Starting with the usual port scan leads to the discovery of 3 open ports:
/tmp/tmp.AeOoNDEiCu ❯ hping3 -S --scan 1-65535 10.10.11.125 | grep -v "Not" | tee general/hping3/syn_scan root@kali
Scanning 10.10.11.125 (10.10.11.125), port 1-65535
65535 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+-----+
|port| serv name | flags |ttl| id | win | len |
+----+-----------+---------+---+-----+-----+-----+
All replies received. Done.
22 ssh : .S..A... 63 0 64240 44
80 http : .S..A... 63 0 64240 44
1337 : .S..A... 63 0 64240 44
I like to use hping3 because I find it to be faster than nmap, then I run a more detailed nmap scan while enumerating another service.
/tmp/tmp.AeOoNDEiCu ❯ nmap -sT -sC -sV -p- 10.10.11.125 -oA general/nmap/popular 9s root@kali
Starting Nmap 7.92 ( <https://nmap.org> ) at 2024-06-22 22:49 NZST
Nmap scan report for 10.10.11.125
Host is up (0.042s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 b4:de:43:38:46:57:db:4c:21:3b:69:f3:db:3c:62:88 (RSA)
| 256 aa:c9:fc:21:0f:3e:f4:ec:6b:35:70:26:22:53:ef:66 (ECDSA)
|_ 256 d2:8b:e4:ec:07:61:aa:ca:f8:ec:1c:f8:8c:c1:f6:e1 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-generator: WordPress 5.8.1
|_http-title: Backdoor – Real-Life
1337/tcp open waste?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 36.29 seconds
Interestingly, nmap is unable to figure out what is at port 1337. We make a note of this and focus on port 80 for now.
nmap reveals that port 80 is hosting a wordpress page running wordpress 5.8.1.
Visiting the page hosted at the ip reveals a page that consists of template boilerplate text:
Clicking home takes me to a page hosted at backdoor.htb .
I assume that it is the hostname of the box so I add it to my hosts file accordingly:
/tmp/tmp.AeOoNDEiCu ❯ echo "10.10.11.125 backdoor.htb" >> /etc/hosts root@kali
/tmp/tmp.AeOoNDEiCu ❯ cat /etc/hosts root@kali
127.0.0.1 localhost
127.0.1.1 kali.lan kali
#The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
10.10.11.125 backdoor.htb
Running whatweb, gobuster and nmap’s http-enum revealed nothing interesting so I chose to run wp-scan with the default parameters which also revealed nothing that led anywhere of consequence.
/tmp/tmp.AeOoNDEiCu ❯ wpscan --url <http://backdoor.htb> --api-token <REDACTED> | tee 80/wpscan
_______________________________________________________________
__ _______ _____
\\ \\ / / __ \\ / ____|
\\ \\ /\\ / /| |__) | (___ ___ __ _ _ __ ®
\\ \\/ \\/ / | ___/ \\___ \\ / __|/ _` | '_ \\
\\ /\\ / | | ____) | (__| (_| | | | |
\\/ \\/ |_| |_____/ \\___|\\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.8.25
Sponsored by Automattic - <https://automattic.com/>
@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
[+] URL: <http://backdoor.htb/> [10.10.11.125]
[+] Started: Sat Jun 22 23:17:27 2024
Interesting Finding(s):
[+] Headers
| Interesting Entry: Server: Apache/2.4.41 (Ubuntu)
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: <http://backdoor.htb/xmlrpc.php>
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - <http://codex.wordpress.org/XML-RPC_Pingback_API>
| - <https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/>
| - <https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/>
| - <https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/>
| - <https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/>
[+] WordPress readme found: <http://backdoor.htb/readme.html>
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] Upload directory has listing enabled: <http://backdoor.htb/wp-content/uploads/>
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: <http://backdoor.htb/wp-cron.php>
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - <https://www.iplocation.net/defend-wordpress-from-ddos>
| - <https://github.com/wpscanteam/wpscan/issues/1299>
...