Solving the Hack Smarter Challenge Lab: Samurai (Writeup) — My Approach

Shalom 🕊️!

Here is another writeup for the Samurai Challenge Lab on Hack Smarter.

I hope it's helpful…☺️

Objective

As part of a penetration test, your team identified an interesting web server. Your task is to enumerate the target, establish an initial foothold, and escalate privileges to root.

1. What is the user flag?

2. What is the root flag?

I begin with a simple Nmap scan:

Notice there are two open ports, I perform a much comprehensive scan on the two open ports to see the services running and to see if we can find anything interesting:

I didn't find anything interesting in the scan as well.

Directory Bruteforcing

I try playing around with the site and checking the robots.txt and sitemap to see if there'll be any interesting finds but there was nothing so I try a directory bruteforce:

I usually like to use dirsearch for a quick directory listing. It is usually enough for me, but it's my personal preference. You can use other directory bruteforcing tools like gobuster, ffuf, dirbuster

dirsearch -u http://ipaddress

dirsearch -u http://ipaddress

I find some interesting directories from the scan. I check out some of the directories to see if there'll be any interesting finds.

From the /administrator and the /README.txt directory I notice it's a Joomla CMS.

I see it's running Joomla version 4. I use joomscan to perform a scan for more details.

joomscan -u [ipaddress]

joomscan -u [ipaddress]

I see the Joomla version is 4.2.5. I search SearchSploit for any vulnerabilities:

From the searchsploit results only two exploits are applicable. The rest are below the Joomla version of the target.

I search google too to see what I can find.

From the search results I see the like vulnerability is the information disclosure one.

I find the GitHub for the exploit for the vulnerability. Follow the instruction to install the dependencies you need to run the exploit. It was written in ruby.

GitHub - Acceis/exploit-CVE-2023-23752: Joomla! < 4.2.8 - Unauthenticated information disclosure Joomla! < 4.2.8 - Unauthenticated information disclosure - Acceis/exploit-CVE-2023-23752

I find the exploit code on the exploit database. I copied it and run it following the GitHub instructions.

ruby exploit.rb http://ip-address:80

ruby exploit.rb http://ip-address:80

I got some credentials I think I can use to sign in to the admin page. I try different combinations of the user name and the Username Miyamoto and the Db Password work.

I have now have access to the admin dashboard! I need to find a way to get a reverse shell. I locate the pages and plant my shell code there.

I go to system > site templates and then I click on the current template

Now I see the content of the template site. I look for any of the php pages and put my reverse shell code there.

I edit the index.php and put my reverse shell code there.

I then access the page to get my reverse shell, but before that I set up my listener using penelope and then visit the page containing my shell code.

penelope -p 1234

penelope -p 1234

I get my shell! 🍾🥳

I find my flag at var/www

I try to access the root directory for the root flag but didn't work. Need to escalate privileges here:

I try to see what this current user can run using sudo:

I see that I DbMaria can be run with sudo and runs as root. After checking out the DbMaria using strings and file command I realise it is vulnerable to command injection. I use the injection code below to see if I can escalate my privilege and it works!

sudo /opt/backup/DbMaria 'test; /bin/bash -p #'

sudo /opt/backup/DbMaria 'test; /bin/bash -p #'

I become root user now. I find the flag in the /root directory which I can now access as root.