# Blogger

**Source**: Proving Grounds\
**OS**: Linux\
**Community Rating**: Hard (I don't know how, this was really easy)

## **Enumeration & Reconnaissance**

* I began, as usual, with autorecon, which revealed two open ports:
  * **SSH (22)**&#x20;
  * **HTTP (80)**

## **Service Analysis**

* A visit to the HTTP service showed a programmer’s personal site, nothing exciting at first. I proceeded with the usual checks (robots.txt, etc.) while letting fuzzers run in the background.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FN4eb477jziI7KfmqP3bB%2Fimage.png?alt=media&#x26;token=768532d9-96d9-45e3-b1cd-ee2f5d980641" alt="" width="375"><figcaption><p>The "Programmer/Blogger"</p></figcaption></figure>

* The fuzzers revealed an "assets" folder. Upon checking that folder, I found a WordPress site located under **/assets/fonts/blog/**

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FFF7HvZvLxJwOV7KIocog%2Fimage.png?alt=media&#x26;token=bfb4cd56-b91b-40fc-a7c0-d07b9c415c9d" alt="" width="375"><figcaption><p>/assets/fonts directory</p></figcaption></figure>

* After examining the blog, the hostname **http://blogger.pg** appeared, so I updated my **/etc/hosts** to properly resolve it.&#x20;
* Running wpscan in its default mode didn’t turn up any plugins; however, switching to aggressive plugin detection (using the `-p --plugins-detection aggressive` flag) exposed two plugins.&#x20;
* Additionally, two WordPress users were discovered during the scan. I then started a brute-force attack against these users while checking for known vulnerabilities in the identified plugins.

## Gaining Initial Access

* The vulnerable plugin, **wpdiscuz**, turned out to be the key.&#x20;
* A known CVE allowed me to upload a shell. Although my initial attempts to execute commands via the PoC failed, likely due to an issue with sending the commands in that PoC. However, the shell was successfully uploaded. I used the uploaded shell to secure a reverse shell on the target.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FbpPItsbnM5aAeFBD2BzH%2Fimage.png?alt=media&#x26;token=6d8e7320-6624-4cd0-897d-8c3c80b7115a" alt="" width="563"><figcaption><p>PoC Shell Upload</p></figcaption></figure>

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FgoqPjOZN1Un99KBaTfZ9%2Fimage.png?alt=media&#x26;token=4ef31178-acdb-459a-bd23-c5a99d54d9d9" alt="" width="563"><figcaption><p>Using the uploaded shell</p></figcaption></figure>

* After gaining initial access, I checked the wp-config file for credentials and found the username **root** and the password **sup3r\_s3cr3t**. However, these credentials didn’t work on any other services I tested.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FcwAIK5z5T5y0rzJ1UmWO%2Fimage.png?alt=media&#x26;token=459bfe00-ae2b-486b-9091-df6713a30a19" alt="" width="563"><figcaption></figcaption></figure>

## **Privilege Escalation**

* Once I had a foothold, I ran **linpeas.sh** to check for privilege escalation opportunities. The process was almost too easy.&#x20;
* I discovered the user **vagrant**, which was still using the default password "vagrant". Switching to this account was a no-brainer. Even more, the vagrant user was configured to execute all sudo commands without a password prompt, a quick `sudo -i` landed me straight into a root shell.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FmH7omimV2FqSQxiOwRux%2Fimage.png?alt=media&#x26;token=0e310c0f-fcc0-4e02-bc16-7081239ffa41" alt="" width="563"><figcaption><p>Privilege Escalation</p></figcaption></figure>

## **Lessons Learned**

* **Thorough Scanning:** Using aggressive detection modes with tools like wpscan can reveal vulnerabilities that a default scan might miss.
* **Default Credentials:** The discovery of the vagrant user with its default password highlights the risks of leaving default credentials in place.
* **Over-Privileged Accounts:** A misconfigured sudoers file can turn a minor vulnerability into a full system compromise.
