Summary
HackTheBox - Moderators is a Hard Linux machine that features a PHP web application that uses a library which is
vulnerable to file upload using which we can get a code execution by uploading a php file. Later we can find a Dev Version of the same application which is a wordpress application and had brandfolder plugin which was vulnerable to an LFI. using which we can upload a custom wp_load.php and execute to get user lexi. Updating wp admin credential we can get john user. From there it was all about mounting an encrypted vdi and getting root credential.
Author: kavigihan
Initial Scan
nmap
1 | # Nmap 7.92 scan initiated Sun Aug 7 08:50:28 2022 as: nmap -sC -sV -vvv -oN nmap/moderators 10.129.18.15 |
Website
Running F
Reports in blog
Checking all the reports we find Logs path
where e21cece511f43a5cb18d4932429915ed look like a md5 hash lets put it in crackstation which result in the report id 9798
So it is possible that the other reports logs are also present in /logs/md5(reportId) paths
Checking that we see empty page for all the paths
We also saw /logs/uploads/ lets try file extensions on /logs/uploads/e21cece511f43a5cb18d4932429915ed and FUZZ that
After lots of Enumeration we find
Checking other logs
We also find
When we upload a pdf logs.pdf (I downloaded from the server itself)
We can find the file in
With some Magic Header we where able to Bypass the php check and upload a php file as
We see
We also see list of disabled functions
1 | pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,passthru,system,exec,shell_exec |
Using https://github.com/epinna/weevely3
we can get a Webshell on the server
Using Chisel we can pivot the system to access wp site
1 |
|
1 |
|
Stuck on this for very long
Taking a break and coming back to it
Going to brandfolder
and reading the callback code again
We see we are concating the wp_abspath with wp-load and so on.
I was sure we could get LFI with https://www.exploit-db.com/exploits/39591
But passing nullbyte or anything i was unable to make it work
So I created a fake wp-load.php in /dev/shm
with content as
1 | echo fread(popen("cat /home/lexi/.ssh/id_rsa", "r"), 4096); |
and now opening brandfolder plugin with /dev/shm folder as LFI. it tried loading the
malicious wp-load.php and printed the user lexi Key.
Privilege Escalation
After Getting lexi lets run linpeas again.
Checking in WP database
We change the password for admin in wp_users
and login as admin
from there we can download the ssh key of john.
More Escalation
With the VDI downloaded we can crack the password using pyvboxdie-cracker as computer
And when we attach the vdi we see it to be an encrypted LUKS disk using cryptsetup-pwguess
cracking the password we get the password as abc123
And we the password in one of the script as
as $_THE_best_Sysadmin_Ever_
using which we get root
