# ThisIsSoEasy1

## Enumeration

### Nmap

We can start by enumerating the services after getting the IP address.

```bash
nmap -sC -sV 10.10.235.212
```

```bash
Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-11 00:32 EST
Nmap scan report for 10.10.235.212
Host is up (0.39s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 0        0            4096 May 25  2021 secret
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.4.7.170
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 3234d4a6b96105f8d97718822693dafa (RSA)
|   256 44dcabdd8827335928d945f6af2f1c3c (ECDSA)
|_  256 6774d81cb61647b7db4d82c4661b5ef3 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-robots.txt: 1 disallowed entry 
|_/
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 64.83 seconds
```

As we can see, there are few ports open such as 80, 22, 21

We can first put the IP at the browser since port 80 is open.

### HTTP

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FAsq9zYX4nHITw6hNMvdu%2Fimage.png?alt=media&#x26;token=7e2a80f3-4895-44ac-9df5-553bececc222" alt=""><figcaption></figcaption></figure>

**Flight Details page**

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FMN6uvUliECCRXKO9N3Mx%2Fimage.png?alt=media&#x26;token=61a0db9b-dad3-4492-82e6-456b73226c9f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FfQmaFa41ceJi3I9H1uJ5%2Fimage.png?alt=media&#x26;token=c8590b35-d242-4bfe-aaa4-f28f2379c29f" alt=""><figcaption></figcaption></figure>

For the Wordpress we can see it redirects to a specific domain. What we can do is add the domain to our **/etc/hosts**.

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FJ24OpgtXuNzpErnNq5MW%2Fimage.png?alt=media&#x26;token=88cc19e5-e058-4f4a-8ab8-150f9db1d948" alt=""><figcaption></figcaption></figure>

Reload the page and we get this!

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FIK2VmKmo9fckPBmWF9BU%2Fimage.png?alt=media&#x26;token=c1bfba54-d8e2-4e8a-9a9b-9aebff0f638b" alt=""><figcaption></figcaption></figure>

### FTP

For the FTP, we can login using anonymous login. We then found out there is a secret folder available inside. Inside the secret folder there is a TODO.txt

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2F2L1yYBjUiPPFFmqAa8Q1%2Fimage.png?alt=media&#x26;token=5d64a474-c695-467c-9f26-4fdfebd15219" alt=""><figcaption></figcaption></figure>

cat the TODO.txt

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2F5eQhpX36wR5KqBPAbfRs%2Fimage.png?alt=media&#x26;token=e9babaf1-234c-4099-88bd-38b592e82e86" alt=""><figcaption></figcaption></figure>

Interesting.

After poking around for some time, I found out that the flightPage is actually a rabbit hole and it contains nothing interesting in it.



### WPScan

Moving to the Wordpress website, we can use a tool called [wpscan](https://github.com/wpscanteam/wpscan) to enumerate the wordpress website.

```bash
wpscan --url http://thisissoeasy.local/wordpress/ --enumerate u,ap --plugins-detection aggressive
```

```bash
Options:
u - users
ap - all plugins
```

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FqU8UIzgMa8XywvvwXEDV%2Fimage.png?alt=media&#x26;token=87fc009b-6f7a-401d-b110-bb50719acce4" alt=""><figcaption></figcaption></figure>

We can see from the wpscan output, the users that detected by wpscan is administrator and jane.



We can navigate to **/wp-admin** to try to brute-force or login with default credentials.

Upon trying here and there, and also some hints we got from the TODO.txt, we got to log in to the WordPress admin dashboard with the username **administrator** and password **admin**

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FYbel3pKiXAzDhjZfi5lG%2Fimage.png?alt=media&#x26;token=f16f52ae-90f8-4b80-aa24-6340e42f619a" alt=""><figcaption></figcaption></figure>

We can then navigate to Appearance -> Theme Editor

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2F3xwmoq96FtsyDMpbfLtY%2Fimage.png?alt=media&#x26;token=c3485086-4176-4652-9543-533c0bd94fae" alt=""><figcaption></figcaption></figure>

Navigate to **404 Template**

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2F5Xf1QER7opayHOdgGJ3n%2Fimage.png?alt=media&#x26;token=61e6712f-7b0b-4580-aa6c-e10cd2117e86" alt=""><figcaption></figcaption></figure>

## Reverse Shell

We can replace it with PHP Reverse Shell

Website to generate various Reverse Shell -> [RevShells](https://www.revshells.com/)

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2F4MuSQ8aKaYZVn94NLRcf%2Fimage.png?alt=media&#x26;token=80f88696-3978-40f5-92aa-6ff18a2c8f39" alt=""><figcaption></figcaption></figure>

Choose the PHP PentestMonkey Reverse Shell.

Copy the contents and replace it to the 404 template

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2Faw2tNVQFNkMm4BsGekks%2Fimage.png?alt=media&#x26;token=93783eaf-7da1-44e6-9420-b1952679851b" alt=""><figcaption></figcaption></figure>

Update the file.

At our own Kali machine, set up a reverse shell listener

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FGcwN7zKqIJGETN8hSlNj%2Fimage.png?alt=media&#x26;token=bcc811cf-38db-4b24-87a4-bac50df2e25b" alt=""><figcaption></figcaption></figure>

Navigate to this link

```bash
http://thisissoeasy.local/wordpress/wp-content/themes/twentytwenty/404.php
```

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FL1tC7c8MlACKjMpMLHlP%2Fimage.png?alt=media&#x26;token=c19c104d-276b-420f-a8b4-c15d398d2f3f" alt=""><figcaption></figcaption></figure>

Got a reverse shell back!

## User

Navigate to **/var/www** and we get the user flag.

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FPsDfAyXCMQOhHbR9fctN%2Fimage.png?alt=media&#x26;token=54b0f3ba-b1f4-4e48-a26c-72f790d1c3ff" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

First thing we can do (before passing in any scripts) is by supplying **sudo -l**

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2F9LGPj0KrHbgHfWP2ak1g%2Fimage.png?alt=media&#x26;token=e014a52b-0f80-4da6-ad95-d0c63f950b4b" alt=""><figcaption></figcaption></figure>

we can see the user can execute env command by using sudo.

There is a website that list down all of the sudo and SUID privilege escalation -> [GTFOBins](https://gtfobins.github.io/gtfobins/env/#sudo)

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2Fu4Z0qCgOj2fd8jVZXpc3%2Fimage.png?alt=media&#x26;token=eb89f5ac-bab5-469b-a1c4-095835e045e6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FOmAKxr4pDMm28xjr2oqM%2Fimage.png?alt=media&#x26;token=5bd80bcb-0e61-49ad-9be1-956db14931e2" alt=""><figcaption></figcaption></figure>

Got root right away!

<figure><img src="https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M6jqZqh8dnhmWJDpTuf%2Fuploads%2FDCNorwuPehloJsyABttH%2Fimage.png?alt=media&#x26;token=765f846a-f37e-4a18-b0aa-b3d1124a528c" alt=""><figcaption></figcaption></figure>

Boom, flag! Congratz!
