ChatRoom

Nmap Scan

Foothold

I start looking at port 80 HTTP service

I run a ffuf scan

then checking the pages I did not find anything interesting so I start checking the function on the pages.

The forgot password page seemed to have a user enemuration vulnerability

So I moved that to Burpsuite to start an Intruder attack and find users, and at this point I notice this comment on the page source

I already found a valid username “johanna” and got that confirmed by submitting on the forgot password page, this time I did not get the error message instead I got redirected to login page.

looking at the requests generated by a valid password reset request I find this request

So what might this token be ? and how is it used ?

looking back at ffuf results there was also a password reset page, I visit that page and get

so I feed it the token and try again

now I just need to set a new password !

Get dj4m’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I set the new password then try to login just to get face with 2FA wall

To bypass this I made a submit with ramdom code

then took the request and passed it to ffuf fuzzing the code

once that is done my session was not clocked by the 2fA anymore so I just go back to my browser and change the url to admin.php which redirected me to chat.php but I still got a admin username there so I just need to replicate the previous steps to get admin access

once that is done I was logged in as adm_robertz and was able to access admin.php

Initial Access

on admin page the chat hook looked interesting

I test that by changing the command

then when I visit chat.php and submit a message I get

I tested for reverse shell command but that was refused and I got a message that invalid ip was used so instead I try to get ssh key for identified user which worked like a charm

I copied the key to a local file set the right permission and I was able to use it to get ssh session on the target as user dylan with access to local.txt flag

Privilege Escalation

I was able to find a cron job run by root every minute making backups

at the bottom I see an eval command which make me smile I just need to find a way to inject something in to that command.

It’s running whatever is in “$c” if the part on the left triggers an error:
echo “$c” | grep -qE “$ip4|$ip6”

to exploit his I created a script at dylan home dir with a revshell command(this is needed to bypass the grep filter that will refuse IPs) then used the application ui to insert that to the hooks table, but that was not enough since the backup column had a value 0 so the select did not work, but I was able to change that manually on the database file

once that is done it did not take long for the root user to eval my command, giving me shell access as root and was able to get proof.txt flag