2

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to be even asked about that bit of information..

Well, I have downloaded the plugin WPTerm, with which I can call python scripts or write php files to be executed in the front end, but I run into trouble due to the following issues:

sudo is not available: sh: 1: sudo: not found

su does not work: su: must be run from a terminal

ssh and nc are also not available

It seems that this webserver runs in a docker environment and the Loginizer plugin tells me, that the server has the private IP Address: Server's IP Address 172.18.0.6

How the hell do I spawn an interactive shell where I can bypass the "su: must be run from a terminal" error message? I seriously have no idea what to do next, maybe some kind of shellcode for php or python would work.

bumped to the homepage by Community 2 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • A note on the lack of nc, have you also checked for ncat and netcat as commands? And what happens if you run commands using sh -c "command"? – JonRB Mar 28 '18 at 0:28
  • Why not use script to give the password to su? – forest Mar 31 '18 at 5:52
0

You could try to install bad scripts (viruses) after reading and adapt them:

  • PHP Shell PHP Shell or p0wny@shell

    A webpage presenting a FORM with a lot of features, including command line.

  • Perl IRC Bot Warr1024/logbot.pl or tlongren/bot.pl

    For this, a IRC server may be usefull. Read carefully the script and change IRC server, user and password...

Be carefull, playing with this kind of tools! Ensure you clearly understand what you do!

  • And have the proper (real world) permission to do so. – ThoriumBR Jul 31 '18 at 19:50
0

Basically, you can try by starting a PTY shell:

echo "import pty; pty.spawn('/bin/bash')" > /tmp/abcd.py
python /tmp/abcd.py

After that, you could install sudo (but I think that it's not necessary because after su -, you are a root user) with:

su -
apt-get install sudo
  • Yeah but WPTerm is a non-interactive shell, which means that after I run the python command the application basically freezes. That's why I need a one-liner to start a shell with superuser rights and read the contents of the /root directory or change its owner/access rights. – Adrian Baginski Mar 25 '18 at 15:39
  • 3
    Did you try a reverse shell (i.e. upload it as PHP script) and after that connect to it by using netcat? – CipherX Mar 25 '18 at 15:41
  • @CipherX suggestion seems the most logical. I would however, use a meterpreter shell rather than netcat -- use msfvenom to generate the php. – keithRozario Mar 26 '18 at 6:08
  • 1
    Look up 'the reverse shell cheat sheet' it's a good reference. I also concur with using venom to craft a payload – Anthony Russell Jun 24 '18 at 11:43
  • I did this challenge too and the answer @CipherX gave in the comments is correct. The solution was to use a reverse shell. – RenKernegger Jul 1 '18 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.