search

devvortex HTB

IP 

10.10.11.242

Initial Nmap scan

 sudo nmap -p- --min-rate 10000 10.10.11.242 | cut -d"/" -f1 | tr '\n' ','

we have the following ports open on the target

22,80

Lets run a more in-depth scan of the target

sudo nmap -sCV -p22,80 -oA TCP_ports 10.10.11.242

results 

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://devvortex.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

we can see

  • domain name: devvortex.htb we can add this to our hosts file

  • SSH is up on the target

  • we have a nginx web server version 1.18.0

  • most likely a ubuntu machine

Lets check out this web server

  • pretty static little to no functionality

Lets run feroxbuster and see if we can find any directories

  • nothing to interesting

let's see if we can find any subdomains

we do find a sub domain

Lets add this to our hosts file

Lets checkout dev.devvortex.htb

  • looks like an updated website

  • Not alot of functionality, pretty static

Lets run feroxbuster and see if we can find any interesting directories

  • hmm the output looks like it keeps erroring out lets try gobuster instead

we do find some interesting directories

more particular /administrator , when we visit the directory we can see the following

Looks like its supposed to be a login page but we have an error weird?

  • this actually resulted in a box reset

now we restarted the box we can see the follwoing

we need to find the version, as weak creds dont seem to work

we can find the version by visiting `http://dev.devvortex.htb/administrator/manifests/files/joomla.xmlarrow-up-right`

  • we have version 4.2.6

Looks like this version of joomla is vulnerable to CVE-2023-23752 we can use the following exploit script

LogoGitHub - gunzf0x/CVE-2023-23752: Binaries for "CVE-2023-23752"GitHubchevron-right

What is CVE-2023-23752 ?

  • I'll leave a great blog that explains the vulnerability but essentially its an authentication bypass vulnerability that allows unauthenticated users access to sensitive information about Joomla installation

Now lets exploit it

we can see we have the creds for the user lewis Lets see if we can

SSH in

  • that a negative

Login via the administrator directory

  • which we most certainly can

we can already see that the current php version is outdated, this server is currently using PHP version 7.4.3

  • looking through the following article

http://dev.devvortex.htb/templates/cassiopeia/rev.phparrow-up-right

We should be able to upload a php reverse-shell through the templates configuration tab

  1. we will use pentest monkeys reverse-shell so prepare you shell (change the ip and port to our local host)

  2. through the "Global configuration" -> 'Templates" Tab on the left side menu

we can want to modify the the "Max, Upload Size" to 100000, i noticed problems with my file being to large to upload, click "Save"

  1. Now from the left most menu we want to click on "System" -> "Site Templates"

then click on the "Cassiopeia Details and Files" template, this is the template we are going to modify

  1. Click "New File"

give it a name and file type

click create

  1. within the left menu, click on the new file we created

Copy and paste our php reverse-shell within the file, click Save (up the top)

  1. Let's start our listener

  1. Let's navigate through our browser to our rev.php

http://dev.devvortex.htb/templates/cassiopeia/rev.phpdev.devvortex.htbchevron-right

We now have a shell on the system

let's upgrade our shell

while checking for ports listening internally we can see the following

  • we can MySQL is running wonder if we can do anything with this

  • we still have lewis credentials we found earlier maybe we can search the database

Lets list the databases available to us

joomla looks interesting, let's use this database

list all the tables

we can see the following table sd4fg_users

we have some usernames and there encrypted passwords

Lets see if we can crack these

what kind of hashes are these

  • Blowfish(OpenBSD)

Let's use hashcat and crack the user logan hash

we have the cracked password of

Lets see if we can SSH into the machine

  • we are authenticated

Checking our sudo privileges

we can run the program

after a quick google search this program is vulnerable

explains the vulnerability

LogoGitHub - diego-tella/CVE-2023-1326-PoC: A proof of concept for CVE-2023–1326 in apport-cli 2.26.0GitHubchevron-right

But essentially we have the ability to read a crash report in a vi like program, from here we can execute bash and jump straight into a root bash shell

we are now root

PreviousZipping HTBNextMagic HTB

Last updated