Week 11. Surveillance
TL;DR
This is an Ubuntu machine running a web site built with a vulnerable version of CraftCMS (CVE-2023-41892). This can be exploited to get an initial shell, then move laterally to SSH user using credentials found in the file system. To escalate privileges, we exploit a vulnerable ZoneMinder version (CVE-2023-26035) to move laterally to another user, then abuse an overly permissive sudo misconfiguration to get root.
KEYWORDS
CraftCMS 4.4.14, CVE-2023-41892, ZoneMinder, CVE-2023-26035, Metasploit, sudo escalation.
REFERENCE
https://www.cvedetails.com/cve/CVE-2023-41892/
https://gist.github.com/to016/b796ca3275fa11b5ab9594b1522f7226
https://www.cvedetails.com/cve/CVE-2023-26035/
https://www.rapid7.com/blog/post/2023/11/17/metasploit-weekly-wrap-up-36/
ENUMERATION
Port scan.
> nmap $target -p- -T4 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-10 16:31 EST
Nmap scan report for 10.129.180.84
Host is up, received user-set (0.087s latency).
Not shown: 61282 closed tcp ports (conn-refused), 4251 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
Nmap done: 1 IP address (1 host up) scanned in 31.20 secondsEnumerate the open ports.
Add to hosts file and enumerate the web site with Firefox, it seems it is built with CraftCMS 4.4.14.
For initial foothold, we'll focus on the CMS vulnerabilities.
USER
Searching for CraftCMS 4.4.14 vulnerabilities, we come across this one: https://www.cvedetails.com/cve/CVE-2023-41892/. And this PoC: https://gist.github.com/to016/b796ca3275fa11b5ab9594b1522f7226
The PoC cannot be used off-the-shelf, just need a small modification in line 25 (remove the proxies). The final working exploit code is the following.
To get the shell, just run the exploit with the host's URL and a www-data shell is returned.
Once inside the host, we find a MySQL backup in /var/www/html/craft/storage/backups/surveillance--2023-10-17-202801--v4.4.14.sql.zip. Just unzip it and dump the contents, we find a hash for user admin (matthew), which looks like SHA-256.
This can be cracked (module 1400).
Finally, just SSH in as matthew, using the cracked password and retrieve the user flag.
ROOT
Begin from an SSH shell for user matthew and list local open connections.
Forward internal port 8080 to Kali 8085 and browse the site with Firefox, a login portal appears. It seems a ZoneMinder server is running on host's port 8080.
Looking for ZoneMinder vulnerabilities, we discover this one: https://www.cvedetails.com/cve/CVE-2023-26035/
We also search for a PoC, but nothing useful is found. However, we find a recently published Metasploit module: https://www.rapid7.com/blog/post/2023/11/17/metasploit-weekly-wrap-up-36/
You may need to update your framework to install this module, since it has been published very recently.
Once installed, just start the framework, load the module and configure it properly. For this, just remember that, with the local port forwarding in place, now the victim's 8080 port is accessible from Kali's http://localhost:8085
Once the metepreter session is received, open a shell and find out it is running under the zoneminder user context.
This meterpreter shell is functional, but not interactive. The best option to upgrade the shell is to send a nc mkfifo reverse shell to Kali, then upgrade to TTY.
The resulting shell is interactive and can be used to do some enumeration in the ZoneMinder root directory /usr/share/zoneminder/www. Inside this location we launch a grep scan for clear text passwords in the file system.
A database.php file is reported in /usr/share/zoneminder/www/api/app/Config/database.php containing MySQL credentials; however, there is not anything useful in the database.
Moving forward, next step is to verify if zoneminder is a sudoer.
This means any user can run any binary called zm*.pl in the /usr/bin/ directory under the root context, no password will be prompted. Moreover, any option can be passed to the binary since a wildcard has been inserted in the /etc/sudoers file. This is a wide open configuration which can be abused using wildcard injection.
Prepare a shell exploit.
Now just run any zm* binary and inject a command calling the exploit, it will be executed under the root context. For example, using zmupdate with the --version=1 option will force the tool to upgrade the database, and it allows us to inject a command.
This will execute exploit.sh under the root context. Finish the box spawning a root bash shell.
You are root.
Last updated