HackTheBox - MakeSense
Source: YouTube · IppSec · published Oct 31, 2026 · 47:35
BLUF: This video demonstrates a CTF walkthrough for the "Make Sense" box, focusing on exploiting a Cross-Site Scripting (XSS) vulnerability within a speech-to-text WordPress plugin to create an admin account 2:15, followed by a PHP web shell upload to gain initial access 32:50, and finally bypassing an OCR-based image recognition service to achieve root privilege escalation 41:00.
Key Takeaways:
- Initial Reconnaissance: The target runs Apache on Ubuntu with HTTPS on port 443. Adding the domain
makesense.htbto the hosts file reveals a WordPress site 1:30. - XSS via Contact Form: The contact form allows HTML injection. By submitting a script in the message field, the attacker triggers an XSS event that executes in the admin's browser context 2:50.
- Admin Creation: Using a JavaScript payload (derived from
wpscantools), the XSS creates a new administrator user (ipsac) without needing the admin's password 25:50. - Web Shell Upload: Once logged in as admin, the attacker edits the theme's
functions.phpfile to insert a PHP reverse shell, gaining initial command execution on the server 32:50. - Credential Reuse: Dumping
wp-config.phpreveals database credentials for userwalter. SSH access is gained using password reuse 36:25. - OCR Bypass for Root: A local PHP service on port 801 performs OCR on uploaded images. The attacker crafts a PNG image containing a PHP payload that bypasses the OCR engine's character recognition, executing arbitrary code as root 41:00.
Closing Statement: The box highlights the critical risks of XSS in admin-facing interfaces and the subtle vulnerabilities in automated content processing services like OCR when handling untrusted input.
Sources:
- 2:15 Discussion of the primary vulnerability: Cross-Site Scripting via the WordPress plugin.
- 1:30 Network enumeration and host file configuration.
- 25:50 Exploitation of XSS to create a new admin user.
- 32:50 Uploading a PHP web shell via the theme editor.
- 36:25 Gaining user-level SSH access via credential reuse.
- 41:00 Bypassing OCR to execute root-level commands via image upload.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSAC and today we'll be doing make sense from hack the box. And as o as it sounds, my favorite part about this box was WordPress as it really highlights the dangers of cross-sight request forgery attacks as we'll fish the admin user and through cross- sight scripting trick the browser into creating us an admin user. To get to this cross-ite scripting, we'll have to analyze a speechtoext WordPress plugin, find out how we can upload text to the website, and then upload some JavaScript. Alternatively, you could just put HTML in the contact form, skip all this analysis altogether. I'm surprised how many people didn't find this. Once we get onto WordPress, we'll just get shell the typical way by placing some PHP code in a theme and executing it. And then once w…