80

Its a wordpress site. So I ran WPScan:

wpscan -e ap --url http://metapress.htb
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.27
                               
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[i] Updating the Database ...
[i] Update completed.

[+] URL: http://metapress.htb/ [10.10.11.186]
[+] Started: Fri Jan 31 19:03:43 2025

Interesting Finding(s):

[+] Headers
 | Interesting Entries:
 |  - Server: nginx/1.18.0
 |  - X-Powered-By: PHP/8.0.24
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] robots.txt found: http://metapress.htb/robots.txt
 | Interesting Entries:
 |  - /wp-admin/
 |  - /wp-admin/admin-ajax.php
 | Found By: Robots Txt (Aggressive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://metapress.htb/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://metapress.htb/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://metapress.htb/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 5.6.2 identified (Insecure, released on 2021-02-22).
 | Found By: Rss Generator (Passive Detection)
 |  - http://metapress.htb/feed/, <generator>https://wordpress.org/?v=5.6.2</generator>
 |  - http://metapress.htb/comments/feed/, <generator>https://wordpress.org/?v=5.6.2</generator>

[+] WordPress theme in use: twentytwentyone
 | Location: http://metapress.htb/wp-content/themes/twentytwentyone/
 | Last Updated: 2024-11-13T00:00:00.000Z
 | Readme: http://metapress.htb/wp-content/themes/twentytwentyone/readme.txt
 | [!] The version is out of date, the latest version is 2.4
 | Style URL: http://metapress.htb/wp-content/themes/twentytwentyone/style.css?ver=1.1
 | Style Name: Twenty Twenty-One
 | Style URI: https://wordpress.org/themes/twentytwentyone/
 | Description: Twenty Twenty-One is a blank canvas for your ideas and it makes the block editor your best brush. Wi...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 | Confirmed By: Css Style In 404 Page (Passive Detection)
 |
 | Version: 1.1 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://metapress.htb/wp-content/themes/twentytwentyone/style.css?ver=1.1, Match: 'Version: 1.1'

[+] Enumerating All Plugins (via Passive Methods)

[i] No plugins Found.

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Fri Jan 31 19:03:51 2025
[+] Requests Done: 47
[+] Cached Requests: 7
[+] Data Sent: 11.483 KB
[+] Data Received: 22.015 MB
[+] Memory used: 284.344 MB
[+] Elapsed time: 00:00:08

And this box has virtual host, so it makes sense to run vhost fuzzing.

But I get nothing.

Here's what we know so far. Software and their version number:

  1. Wordpress - 5.6.2 - from 2021 which is old.

WPScan couldn't find any plugins which is weird. So I tried analyzing the source code manually. Searching on the /events page, we see a plugin called bookingpress-appointment-booking is used, and directory listing is enabled, so we can checkout this page for version number.

Its version 1.0.10. It is vulnerable to SQL injection vulnerability due to the lack of input sanitization. I found a working exploit for this CVE,

And we get the password hashes. They are both MD5(wordpress) hashes according to hash-identifier tool. Trying to crack admins hash took forever, but I was able to get manager hash.

We get our first credential: manager:partylikearockstar

We have ftp and ssh open. I tried the credentials on SSH but won't work, same with FTP.

Login into wp-admin

This is not an Administrative panel so we can't achieve PHP code execution with theme editor.

Authenticated XXE

According to this post, this version and any version prior to 5.7 is prone to authenticated XXE vulnerability. The XXE is in the file wp-includes/ID3/getid3.lib.php, which is used to extract metadata information from user uploaded media. As we know XXE vulnerability can be used for LFI to read source code, any other files where we might find sensitive information including credentials. Because this is a WP site, if we can read the wp-config.php, we might find credentials that might give us access to the FTP or SSH services open on the server.

This blog explains it in detail. I read through it to try to understand the vulnerability as much as I can complimented by my XXE notes that I took for CPTS.

I followed through this PoC. I was struggling so I went to the walkthrough.

Step 1: Creating a WAV file with our IP.

It starts with WAV audio files magic bytes. It will make a request (external entity) for a .dtd file that's on our machine. And in that file we can specify any file we want to read, exploiting LFI.

What it does is it base64 encodes the /etc/passwd and sends it as a parameter to our HTTP server where we will be listening. After that we can just decode it. This method is called Out-of-Band data exfiltration.

We start a PHP server that has a PHP file that can listen for and decode this:

Then I just have to upload it into media

As soon as I upload it we get the file back:

So we know it works. According to the writeup, the WPScan PoC shows that we can read wp-config.php file providing the path ../wp-config.php. So I updated the .dtd file to read this:

And we get back the wp-config.php file.

A bit garbled but we do get FTP_USER credentials. Lets try to log in with metapress.htb:9NYS_ii@FyL_p5M2NvJ

We also get the MySQL credentials blog:635Aq@TdqrCwXFUZ

PreviousEnumerationNextFTP - 21

Last updated