This is an Ubuntu 22.04 machine running an e-learning web site made with of Chamillo LMS (Learning Management System). The version installed is Chamillo 1.11, which is vulnerable to unrestricted file upload (CVE-2023-4220) . Exploiting this vulnerability we get initial to access to the system, then move laterally to a low-priv user reusing database credentials found in a PHP configuration file. Regarding escalation, we abuse an overly permissive sudo script that allows the user to update file permissions with setfacl
> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-10-10 11:34 EDT
Nmap scan report for 10.10.11.23
Host is up, received user-set (0.036s latency).
Not shown: 59940 closed tcp ports (conn-refused), 5593 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
Nmap done: 1 IP address (1 host up) scanned in 12.90 seconds
Enumerate the open ports.
> nmap $target -p22,80 -sV -sC -Pn -vv -n
Starting Nmap 7.93 ( https://nmap.org ) at 2024-10-10 11:34 EDT
Nmap scan report for 10.10.11.23
Host is up, received user-set (0.043s latency).
Scanned at 2024-10-10 11:34:48 EDT for 8s
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 e25c5d8c473ed872f7b4800349866def (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAyYzjPGuVga97Y5vl5BajgMpjiGqUWp23U2DO9Kij5AhK3lyZFq/rroiDu7zYpMTCkFAk0fICBScfnuLHi6NOI=
| 256 1f41028e6b17189ca0ac5423e9713017 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP8A41tX6hHpQeDLNhKf2QuBM7kqwhIBXGZ4jiOsbYCI
80/tcp open http syn-ack Apache httpd 2.4.52
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://permx.htb
|_http-server-header: Apache/2.4.52 (Ubuntu)
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap done: 1 IP address (1 host up) scanned in 8.57 seconds
Add to hosts file and enumerate with Firefox. An online e-learning site comes into view.
Download and run the exploit (exploit.py), it provides instant RCE. First we'll use it to discover the host is running Linux, then we verify nc is installed.
It seems that's the case and we can retrieve user flag.
ROOT
Start from the low-priv shell for user mtz and take the opportunity to enumerate the user and the system.
> whoami && id
mtz
uid=1000(mtz) gid=1000(mtz) groups=1000(mtz)
> uname -a && cat /etc/os-release
Linux permx 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
PRETTY_NAME="Ubuntu 22.04.4 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.4 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
Check sudo configuration.
> sudo -l
Matching Defaults entries for mtz on permx:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User mtz may run the following commands on permx:
(ALL : ALL) NOPASSWD: /opt/acl.sh
Inspect the script /opt/acl.sh
#!/bin/bash
if [ "$#" -ne 3 ]; then
/usr/bin/echo "Usage: $0 user perm file"
exit 1
fi
user="$1"
perm="$2"
target="$3"
if [[ "$target" != /home/mtz/* || "$target" == *..* ]]; then
/usr/bin/echo "Access denied."
exit 1
fi
# Check if the path is a file
if [ ! -f "$target" ]; then
/usr/bin/echo "Target must be a file."
exit 1
fi
/usr/bin/sudo /usr/bin/setfacl -m u:"$user":"$perm" "$target"
It seems the script modifies any file's permissions with setfacl binary. There are 2 conditions: the target must be a file and be inside mtz home directory.
Create a symbolic link to /etc/passwdin mtz home directory, then update its permissions so we can add new users.
