Loly
Introduction
This write-up details the steps taken to solve the Loly machine from Proving Grounds Play. The approach includes reconnaissance, enumeration, exploitation, and privilege escalation to gain root access.
Reconnaissance
I began with a full port scan using nmap to identify services and their versions:
Enumeration
Port 80
Upon visiting http://192.168.207.121/, the default nginx welcome page was displayed.
Since no obvious entry points were available, directory enumeration was performed using gobuster:
A directory named /wordpress was discovered, indicating the presence of a WordPress CMS.
Host Modification for Proper Resolution
Upon clicking Login, the page redirected to loly.lc/wp-admin/wp-login.php. This indicated that the application uses a virtual host configuration. To properly interact with WordPress, the hostname was added to `/etc/hosts.
Now, accessing http://loly.lc/wordpress/ correctly displayed the WordPress site:
WordPress Enumeration
To extract more information, wpscan was used to enumerate users, themes, and plugins:
Findings:
Identified Themes:
twentynineteen (1.7)
twentyseventeen (2.4)
twentytwenty (1.5)
virtue (3.4.2)
None of these themes had known public vulnerabilities, so theme-based exploitation was ruled out.
Identified Users:
A user named loly was found.
Given that password brute-forcing is a common attack vector on WordPress instances, this user can be targeted using credential stuffing or brute-force attacks.
Explotation
WordPress Brute-Force Attack
With the username loly identified, a brute-force attack was conducted using wpscan to determine the valid password:
The scan revealed loly's password:
Username: loly
Password: fernando
With these credentials, I successfully authenticated to the WordPress admin panel at: http://loly.lc/wordpress/wp-admin/
Identifying a File Upload Mechanism
During the post-login analysis, I found that the ADRotate plugin was installed. This plugin provides an ad banner management system and includes functionality to upload ZIP archives, which are automatically extracted.
This behavior can be exploited by uploading a ZIP file containing a malicious PHP shell and accessing it remotely to execute system commands.
A simple web shell was created to execute arbitrary commands via the cmd parameter:
The script was then compressed into a ZIP archive to bypass file upload restrictions:
The ZIP file was successfully uploaded using ADRotate, and the contents were extracted to the wp-content/banners/ directory.
By navigating to: http://loly.lc/wordpress/wp-content/banners/shell.php?cmd=id, I confirmed remote command execution:
To obtain an interactive shell, I triggered a reverse shell payload:
Before executing the payload, a Netcat listener was set up on the attack machine. Once the payload was executed, a reverse shell was successfully established:
TTY Treatment
Once I had successfully established the reverse shell, the session was not as stable or user-friendly as it could be. The shell I obtained was non-interactive, meaning it didn’t allow me to perform typical interactive tasks like tab completion, command history, or using commands like sudo properly.
To resolve this, I applied a TTY treatment to the shell, making it more stable and interactive. This was done by upgrading the shell to a fully interactive terminal using the following command:
After checking the contents of the /var/www directory, I discovered the user flag.
Privilege Escalation
After obtaining an initial shell, the goal is to escalate privileges to root. This process involves:
Lateral movement to a more privileged user.
Kernel exploitation to achieve full system control.
Lateral Movement - Escalating to User "loly"
Checking Running Services
Since MySQL configurations often store plaintext credentials, I searched for the WordPress configuration file, which usually contains database connection details.
Using these credentials, I logged into the MySQL database:
Credential Reuse for System Access
Although MySQL did not contain useful information, I attempted to reuse the password for system authentication. Upon entering "lolyisabeautifulgirl", I successfully switched to the loly user:
Kernel Exploitation - Escalating to Root
Running LinPEAS to enumerate privilege escalation vectors, I identified that the system was running a vulnerable Linux kernel version, exploitable via CVE-2017-16995.
On Attacker Machine:
Download the exploit from Exploit-DB and start an HTTP server to transfer it:
On Victim Machine:
Download the exploit using wget:
Once transferred, the exploit was compiled using gcc:
Running the compiled exploit successfully elevated privileges to root:
Last updated
