# Paper (Easy)

## Enumeration

### nmap

```
nmap -sC -sV -oA nmap/paper 10.10.11.143
```

```
# Nmap 7.91 scan initiated Mon May 23 03:41:30 2022 as: nmap -sC -sV -oA nmap/paper 10.10.11.143
Nmap scan report for 10.10.11.143
Host is up (0.078s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.0 (protocol 2.0)
| ssh-hostkey: 
|   2048 10:05:ea:50:56:a6:00:cb:1c:9c:93:df:5f:83:e0:64 (RSA)
|   256 58:8c:82:1c:c6:63:2a:83:87:5c:2f:2b:4f:4d:c3:79 (ECDSA)
|_  256 31:78:af:d1:3b:c4:2e:9d:60:4e:eb:5d:03:ec:a0:22 (ED25519)
80/tcp  open  http     Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9)
|_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
|_http-title: HTTP Server Test Page powered by CentOS
443/tcp open  ssl/http Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9)
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
|_http-title: HTTP Server Test Page powered by CentOS
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=Unspecified/countryName=US
| Subject Alternative Name: DNS:localhost.localdomain
| Not valid before: 2021-07-03T08:52:34
|_Not valid after:  2022-07-08T10:32:34
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon May 23 03:41:50 2022 -- 1 IP address (1 host up) scanned in 20.74 seconds

```

We can see there are pot 80 and 443 open

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2F6nAssOd5KTzLhcARznsv%2Fimage.png?alt=media\&token=0177519e-f1e9-4f4f-b258-168e71eca599)

There is nothing interesting here. After poking around for a while, I curl the page and found out we need to supply the domain name to the `/etc/hosts` file.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2F0T5vMy68hBiHstqA6h1I%2Fimage.png?alt=media\&token=9aa7512f-c995-4d66-a3b6-e6fe204a2096)

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FH8GLRswvJhNALumQbE6W%2Fimage.png?alt=media\&token=bde16dc4-8779-4c78-8cf2-1cc7a29a178c)

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FMp7rmvbWc4EtTMKEG1ld%2Fimage.png?alt=media\&token=afda787b-978a-4aac-aa87-c15e41c38fc6)

After that, we can see that we will get an entirely new page that has been made by WordPress.

By reading one of the posts on the forum, we may see the replies at one of the posts that might hint us something

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FA3hrLcMDfIB0X9uJnaX7%2Fimage.png?alt=media\&token=5923bac6-3791-4023-b07f-48f7e702436e)

Found a post regarding reading unauthenticated/draft post of WordPress [here](https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/).

There is a way to manipulate the URL to show unauthenticated posts by supplying the following variable.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FjjxSsHHRnMGiWcWegpCj%2Fimage.png?alt=media\&token=a611e1f4-402c-4f01-99a7-b7f398392c8a)

Putting **asc** as the value for the order does not work, but **desc** does.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FpcpkDCUmyb0aJzjjXpSi%2Fimage.png?alt=media\&token=39afc31c-7231-4f83-8d28-698cc863dde8)

We are able to see the "hidden" post now.

If we look closely, we are able to find the secret registration of the chat system URL address.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FYV04s9Zv1KROAuOLw8RH%2Fimage.png?alt=media\&token=9bf51603-1a7b-4dd4-b8ec-b36b510c63a3)

After registering the account, we are able to access the chat system of the organization.

It says that we are able to interact with the bots named "recyclops" by supplying commands.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2F1niHtTAFVasuYYZej3LP%2Fimage.png?alt=media\&token=6db3d33f-dc8f-46d8-a76c-2ced544cce5c)

2 most interesting commands right here.

After playing with the bot for a bit, I am able to list the `/etc/passwd` and `/self/proc/environ` files that are able to help me to further the process of exploitation.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FHExiCe63uEqhsOb5rQiD%2Fimage.png?alt=media\&token=39754a4b-e91d-4405-b57f-23365957f5a0)

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FDZnT3T2JhNh0hX7DriA9%2Fimage.png?alt=media\&token=36468041-a0ac-4bf0-9832-54500502cd17)

We can see the password for the bot is **Queenofblad3s!23**, then we proceed to login as dwight as he is the developer of this bot.

## User

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FFTXcwsEO2feuqiHirRHz%2Fimage.png?alt=media\&token=e7a95dc1-cd97-4bf0-8f52-dbd8ccdacf63)

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2Fthk7GCdw0nSZoQBNHk8U%2Fimage.png?alt=media\&token=01454751-8743-47c9-91e8-fc79eac256f0)

## Privilege Escalation

Use LinPeas to scan for vulnerability!

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FpahmszN9PaXwvGMzS7qC%2Fimage.png?alt=media\&token=e766df42-a7b4-4376-99fd-0349781dc7dc)

It shows it is vulnerable to [CVE-2021-35601](https://github.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation)

Clone the repository and run it on the victim machine!

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FaunMYB7J8r0RHLddkbLr%2Fimage.png?alt=media\&token=1de76ed6-ed7e-479b-afee-d2b755179964)

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FuxRrUFftmxgjP8cQdoKn%2Fimage.png?alt=media\&token=e707d2bb-a64b-4355-83ef-077f9ea23a19)

Got root!



