Paper
Personal Rating: Easy
Last updated
Personal Rating: Easy
Last updated
Running an nmap scan:
sudo nmap -A <IP>
I found the subdomain office.paper in the header. Its a Wordpress site.
I started subdomain/vhost fuzzing with ffuf as well as a wpscan.
I added the discovered subdomains to my hosts file
chat.office.paper/livechat was particularly interesting
Additionally, Wappalyzer detected Handlebars to be in use.
The wordpress version was vulnerable, checking the wpscan output. If you append ‘?static=1’ to the url, you can view otherwise hidden content.
I registered an account
There was a group chat with interesting information
This bot could potentially give me the ssh key, but it did not work
Enumerating the folder of the webapp, a config file can be found that contains credentials
Using the creds recyclops:Queenofblad3s!23 I could log in with ssh with the user dwight. The password was reused and from the enumeration with the bot I knew that the user dwight exists on the system.
Running LinPEASS, Baron Samedits's sudo exploits are suggested, but the PoCs that I tried did not work. The host was also vulnerable to the well-known polkit exploit CVE-2021-3560, which could be exploited with this PoC
From the content revealed I got the url which is the secret registration url mentioned earlier
