Tuesday, September 11, 2018



- Layout for this exercise:


- The goal of this exercise is to develop a hacking process for the vulnerable machine Stapler.

- According to Stapler's author there are multiple methods to hack this vulnerable machine, let's try some of them.

Stapler can be downloaded from here:


- Once downloaded and extracted with VMware:


- Scanning  all the ports with Nmap:

- Scanning thoroughly just the open ports:

2.1 - Enumeration for FTP

- Login FTP with anonymous credentials:

- There is a file called note:

- Getting note:

- It is an ASCII text:

- Opening the file:

2.2 - Trying SSH

- SSH-rooting is not allowed:

2.3 - Enumerating SMB

enum4linux gives us interesting information about SMB shares: /kathy and /tmp:

- Accessing SMB resources with smbclient:

- Because Fred and Kathy seem to be related, let's try this share:

- Listing, getting and opening content:

2.4 - Enumerating the Web Servers

- Now let's go to the two web servers working at Stapler, one at port 80 and the other at port 12380:

- port 80:

- port 12380:

nikto helps us to discover folders /admin112233, /blogblog, /phpmyadmin, also the robots.txt and the fact that HTTPS is used:

- Connecting againg to port 80, now with HTTPS instead of HTTP:

- Connecting to robots.txt  at port 12380 via HTTPS:

- Going to /blogblog we discover that wordpress is used:

- Going to /phpmyadmin:

dirb discovers another directory:

- Browsing announcements:

- Reading the message.txt, nothing special:

2.5 - Enumerating Wordpress

wpscan enumerates Wordpress vulnerabilities.

- First try is unsuccessful because there is an ssl_cacert error at checking the cerficate used with HTTPS:

- Disabling the certificate check with option --disable-tls-checks:

wpscan yields important information like a lot of login, usernames, vulnerabilities, and the existence of two folders: /wp-content/uploads and /wp-includes.


- There are different approaches for exploiting Stapler.

3.1 - Advanced Video Embed exploitation

Going to wp-content there are 3 folders: plugins, themes and uploads:

- Going to uploads it is empty:

- Goint to plugins, let's notice the first one:

- There is an exploit for the Wordpress plugin Advancedd Video Embed 1.0, it can be found here:

- Using searchsploit we find the Python script 39646.py:

- Reading the exploit we find the Proof of Concept:

- Copying 39646.py, renaming to advanced_video_LFI.py and editing in two ways:

  • adadpting to HTTPS
  • adapting to IP, port and web page

- Giving execution permissions:

- Executing the Python script:

- As a result of the execution a file with .jpeg extension is created at the uploads folder:

- It seems that the .jpeg file is like an uploaded comment or blog entry at /blogblob:

- Downloading to Kali the .jpeg file:

- Actually it is a PHP script:

- Reading the content we find unvaluable information. Actually it returns the file wp-config.php containing credentials of the Wordpress MySQL database: :

- We have the password plbkac what will be of great interest later.

3.2 - MYSQL exploitation

- Taking advantage of the information obtained at previous point, let's dig into the database:

- Using wordpress:

- Describing wp_users:

- Selecting login and passwords:

- No we have a list of usernames with their corresponding hashes, what could be decrypted later.

- However, for now I am just going to insert a cmd file to the web server via an MySQL command:

- It works, for instance executing pwd:

3.3 - Decrypting the hashes  with John The Ripper

- Launching John The Ripper against the hashes:

- After a while we find most of the passwords:

3.4 - Accesing to phpmyadmin

- Also, using credentials root:plbkac we have total access to /phpmyadmin, where we can achieve same information about users and passwords than before:

3.5 - Getting a low privilege shell with php-reverse-shell.php

 - Now, let's bring php-reverse-shell.php to our working folder and rename it to keep the original one:

- Adapting the script to our needs:

- Having a look at the last picture from the last point 3.4 the first listed username is john, and it often happens that the first list user is the administrator. 

- Using john:incorrect as credentials let's try to login to /blogblog:

- Going to Plugins there is a tab Add New:

-  Uploading phpscript.php trough Add Plugins / Browse:

- The upload is successful:

- Setting with netcat a listening session on port 3333:

- Clicking phpscript.php:

- A low privilege reverse shell is successfully achieved:

3.6 - Getting a low privilege shell with Hydra and SSH

- Listing users:

- Let's try attacking SSH service with Hydra using password plbkac (obtained from the .jpeg file at point 3.1 of this exercise):

- Connecting from Kali to Stapler with SSH trying credentials zoe:plbkac:

- We have achieved another low privilege shell.


- To achieve Privilege Escalation we will practice three different ways:

4.1 - Reading .bash_history

- Listing content of the /home directory we find folders for a lot of different users:

- Opening all the folders we find a different structure and content at peter user's home folder, in comparison with other users home folders.

- For instance the hidden file .sudo_as_admin_successful suggests the idea that user peter might be an administrator of Stapler:



- At the same time, reading .bash_history for all users we find this self explanatory line:

- The line corresponds to user JKanode .bash_history, and tells us that user peter has got the passsword JZQuyIN5:

- Trying SSH with credentials peter:JZQuyIN5 the result is successful:

- Choosing the (q) option we are given a remote shell:

- Checking peter's sudoer abilities it happens that he may run (ALL:ALL) ALL commands: 

- Let's try changing root's password:

- Now peter can do su root and we finally have a root shell

4.2 - Abusing a cron job

- Listing for cron jobs:

- Checking logrotate we learn that the shell script cron-logrotate.sh is executed every 5 minutes with root privileges:

- Now, let's alter the content of cron-logrotate.sh so that every 5 minutes this small script is executed with the goal of launching a reverse root shell at the Kali machine. 

- Echoing to cron-logrotate.sh:

- Setting a Netcat listener at port 5555:

- After a while a root shell is achieved at the Netcat session

4.3 - Exploiting the Kernel and Operating System

- We know that Stapler is running Ubuntu 16.04 with a kernel 4.4:

- Looking for an exploit to achieve Privilege Escalation:

- Reading information about the exploit we find the link to the downloading page:

- Saving to Kali:

- Setting a simple HTTP server on port 8000:

- Transferring the exploit to the /tmp folder at Stapler:

- Unzipping:

- Extracting the exploit:

- Going to the new folder:

- Giving execution permissions to doubleput.c:

- Compiling:


- Running the executable ./doubleput:

- Finally we have a root shell:


- Capturing the flag: