /home/user/user.txt, which indicates me that we are probably reading files as www-data which is why we don’t have reading permissions in the /home/user directory.

After looking up on google on how to get a RCE from a LFI, I found multiple blogs that wrote about enumerating the /proc directory. From what I understand, the /proc directory is a pseudo filesystem that stores information about the running processes, but in a file format readable by cat for example.

In my enumeration, I stumbled upon /proc/959/cmdline.

Which means this command runs on the server :

/bin/sh -c 
	while true;
		do su user -c "
			cd /home/user;
			gdbserver --once 0.0.0.0:1337 /bin/true;
			";
	done

Now that gives us a bit more information on that weird thing running on port 1337 that nmap couldn’t recognize.

According to the gdbserver documentation, gdbserver is a remote debugging server to which we can simply connect to and execute things.

Fortunately for us, there is already a metasploit module that allows us to easily upgrade a gdbserver connection to a more convenient shell. Note that the PAYLOAD and TARGET options in metasploit need to be fine tuned for the “exploit” to work.

Root Flag

First, I stabilized the shell because the shell I had made me scream internally.

python3 -c 'import pty; pty.spawn("/bin/bash")'

Then I ran linpeas and this came out in the running processes :

root         952  0.0  0.1   8352  3412 ?        S    15:06   0:00  _ /usr/sbin/CRON -f
root         960  0.0  0.0   2608  1740 ?        Ss   15:06   0:10      _ /bin/sh -c while true;do sleep 1;find /var/run/screen/S-root/ -empty -exec screen -dmS root ;; done

After some googling, I found that screen is some sort of session manager :

When screen is called, it creates a single window with a shell in it (or the specified command) and then gets out of your way so that you can use the program as you normally would. Then, at any time, you can create new (full-screen) windows with other programs in them (including more shells), kill existing windows, view a list of windows, turn output logging on and off, copy-and-paste text between windows, view the scrollback history, switch between windows in whatever manner you wish, etc.

Also, it looks like anyone can attach to any running session that isn’t already in use. The -x option allows us to attach to a running session

-x Attach to a not detached screen session. (Multi display mode).

Listing the currently running sessions owned by root :

user@Backdoor:~$ screen -ls root/root
There is a suitable screen on:
        1008.root       (01/05/22 15:06:34)     (Multi, detached)
1 Socket in /run/screen/S-root.

We can then attach to it.

user@Backdoor:~$ screen -x root/1008.root

root@Backdoor:~# id
uid=0(root) gid=0(root) groups=0(root)