ports=$(nmap -Pn -p- --min-rate=1000 -T4 10.10.10.206 | grep open | awk -F / '{print $1}' ORS=',') echo $ports && nmap -p$ports -sV -sC -v -T4 -oA scans/nmap.full 10.10.10.206
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
+80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Passage News
-
http server is running cutenews cms
- cutenews: CuteNews is a FREE, powerful and easy-to-use news management system based on flat files as a storage with quick installation, search function, file upload management, backup & restore, IP banning, permission levels supporting, flood protection and many more. Moreover Cutenews is UTF-8 fully compatible system.
-
in the web page there is a rss feed link which goes here
http://passage.htb/CuteNews/rss.php
this is inside cms directory and thats how we get cms directory.-
going to cms directory we get login page and also cms version -
-
Version: 2.1.2
-
Exploit: CVE-2019-11447 RCE ExploitDB
-
msf module:
exploit/unix/webapp/cuteNews_rce
-
-
using exploitDB python script we get the web user shell on the box -
-
inside
/var/www/html/CuteNews/cdata/users/
found a file named "lines" contains some password hashes -for i in $(cat /var/www/html/CuteNews/cdata/users/lines | grep -v php); do echo $i | base64 -d | grep -E '[0-9a-z]{64}' | grep -oE '[a-z0-9]+@[a-z]+.[a-z]{3}|[0-9a-z]{64}' && echo; done
-
crack the paul password hash and the same user have shell in the box so we can try to su to user paul
-
it looks like user paul's .ssh directory coatins user nadav ssh key -
-
use that private ssh key to get nadav shell -
-
something in the viminfo file -
-
searching about these files find something interesting about USBCreator here
-
flaw in the USBCreator D-Bus interface which:
Allows an attacker with access to a user in the sudoers group to bypass the password security policy imposed by the sudo program. The vulnerability allows an attacker to overwrite arbitrary files with arbitrary content, as root – without supplying a password. This trivially leads to elevated privileges, for instance, by overwriting the shadow file and setting a password for root.
- D-Bus is a messaging system that is a core system on many Linux systems, allowing for communications between processes running on the same system. This vulnerability is in how this process, interface mistakenly allows for an attacker to trigger it to do something unintended, arbitrary write as root.
-
i don't understand it completely but found the exploit in the end of the article to just get the root
-