BoardLight
Last updated
Last updated
It appears to be a simple showcase site, and even a directory scan with ffuf returns nothing.
Trying to scan vhosts always with ffuf we get nothing. This is very strange... 🤔
Let's go back to the homepage and see if we can extract additional information such as employees, additional domain names, etc.
In the footer we see that the domain name is not boardlight.htb but board.htb:
At this point trying to run a new scan of possible vhosts immediately ffuf returns something super interesting:
This is the login page of Dolibarr ERP/CRM which is an Open source modular software that suits small and medium-sized enterprises (SMEs), foundations and freelancers.
Trying admin:admin credentials we can enter in a sort of restricted area of CRM:
But is still possible to create website and under each website a test page. In fact, if we create a new website and create a blank page with some HTML code this will be visible from the browser:
By clicking on the preview symbol to the right of the page :binocul or by reaching the correctly set URL, the created page can be viewed:
The juiciest and most interesting thing of all though is that it is possible to create pages with dynamic content in other words with PHP code that could get us a reverse shell.
But if we try to enter some PHP code using the classic tag we obtain the following error:
The good news, however, is that there is a vulnerability that allow us to easily bypass this restriction and the reference is this one:
This is the payload used to exec some shell commands on backend:
List files in the current working directory:
We can list the users on the machine and we will find larissa:
Verify if some useful binaries exists:
after several attempts we finally find the reverse shell working and get a session in pwncat:
Googling (https://wiki.dolibarr.org/index.php?title=Configuration_file) we find that Dollibarr's configuration file is in conf/conf.php as shown in the figure:
dolibarrowner <--> serverfun2$2023!!
The first idea was to enumerate further by checking for other users within the MySQL database:
With show tables; we can list the tables present in this database:
llx_user is the most interesting table but difficult to read using the reverse shell:
If we copy this output to a mysql editor formatter like this one we can easily read the password hashes and users:
It's a Blowfish hash type:
Instead if we simply try to SSH with this password as larissa user enumerated before we obtain the user flag:
Download linpeas.sh under /tmp and start it:
Enlightenment is a Window Manager, Compositor and Minimal Desktop for Linux (the primary platform), BSD and any other compatible UNIX system.
Adding crm.board.htb to /etc/hosts and visiting the URL we will reach a login page
Easy Peasy!
And the first credential set appear magically :
Try to crack it using Hashcat is a fail
After trying several different avenues (from port 33060 open only in localhost to the different CVEs listed but not compatible with the Ubuntu Focal 21.04 version of the machine) and many hours of reviewing linpeas output came enlightenment!
Using the exploit found on GitHub we can obtain the root flag
