Скрипт-кидди (Script-kiddie)

Platform: hackerlab.pro | Category: Infrastructure | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: WordPress plugin vulnerability exploitation (CVE-2019-9978), Password reuse (DB credentials → SSH), GTFOBins nano privilege escalation, Two-part flag assembly

Summary

Pentest machine with a WordPress site. Need to gain initial access, find the first part of the flag, then escalate privileges to get the second part.

Скрипт-кидди (Script-kiddie) — Hackerlab

Description

Pentest machine with a WordPress site. Need to gain initial access, find the first part of the flag, then escalate privileges to get the second part.

Analysis

Stage 1: Reconnaissance

Scanning revealed WordPress 6.2 with the Social Warfare v3.5.2 plugin installed.

This plugin version is vulnerable to CVE-2019-9978 — remote code execution via the swp_url parameter.

Stage 2: Initial Access via CVE-2019-9978

Social Warfare v3.5.2 allows arbitrary PHP code execution via the swp_url parameter, which loads and executes the contents of a remote file. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The vulnerability allows:

1. Reading local files
2. Executing arbitrary PHP code

Stage 3: Data Collection

Using RCE, we read the WordPress configuration file:

 bash read-only • copy allowed Copy
# Reading wp-config.php
cat /var/www/html/wp-config.php

Extracted credentials:

• DB User: kiddie
• DB Password: erMfrbUvRQpchsy

Stage 4: SSH Access via Password Reuse

The database password works for SSH:

 bash read-only • copy allowed Copy
ssh kiddie@<target>
# Password: erMfrbUvRQpchsy

First part of the flag in the home directory:

 bash read-only • copy allowed Copy
cat ~/first_part
# CODEBY{REDACTED

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Stage 5: Privilege Escalation Analysis

Checking sudo permissions:

 bash read-only • copy allowed Copy
sudo -l

Result:

User kiddie may run the following commands:
    (ALL) NOPASSWD: /usr/bin/nano /tmp/*.txt

The user can run nano with root privileges to edit files in /tmp/*.txt.

Solution

GTFOBins Nano Privilege Escalation

Nano has a built-in command execution capability via the ^T (Ctrl+T) menu — "Execute Command".

Exploitation steps:

1. Create a file in /tmp:

 bash read-only • copy allowed Copy
touch /tmp/pwn.txt

1. Run nano with sudo:

 bash read-only • copy allowed Copy
sudo /usr/bin/nano /tmp/pwn.txt

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. In nano, press Ctrl+T to open the command execution menu

2. Enter the command to read the flag:

 bash read-only • copy allowed Copy
cat /root/last_part

1. Get the second part of the flag:

REDACTED}

Alternative method — getting a shell

 bash read-only • copy allowed Copy
# In nano: Ctrl+T, then:
bash

This gives an interactive root shell.

Full flag

CODEBY{REDACTED}

Exploit Chain Summary

WordPress + Social Warfare v3.5.2
         ↓
    CVE-2019-9978 (RCE via swp_url)
         ↓
    Read wp-config.php
         ↓
    DB password: erMfrbUvRQpchsy
         ↓
    SSH as kiddie (password reuse)
         ↓
    First part: CODEBY{REDACTED
         ↓
    sudo -l → nano /tmp/*.txt
         ↓
    GTFOBins nano (Ctrl+T → command execution)
         ↓
    cat /root/last_part
         ↓
    Second part: REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

References

• CVE-2019-9978 - Social Warfare RCE
• GTFOBins - nano
• WordPress Security Best Practices ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍