IP redirects to blog.bigbang.htb which seems to have repeating contents. It's a wordpress website and we have some kind of form for login and resetpassword leads to wordpress
I think main reason why previously phar or php didn't work was because we needed image, simplest image header is GIF with GIF89;
Now we have LFI, but some files are not readable fully (?); Also it is incredibly slow, like 10-15second per read.
LFI is not yielding anything
iconv RCE
By default there were some uploaded files and for some reason output of /proc/self/maps many times in 2024 uploads.
Ambionics security has another research about iconv RCE which fits the description of target. maps is also required for this exploit with glibc, considering that above maps is either a hint or author forgot to remove them.
Note: glibc wasn't playing nice so above script is updated to pad length of prefix with null bytes, so GIF89; adds 6 null bytes at the end which gives valid libc.
We need to slightly modify script to use wrapwrap and then get RCE.
Main changes are inside Remote class and then some changes in logic. check_vulnerable will fail because so it's removed, files were already downloaded so load them locally. Most of the code stayed the same from source.
Writeup-2.png
Reverse Shell (www-data)
Commands to check active ports don't exist like ss or netstat
I don't think we are inside a container, but could be.
After filtering for bigbang.htb there's 2 routes: /login and /command
Authorization header value seems to be coming from login so let's do that first. Code was really messy, but API was chatty enough to say what it wanted.
Actually if we look for class name we can identify arguments.
Writeup-7.png
There seems to be 2 commands. First is move with x, y, z coordinates?
Writeup-8.png
And second is send_image with output_file
Pasted_image_20250201180525.png
Outputs about special characters looked like classic filters for command injection.
I wanted to insert newline, but application crashed with Errno 2
Error is raised by Python, probably the output_file is parsed into os.system or smth. Anyway the api returns error but command is executed.
└─$ feroxbuster -u 'http://blog.bigbang.htb/' -w /usr/share/seclists/Discovery/Web-Content/common.txt --thorough -n -D -C 404,403,400 -S 0,34
200 GET 65l 385w 28136c http://blog.bigbang.htb/wp-content/uploads/2024/06/f8724a71a5bc071c43ecb8040727d0db.jpg
200 GET 89l 314w 5790c http://blog.bigbang.htb/wp-login.php
405 GET 1l 6w 42c http://blog.bigbang.htb/xmlrpc.php
200 GET 510l 2734w 209498c http://blog.bigbang.htb/wp-content/uploads/2024/06/342-3427921_physics-atom-clipart-715454559-2.png
200 GET 121l 945w 73562c http://blog.bigbang.htb/wp-admin/images/browser.png
301 GET 9l 28w 323c http://blog.bigbang.htb/wp-admin => http://blog.bigbang.htb/wp-admin/
301 GET 9l 28w 325c http://blog.bigbang.htb/wp-content => http://blog.bigbang.htb/wp-content/
301 GET 9l 28w 326c http://blog.bigbang.htb/wp-includes => http://blog.bigbang.htb/wp-includes/
[####################] - 64s 28525/28525 0s found:86 errors:12
[####################] - 48s 27785/27785 579/s http://blog.bigbang.htb/
└─$ wpscan --url http://blog.bigbang.htb/ -e ap
[+] URL: http://blog.bigbang.htb/ [10.129.108.201]
[+] Started: Sat Jan 25 14:07:20 2025
Interesting Finding(s):
[+] Headers
| Interesting Entries:
| - Server: Apache/2.4.62 (Debian)
| - X-Powered-By: PHP/8.3.2
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://blog.bigbang.htb/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://blog.bigbang.htb/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] Upload directory has listing enabled: http://blog.bigbang.htb/wp-content/uploads/
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://blog.bigbang.htb/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 6.5.4 identified (Insecure, released on 2024-06-05).
| Found By: Rss Generator (Passive Detection)
| - http://blog.bigbang.htb/?feed=rss2, <generator>https://wordpress.org/?v=6.5.4</generator>
| - http://blog.bigbang.htb/?feed=comments-rss2, <generator>https://wordpress.org/?v=6.5.4</generator>
[+] WordPress theme in use: twentytwentyfour
| Location: http://blog.bigbang.htb/wp-content/themes/twentytwentyfour/
| Last Updated: 2024-11-13T00:00:00.000Z
| Readme: http://blog.bigbang.htb/wp-content/themes/twentytwentyfour/readme.txt
| [!] The version is out of date, the latest version is 1.3
| [!] Directory listing is enabled
| Style URL: http://blog.bigbang.htb/wp-content/themes/twentytwentyfour/style.css
| Style Name: Twenty Twenty-Four
| Style URI: https://wordpress.org/themes/twentytwentyfour/
| Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti...
| Author: the WordPress team
| Author URI: https://wordpress.org
|
| Found By: Urls In Homepage (Passive Detection)
|
| Version: 1.1 (80% confidence)
| Found By: Style (Passive Detection)
| - http://blog.bigbang.htb/wp-content/themes/twentytwentyfour/style.css, Match: 'Version: 1.1'
[+] Enumerating All Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)
[i] Plugin(s) Identified:
[+] buddyforms
| Location: http://blog.bigbang.htb/wp-content/plugins/buddyforms/
| Last Updated: 2024-09-25T04:52:00.000Z
| [!] The version is out of date, the latest version is 2.8.13
|
| Found By: Urls In Homepage (Passive Detection)
|
| Version: 2.7.7 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://blog.bigbang.htb/wp-content/plugins/buddyforms/readme.txt
[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
[+] Finished: Sat Jan 25 14:08:02 2025
[+] Requests Done: 32
[+] Cached Requests: 5
[+] Data Sent: 8.002 KB
[+] Data Received: 552.621 KB
[+] Memory used: 263.277 MB
[+] Elapsed time: 00:00:42
└─$ curl 'http://blog.bigbang.htb/wp-admin/admin-ajax.php' -d 'action=upload_image_from_url&url=phar://../wp-content/uploads/2025/01/159.png&id=159&accepted_files=image/gif'
{"status":"FAILED","response":"File type is not allowed."}
└─$ cat unknown/okhttp3/internal/publicsuffix/NOTICE
Note that publicsuffixes.gz is compiled from The Public Suffix List:
https://publicsuffix.org/list/public_suffix_list.dat
It is subject to the terms of the Mozilla Public License, v. 2.0:
https://mozilla.org/MPL/2.0/
└─$ rm -rf unknown/
