Here's the link to the lab: https://www.hacksmarter.org/courses/bb164cba-ddc9-4cb0-8e95-ad4853d0143c/take
- Let's connect to VPN
- Ping our host
- nmap -A our host
- Here we get our first inclination that his is WordPress 6.0
- It's been a while that I use wpscan, but I do remember it's a thing, one main source of vulnerabilities in WordPress is it's plethora of available plugins.
- wpscan --url http://10.0.21.199 --api-token APIKEYHERE --enumerate p --plugins-detection mixed
- -enumerate p
- this flag enumerates plugins, and the options are A/VP/P ( All , Vulnerable Plugins, Plugins) wpscan checks it's database and stuff, that's why we need the APIKEY
- You can enumerate more stuff like themes, users, config backups, db exports.
- A lot of it is mumbo jumbo, while I understand the context I would have to dig a bit deeper.
- I started with --enumerate vp, figuring it would find a vulnerable plugin, but reverted back to P when it did not find something useful.
- --plugins-detection mixed
- You either do PASSIVE/AGRESSIVE/MIXED detection methods.
- While wpscan reported a couple of findings, we see a good one to test that includes Privilege Escalation, Unauthenticated one, the ones we love.
- Time to go digging for CVE-2026-23550
- I'll save you some time. According to this site: https://hurayraiit.com/blog/cve-2026-23550-critical-privilege-escalation-in-wordpress-modular-ds-plugin-cvss-10/#the-poc
I use this as my payload; https://example.com/api/modular-connector/login/anything?origin=mo&type=fooLet's try it.- Look at that we're in:
- It's really crazy how these things work.
- Now we're in Wordpress as an admin, but that's only a step closer. I know we can probably get a shell with the Themes, maybe even use metasploit and get initial foothold to the OS there. I will come back a bit later and continue.
