Skip to content

Attack Chain — TartarSauce

Current Path

nmap (port 80) → robots.txt → /webservices/ → Monstra CMS (decoy) → WordPress at /webservices/wp/ → wpscan aggressive: gwolle-gb 2.3.10 → CVE-2015-8351 RFI → wp-load.php webshell → www-data shell → sudo -l: (onuma) /bin/tar → tar GTFOBins (--checkpoint exec) → onuma shell → user.txt → systemctl list-timers: backuperer.timer → /usr/sbin/backuperer (race + symlink in tar) → diff -r leaks /root/root.txt to /var/backups/onuma_backup_error.txt → root.txt

Branch Points

1. Monstra CMS Was a Decoy

  • Tried: Logged into Monstra admin panel with admin:admin. Attempted PHP file upload — blocked with multiple bypasses (.txt, double extension).
  • Lesson: When the obvious attack path is filtered/locked-down, it's likely a decoy. Look for other apps under the same parent path.

2. WPScan Aggressive Detection Required

  • Tried: Initial wpscan (default) found NO plugins.
  • Solution: --plugins-detection aggressive revealed gwolle-gb 2.3.10
  • Lesson: Always run wpscan with aggressive plugin detection — passive mode misses vulnerable plugins not referenced in homepage HTML.

3. RFI Setup — File-Serving HTTP, Not Netcat

  • Mistake initially: Tried to use a netcat listener as the "remote" for RFI.
  • Fix: Need a real HTTP server (python3 -m http.server) hosting a file literally named wp-load.php (the plugin appends /wp-load.php to the abspath param).
  • Lesson: RFI requires the attacker to serve a file over HTTP, not listen on a port.

4. TTY Upgrade Required for sudo

  • Issue: sudo rejected the reverse shell — "no tty present"
  • Fix: python3 -c 'import pty; pty.spawn("/bin/bash")'
  • Lesson: sudo on Ubuntu often refuses to run without a real PTY, even for NOPASSWD entries.

5. Timer-Driven Backup Script as Root Privesc

  • Found: backuperer.timer (every 5 min) runs /usr/sbin/backuperer as root
  • Bug 1: Background tar + 30-second sleep = TOCTOU window where unprivileged user can replace the tarball
  • Bug 2: diff -r follows symlinks; output captured in world-readable onuma_backup_error.txt
  • Exploit: Build tarball containing symlink var/www/html/index.html → /root/root.txt. Watch loop swaps the script's tmpfile during sleep. Root extracts our archive (creates the symlink), then diff follows it and dumps root.txt to the error log.
  • Lesson: When you spot a timer + ownership anomaly (root-owned dir containing user-owned files), read the script for race windows and trust assumptions about files in shared dirs.