Week 2. Sea
TL;DR
This is an Ubuntu 20.04 machine hosting a web site made with WonderCMS 3.2.0, a version vulnerable to XSS (CVE-2023-41425). Using an exploit available in GitHub we get an initial foothold. Then we find a Blowfish hash in a JS configuration file that, once cracked, allows us to move laterally to another user with enough permissions to read the first flag. Regarding escalation, we abuse an internal system monitoring web application under development that is running with root permissions, and turns out to be vulnerable to command injection.
KEYWORDS
WonderCMS 3.2.0, CVE-2023-41425, XSS, Blowfish, command injection.
REFERENCES
https://www.cvedetails.com/cve/CVE-2023-41425/
https://github.com/prodigiousMind/CVE-2023-41425
ENUMERATION
Port scan.
> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-11 16:49 EDT
Nmap scan report for 10.10.11.28
Host is up, received user-set (0.045s latency).
Not shown: 45417 closed tcp ports (conn-refused), 20116 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
Nmap done: 1 IP address (1 host up) scanned in 17.35 secondsEnumerate the open ports.
Fuzz for hidden content.
In Burpsuite you can gather more information about the site sitemap
Fuzz again in the /themes/bike directory.
Download and inspect the README.md file to get info about the CMS.
Once we have disclosed the CMS is WonderCMS, we can obtain the version with curl
Investigate this version of WonderCMS, it is impacted by this CVE: https://www.cvedetails.com/cve/CVE-2023-41425/
The machine is running a website made with a version of WonderCMS vulnerable to XSS. We have a potential point of entry for XSS in contact.php
USER
Download an exploit from: https://github.com/prodigiousMind/CVE-2023-41425
Follow the author's instructions: first, run the exploit to generate a xss.js file.
Note the /index.php?page=loginURL is taken from the exploit code, and is accessible via Firefox
The exploit outputs a file xss.js and returns a link to be inserted in the contact page. But before, we need to modify the xss.js file since it cannot be used as-is. You have to change the URL where the exploit downloads the shell.php from. By default the exploit points to a Github URL which does not work, so modify the reverse shell URL to point to your machine.
Now start a Python HTTP to serve the shell.php file (for example, use a PentestMonkey PHP shell) and insert the link in the contact.php form.
Shortly after the form is submitted, a request for xss.js file is received on the exploit's listener, along with a request for shell.php on out local Python HTTP server.
Now the reverse shell is stored in /themes/revshell-main/shell.php. Trigger it with curl
A reverse shell for user www-data is received on port 1919.
This user has read access to /var/www/sea/data/database.js, where we find a Blowfish hash.
This can be cracked with module 3200 (remove the escape chars from the hash).
Use the cracked password to SSH as amay (enumerate users in /home folder or in /etc/passwd).
Use this shell to a shell to retrieve the user flag.
ROOT
Start from the low-priv SSH shell for user amay, and take the opportunity to enumerate the user and the system.
There is something running on port 8080.
Forward to Kali and browse locally with Firefox, a system monitor application appears (use Amay's credentials to login).
Looks like it runs under root context since it allows system management, therefore candidate to command injection. Launch a log file analysis and capture with Burpsuite.
A POST request is sent with 2 parameters log_file and analyze_log.
After trying several payloads, we discover the log_file parameter is vulnerable to command injection.
The format of the payload is the following.
There must be a blank space after the semicolon, and a hashtag at the end of the line. The semicolon is used to concatenate the commands, whereas the hashtag is necessary to comment anything after it (similar to SQL injections).
With this in mind, let's insert a reverse shell payload with Burpsuite and start a listener to capture it.
The received shell is not very stable but you'll have enough time to dump the root flag.
You are root.
Last updated