search

Curling

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.85.248
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 12:14 EDT
Nmap scan report for 10.129.85.248
Host is up (0.0063s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http

hashtag
Blog Enum + Joomla

The page was some type of blog.

In one of the posts, there's a user called floris.

The page source also had a hidden file:

Within it, it had a base64-encoded string. We can pipe the output and decode it:

Can't use these for now, so let's run a gobuster scan as well.

Loads of directories. The /administrator directory had a Joomla login:

We can login using floris:Curling2018!.

We can follow the instructions from Hacktrikcs to get RCE on this website by creating new PHP Templates.

LogoJoomla - HackTricksbook.hacktricks.xyzchevron-right

Then we can get a reverse shell using a bash one-liner.

hashtag
Privilege Escalation

hashtag
Password Backup

We can't capture the user flag yet. In floris home directory, there's a password-backup file.

It appears that the hexdump of the original file was taken and this is what is left. We can reverse this with xxd -r.

This file turns out to be loads of zip files, so we have to do bunzip2 and gunzip twice and tar once. Eventually, we will end up with this file:

We can use this to su to floris.

hashtag
To Root

I ran pspy64 on the machine to see if there were background processes running as root.

There was some curl command being used to read something. Here are the files in question:

So this was reading the URL from a file and outputting it elsewhere. The command uses the config command, which one can read more here:

Logocurl - How To Usecurl.sechevron-right

Essentially, we can specify extra tags here, like --output as output and so on.

This means that we can download any files as root since root is the one who is running the commands by changing the curl configuration file used (which we conveniently have write access over).

This means we can overwrite files like /etc/passwd and add new root users to the machine. First, we would need to get a copy of the /etc/passwd of the machine onto ours, and append this line to it:

This would create a new user within the /etc/passwd file called innocent with a password of password123. Then we need to change the configuration files to this and start a HTT Pserver:

After the machine has downloaded the file, we can just su to our new user.

Rooted!

PreviousBuffNextDoctor