Stapler (Walkthrough)

Stapler (Walkthrough)

This Box Is From Vulhub You Can Download It From Link. i pwned this box by doing wordpress enumeration and an old exploit of ubuntu 16.04 which help me to get root permission.

Breaching Process 

Finding IP

• Nmap

Enumeration

• Browsing HTTP and HTTPS service
• Deep nmap scan for all ports found (12380) running in https
• Enumerating directory using nikto 
• Found robots.txt and other useful direcotry

Exploitation

• Injecting php code in plugin 
• Got reverse shell in meterpreter

Privilege Escalation

• Further enumeration found old Ubuntu (16.04)
• Got root permission (compiling bunch of exoloit)

Let's Breach 

Using nmap scan i found the box ip address.The ip address was 192.168.1.7

I browse the ip to see there was port 80 open and let the nmap scan  

There was not any interesting thing in 80 port.After seeing the and found nothing i go for nmap scan.

There was bunch of open port but the interesting port was ftp (21) 

Funny thing was i can enter as anonymous in ftp 

so,i quickly login to ftp  as anonymous

Found ftp was just a trap a DEADEND :( 

let's turn the step and go from begining

Then i enumerate the ip using enumlinux (script) 

There was bunch of directory that can be access without password

so, i quickly grab that 

First i go with kathy,

Now there was bunch of interesting file for wordpress (This give me the idea that there may be a wordpress site running )

I grab anything that i found but guess what nothing just nothing helped me to exploit

there was a another tmp directory

and i don't have hope with finding anything that will pwned the machine rather i go for it

and that's it was DEADEND

Let's again go from start and scan all the port

Now i go all port scan using nmap and okay i found new port hmmmmm......

Deep scanning the port 12380 i found that was running http and https port 

Surfing the https://192.168.1.7:12380

This was just a website writing coming soon

and i fire-up the nikto to found interesting directory.There was two directory

One was blogblog and another admin112233 

and i surf admin112233 that was just a redirection to some wierd xss website

Now let's surf  the blogblog site wow that was a wordpress site

Let's enumerate the wordpress with wpscan

as this website was a https so disable-tls-checks should be used

This was good so many username was dumped

i go the login page of wordpress 

Now let's bruteforce the username with password list 

It was a matter of second that it cracked the password of john and the password was incorrect

Let's login into the admin panel of wordpress

Boom i got logged in

As i want to get the reverse shell i generate the php reverse shell

using msfvenom you can generate the php reverse shell

I tried to get the reverse shell editing 404 templete haha 

There was not any editing permission 

There was another way to get reverse shell editing plugin.So,I copy the code php in reverse.php and save in my local computer.

Now,I upload in as add plugin in victim machine

Seeing in the directory of plugin uploads directory i found the reverse.php.So,this works like charm 

Let's try to get the reverse shell using meterpreter

So,I fire-up the msfconsole to catch the reverse shell

Boom i got the shell,

As, i got the shell and the shell was lazy  so import the tty shell and xterm 

Now i can clear the enviroment that's pretty good

Let's begin the privilege escalation 

As i found this box was ubuntu 16.04

I googled it and found out pretty interesting vulnerabilty

wget the address in tmp directory of victim machine 

As, it was a zip file you have to extract 39772.zip

and again extract the  exploit.tar

There you will get the bunch of c and sh file

So, running this file you will eventually end up with root 

First, of all run the compile.sh 

./compile.sh

and then 

./doubleput

There will be root shell after a minute 

so,after i got the root shell 

i cat the flag.txt 

that's done

HAPPY HACKING :)