makesense

overview

makesense is a hard linux box themed around client-side ai (speech-to-text and handwriting ocr). the foothold chains a custom wordpress theme's voice feature into a stored xss: the theme encrypts submissions client-side with a hard-coded aes key, so a forged payload can be decrypted and stored server-side, then rendered unescaped in the admin review panel, an admin bot executes it and creates an attacker admin. admin access leads to rce via a malicious plugin. credentials from wp-config.php pivot to the user walter. root is an internal handwriting-ocr service that saves recognised text to attacker-named files in a web-served directory while running as root, an arbitrary php write for code execution.

enumeration

nmap scan

nmap -sC -sV -oN makesense_initial.txt makesense.htb

relevant ports:

• port 22: openssh
• port 80: dead / no response
• port 443: wordpress site (apache 2.4.58, ubuntu)
• port 8001: filtered from outside, an internal service (revisited for root)

wordpress recon

wpscan --url https://makesense.htb --disable-tls-checks \
  --enumerate u,t --plugins-detection passive -t 50

findings: wordpress 7.0, xml-rpc enabled, directory listing on wp-content/uploads/, users walter, jake, admin, and a custom theme webagency. a stray voice-message.wav in the uploads directory is a red herring (a demo of the transcription feature), the real attack surface is the theme's javascript.