{"uuid": "2a162280-4a7b-4789-8655-ea068fe9eaec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81151", "content": "Hacking Articles|Raj Chandel's Blog\nPaper HackTheBox Walkthrough\n\nSummaryPaper is Linux machine and considered as easy box by the hack the box. On this box we will begin with basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. A successfully execution of the exploit will spawn a root shell.<o:p Table of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Initial Enumeration<o:p\n* Find Domain Name <o:p\n* Web Page Enumeration<o:p\n* Searching For the Exploit<o:p\n* Secrets leaking Vulnerability Exploitation<o:p\n* Subdomain Enumeration<o:p\n* Bot Feature Abuse<o:p\n* User Flag<o:p\n* Privilege Escalation<o:p\n\n* PolicyKit Exploit: CVE-2021-3560<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the normal TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sV flag which performs a service version scan against the target machine. <o:p\n\nFlags features:<o:p -sV:\u00a0 Attempts to determine the service version<o:p nmap\u00a0 -sV 10.129.74.162<o:pFrom the nmap scan, we have found there were only three ports open, which is port 22,80and port 443. As usual HTTP serviceis running on port 80, HTTPSservice is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png Initial Enumeration<o:pWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have much interesting things. From the web page we found it is showing default page of CentOS. <o:p htttp://10.129.74.162<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png Find Domain Name Command used:<o:pcurl -I 10.129.74.162<o:pFlags features:<o:p -I: Include protocol response headers in the output<o:p\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper. We have used Kali inbuilt tool called curl.<o:p https://everything.curl.dev/project<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s[...]", "creation_timestamp": "2026-09-05T02:00:05.127780Z"}