Devvortex

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 10.129.37.255                   
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-30 10:25 EST
Nmap scan report for 10.129.37.255
Host is up (0.017s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Did a detailed scan for the HTTP port as well:

$ nmap -p 80 -sC -sV --min-rate 3000 10.129.37.255
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-30 10:26 EST
Nmap scan report for 10.129.37.255
Host is up (0.0074s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://devvortex.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

I added devvortex.htb to the /etc/hosts file.

Web Enum -> CVE-2023-23752 Disclosure

The website was a corporate website for a service provider:

There was nothing inherently interesting about this site, so I went ahead with a gobuster directory and wfuzz subdomain scan.

wfuzz picked up on a dev subdomain, whereas gobuster didn't pick up on much:

Add this to the /etc/hosts file. This dev endpoint was looked to be another corporate site:

I checked the page source, and found a lot of references to a cassiopeia directory:

Googling for this led to Joomla! Content Management System showing up.

I checked online on how to enumerate this website, and found that visiting /administrator/manifests/files/joomla.xml would reveal the version running:

There are a number of vulnerabilities that affect this version of Joomla, most notably an unauthenticated information disclosure one.

LogoJoomla! v4.2.8 - Unauthenticated information disclosureExploit Database

Reading the script, it seems that visiting /api/index.php/v1/config/application?public=true would show a password, and it worked!

There was a user lewis, and using this password allowed me to sign in to the admin panel at /administrator.

Hacktricks tells me that RCE is possible from here by replacing a .php file with a webshell, similar to Wordpress.

After saving, I tested and found that RCE works:

From here, getting a reverse shell is easy.

Privilege Escalation

MySQL Enum -> User Creds

There is a user logan within this machine, and I cannot read the user flag yet.

Since we had the password of lewis, I thought to check the MySQL database present:

From this database, I grabbed the hashed password of logan, then cracked it using john.

Using this password, I could su to logan.

Sudo Privileges -> Apport-CLI Exploit

logan can run apport-cli as the root user:

Checking the version, both the distro and version of the software were outdated and had a specific exploit for it:

LogoImproper Privilege Management in apport | CVE-2023-1326 | SnykLearn more about ubuntu:22.10 with Snyk Open Source Vulnerability Database
LogoBug #2016023 “viewing an apport-cli crash with default pager cou...” : Bugs : apport package : UbuntuLaunchpad

I tried to use the application, and it kept telling me I needed to have a crash report.

Based on this, I had to create a crash report which would be stored in /var/crash, which can be done like so:

Afterwards, following the exploit, the crash dump file will be located /var/crash, and I could access it and use option 'V':

Then, just !bash to get a root shell:

Rooted!

PreviousCodifyNextDrive

Last updated