{"uuid": "4c159d10-0864-40c0-9bfc-7cf1572a783d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81237", "content": "Hacking Articles\nPaper HackTheBox Walkthrough\n\nPaper is a Linux machine and is considered an easy box the hack the box. On this box, we will begin with a basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read the sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. Successful execution of the exploit will spawn a root shell. Table of ContentInitial Access\n\n* TCP Port Scan\n* Initial Enumeration\n* Find Domain Name\n* Web Page Enumeration\n* Searching For the Exploit\n* Secrets leaking Vulnerability Exploitation\n* Subdomain Enumeration\n* Bot Feature Abuse\n* User Flag\n\nPrivilege Escalation\n\n* PolicyKit Exploit: CVE-2021-3560\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the normal TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used \u2013sV flag which performs a service version scan against the target machine.\n\nFlags features:\n\n-sV:\u00a0 Attempts to determine the service version\nnmap\u00a0 -sV 10.129.74.162 \nFrom the nmap scan, we have found there were only three ports open, which is port 22,80 and port 443. As usual HTTP service is running on port 80, HTTPS service is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is the latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to do. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png?w=640&ssl=1 \n\nInitial Enumeration\n\nWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have many interesting things. From the web page, we found it is showing default page of CentOS.\nhtttp://10.129.74.162 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png?w=640&ssl=1 \n\nFind Domain Name \ncurl -I 10.129.74.162 \nFlags features:\n\n-I: Include protocol response headers in the output\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper We have used Kali inbuilt tool called curl. https://everything.curl.dev/project\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s16000/3.png?w=640&ssl=1 \n\nAfter finding the domain name we are adding it to /etc/hosts file in the attacking machine. To add to host\u2019s file you can use any text editor such as leafpad, gedit, nano or vim.\n\nWhy do we need to add domain in the local hosts file?\n\nThe /etc/hosts file contains a mapping of IP addresses to[...]", "creation_timestamp": "2026-09-05T03:00:05.871285Z"}