Week 9. Devvortex
TL;DR
This is an Ubuntu machine running a web server created with a vulnerable version of Joomla CMS (CVE-2023-23752). Using a GitHub exploit we dump admin credentials for Joomla, which allows us to upload a PHP reverse shell. Once inside the box, we found a Blowfish hash in an internal MySQL database, which once cracked can be used for a local user SSH access. Regarding escalation, we abuse a vulnerable version of the apport-cli tool (CVE-2023-1326) that the local user can run with sudo.
KEYWORDS
Joomla 4.2, CVE-2023-23752, Blowfish, apport-cli 2.20.11, CVE-2023-1326, sudo escalation.
REFERENCES
https://www.cvedetails.com/cve/CVE-2023-23752
https://github.com/Acceis/exploit-CVE-2023-23752
https://www.cvedetails.com/cve/CVE-2023-1326
https://stackoverflow.com/questions/6152232/how-to-generate-core-dump-file-in-ubuntu
ENUMERATION
Port scan.
> nmap $target -p- -T4 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-25 15:51 EST
Nmap scan report for 10.129.73.111
Host is up, received user-set (0.089s latency).
Not shown: 63037 closed tcp ports (conn-refused), 2496 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
Nmap done: 1 IP address (1 host up) scanned in 29.68 secondsEnumerate the open ports.
Fuzz for hidden subdomains.
Fuzz again in the dev subdomain.
Browse the robots.txt file, there is an administrator login portal.
There seems to be a Joomla CMS installed, we can enumerate the version in the README file.
It seems the Joomla version installed is 4.2.
USER
Looking for Joomla 4.2 vulnerabilities, we came across this one: https://www.cvedetails.com/cve/CVE-2023-23752, and this associated exploit in GitHub: https://github.com/Acceis/exploit-CVE-2023-23752
Download it and install the necessary dependencies indicated in the exploit description.
Now we can run the exploit to dump credentials for superuser in the administrator portal.
We use disclosed credentials to login into the administrator portal on http://dev.devvortex.htb/administrator/index.php
Once inside, navigate to System -> Site templates
Select the Cassiopeia template and find a writable PHP file; for example, the error.php file. Overwrite error.php with a PHP reverse shell of your choice.
Save and close, the reverse shell is accessible on http://dev.devvortex.htb/templates/cassiopeia/error.php
Once the reverse shell is received, first step is to upgrade the shell to a Python TTY, then enumerate users who have a configured shell in the /etc/passwd file.
So our next goal will be to move laterally to user logan
First, move to the web root directory and look for interesting files. In the directory /var/www/dev.devvortex.htb you find a configuration PHP file which contains MySQL credentials.
This file contains credentials for user lewis in a MySQL database. In fact, there is a local MySQL server running internally on port 3306 (it can be discovered with netstat). Connect to it using Lewis' credentials.
Navigate through the database, and dump hashes in the sd4fg_users table in the joomla database.
Logan's password hash is type Blowfish (module 3200).
From the reverse shell, just su logan with cracked credentials and get user flag.
SYSTEM
Begin from an SHH shell for user logan and verify if he is a sudoer.
Turns out user logan can execute application apport-cli with sudo. Investigating this application, we find out it is used to inspect crash dump files.
Looking for vulnerabilities, we come across this one: https://www.cvedetails.com/cve/CVE-2023-1326
It seems versions earlier than 2.26 use less as pager, and this can be exploited for privilege escalation if run under root, which is the case for this user.
Check which version of apport-cli is running.
So it seems version installed is vulnerable. We just need run a .crash file long enough so the binary calls the pager when parsing it. Investigating ways to generate a crash in Ubuntu, we find 2 resources:
https://stackoverflow.com/questions/6152232/how-to-generate-core-dump-file-in-ubuntu
Following the instructions, let's first configure bash to save large dumps.
Then force a segmentation fault, so the core is dumped in a large crash file.
If everything went well (wrong, in fact), a message indicating the core has been dumped is shown, and a crash file should have been saved in the /var/crash directory.
Launch the apport-cli tool with the generated dump file, the less pager will be called to display contents.
Just enter !sh to interrupt the pager and force it to open a shell. The spawned shell will be root shell since apport-cli was run with sudo
You are root.
Last updated