> For the complete documentation index, see [llms.txt](https://jeanpeyremesmots.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jeanpeyremesmots.gitbook.io/home/jpmm-en/courses-and-hands-on-exercises/pentesting-wp-mobile-detector-plugin.md). # Pentesting wp-mobile-detector plugin Fixing a vulnerability in a WordPress plugin, and hardening the site's configuration ### VM Setup: We're working with a 32 GB VM. Here are the LVM mount points to set up: ``` /; = 5 GB /var; = 10 GB /var/log; = 2 GB /var/tmp; = 5 GB /tmp; = 5 GB /home; = 2 GB /srv/www; = 2 GB ``` For /var/log and /srv/www, make sure to add the following mount options: * nosuid: completely ignores setuid and setgid bits * nodev: ignores device files * noexec: prevents execution of any program on this mount point After partitioning: ```bash root@ubuntu-server:/etc/apache2/sites-available# df -h Filesystem Size Used Avail Use% Mounted on tmpfs 867M 1.6M 866M 1% /run /dev/mapper/myVolume-ROOT 7.8G 4.8G 2.7G 65% / tmpfs 4.3G 0 4.3G 0% /dev/shm tmpfs 5.0M 4.0K 5.0M 1% /run/lock /dev/mapper/myVolume-TMP 4.9G 740K 4.6G 1% /tmp /dev/mapper/myVolume-HOME 2.0G 226M 1.6G 13% /home /dev/mapper/myVolume-VAR 9.8G 1.5G 7.8G 17% /var /dev/mapper/myVolume-lv--0 2.0G 27M 1.8G 2% /srv/www /dev/mapper/myVolume-VAR--LOG 2.0G 37M 1.8G 3% /var/log /dev/mapper/myVolume-VAR--TMP 4.9G 112K 4.6G 1% /var/tmp tmpfs 867M 140K 867M 1% /run/user/1000 root@ubuntu-server:/etc/apache2/sites-available# lvdisplay --- Logical volume --- LV Path /dev/myVolume/ROOT LV Name ROOT VG Name myVolume LV UUID 7XfPcV-U97H-Mfmy-aI5O-4e2g-AjFM-tLX2gC LV Write Access read/write LV Creation host, time ubuntu-server, 2023-03-14 21:47:02 +0000 LV Status available # open 1 LV Size 8.00 GiB Current LE 2048 Segments 1 Allocation inherit Read ahead sectors auto - currently set to 256 Block device 253:0 --- Logical volume --- LV Path /dev/myVolume/VAR LV Name VAR VG Name myVolume LV UUID LS2BOd-1qal-g0iW-ouvv-TBVz-cfcV-cgAVU3 LV Write Access read/write LV Creation host, time ubuntu-server, 2023-03-14 21:47:02 +0000 LV Status available # open 1 LV Size 10.00 GiB Current LE 2560 Segments 1 Allocation inherit Read ahead sectors auto - currently set to 256 Block device 253:1 --- Logical volume --- LV Path /dev/myVolume/VAR-LOG LV Name VAR-LOG VG Name myVolume LV UUID 5BjYH3-u3yJ-2VlY-xO7 [...] ``` Partitions are now complete and ready to use. ### Apache server installation: Using the tutorial: ```bash sudo - apt install software-properties-common add-apt-repository ppa:ondrej/php apt update apt install apache2 apt install php5.6 php5.6-fpm a2enmod proxy_fcgi setenvif a2enconf php5.6-fpm apt install php5.6-mysql php5.6-mbstring php5.6-xml php5.6-gd php5.6- curl apt install mariadb-server mariadb-client apt-get install unzip ``` Next we configure WordPress: ```bash cd /tmp/ wget https://wordpress.org/wordpress-4.0.7.zip && unzip wordpress-4.0.7.zip sudo mv wordpress /srv/www/ && cd /srv/www/ && chown -R root:www-data wordpress/ ``` Then in the Apache config folder: ```php DocumentRoot /srv/www/wordpress Options FollowSymLinks AllowOverride Limit Options FileInfo DirectoryIndex index.php Require all granted Options FollowSymLinks Require all granted ``` Now we just need to enable the WordPress module: ```bash a2ensite wordpress a2enmod rewrite a2dissite 000-default service apache2 reload ``` Now we need to configure the database: ```bash mysql -u root -p ``` ```sql CREATE DATABASE wordpress_db; CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'password'; GRANT ALL ON wordpress_db.* TO 'wp_user'@'localhost' IDENTIFIED BY 'password'; FLUSH PRIVILEGES; Exit ``` Allow plugin installation: ```bash vim php.ini : sed -i 's/upload_max_filesize = 2M/upload_max_filesize = 10M/g' /etc/php/5.6/fpm/php.ini echo "define('FS_METHOD', 'direct');" >> /srv/www/wordpress/wp-config.php systemctl restart php5.6-fpm.service && systemctl restart apache2.service ``` Restrict PHP code execution in the "/uploads" directory: ```bash root@ubuntu-server:/srv/www/wordpress/wp-content# sudo chmod -R 600 uploads/ root@ubuntu-server:/srv/www/wordpress/wp-content# ll total 28 drwxrwx--- 6 root www-data 4096 Mar 15 00:23 ./ drwxr-x--- 5 root www-data 4096 Mar 16 08:24 ../ -rwxrwx--- 1 root www-data 28 Jan 8 2012 index.php* drwxrwx--- 4 root www-data 4096 Mar 15 00:23 plugins/ drwxrwx--- 5 root www-data 4096 Aug 4 2015 themes/ drwxrwx--- 2 root www-data 4096 Mar 15 00:23 upgrade/ drw------- 3 root www-data 4096 Mar 15 00:23 uploads/ root@ubuntu-server:/srv/www/wordpress/wp-content# ``` Prevent code execution in the WordPress admin panel:
As well as in Apache:
And the application secrets. The values are random since these are just for testing:
Finally, fine-tune the permissions: For the ".htaccess":
/wp-content:
wp-content/plugins/\*:
\[...] wp-content/themes/\*:
### Patching the vulnerability: A simple extension check lets us patch the vulnerability:
No reverse shell in sight, and no cached files either: