π°mKingdom
License
The following post by anthonyjsaab is licensed under CC BY 4.0
0 - Introduction
Created by tryhackme, and uartuo
1 - Port Scans
1a - Discovery
1b - Versions and OS
2 - Port 85
2a - Inspecting
2b - Dead ends
2bi - Maybe the CMS is flawed?
The source code of this page starts with the following:
The CMS used appears to be concrete5 - 8.5.2. Searching for vulnerabilities for this particular CMS version does not yield useful results. It's Github repo https://github.com/concretecms/concretecms/ does not show any commits that fixed some vulnerability.
2bii - Maybe we can quickly upload a webshell?
The blog and the contact sections have inputs were we can upload files and/or add messages:
2biii - Maybe we have to do more directory busting?
Interesting results came up, but all of these were present in Concrete CMS's Github page. Thus, no added value here.
2c - A painful mistake
The only working section I have not mentioned yet is the Login page:
Immediately after finding this page (link available on landing page), I ran Burp's Intruder to brute force the password (we know the user is admin based on the blog post's author). However, my IP was quickly banned. Then, I sorta forgot about this page until I went out of leads. I then tried an obvious combination: admin admin. Didn't work. admin password? YES! WE ARE IN!
2d - Foothold
Now I knew what to do: I have to upload a PHP webshell.
I went into "System & Settings". Under the "Files" sections, we have a link to "Allowed File Types".
After adding PHP, I went to "Files" and uploaded flozz/p0wny-shell.
We now go to the file's URL indicated above:
After taking a look at the /home directory, we notice that there are two accounts we can try to break into: toad and mario
3 - From www-data to toad
3a - Upgrading webshell to full shell
In the webshell, I ran this command built using revshells.com:
An nc listener catches the shell. Then a few well-known commands upgrades the shell
3b - Toad's password
I uploaded LinPEAS to the target machine and ran it. A particular output caught my eye:
It had to be toad's password! And sure enough:
4 - From toad to mario
After much enumeration, I noticed an environment variable I am not familiar with: PWD_token
PWD_token seemed to be base64 encoded. After decoding it, it was gibberish. However, I sensed that it could possibly be mario's password. I tried it and it worked!
5 - From mario to root
Here, privilege escalation was not easy at all. At first, I tried some enumerations like the following:
All of the classical privesc vectors were dead ends. Then, I tried to check for something only mario could do or own:
That was quite unusual! Why would we have write access to /etc/hosts? Inside, we can find:
This is very dangerous. It means that every app that relies on /etc/hosts to translate some address to 127.0.0.1 can be fooled to talk to us instead!
I tried this for starters:
I opened Wireshark on Kali, looked at the traffic of tun0 and waited for a bit, until:
Some unknown process on the target machine is now trying to contact us on port 85! The DNS hijacking worked!
When I opened an HTTP server on port 85, I received the connection again:
I quickly created a Bash script that spawns a reverse shell to Kali:
And sure enough:
Last updated
Was this helpful?