Personal WebsiteLinkedin

Devvortex

Enumeration

nmap -A -p- -sC -sV -Pn -v devvortex.htb

Port 80

Enumerating any hidden directories or files seems to not reveal any important hint:

Also enumerating based on extensions of backend technology:

Further we did DNS enumeration for the devvortex.htb website using Host Header enumeration, which showed us the existance of a new domain dev.devvortex.htb:

Add the vhost dev.devvortex.htb to /etc/hosts and enumerate it:

Try to enumerate some hidden directories:

/robots.txt:

/administrator:

We can enumerate the version of Joomla simply visiting this file:

/administrator/manifests/files/joomla.xml

/api:

Info

  • nginx/1.18.0 (Ubuntu)

  • vhost dev.devvortex.htb

    • Joomla 4.2.6

    • /api enabled

Exploitation

Finding if this version of Joomla is vulnerable, we can try this exploit:

This Ruby script nicely formats information that can also be found via cURL or browser as shown above.

LogoGitHub - Acceis/exploit-CVE-2023-23752: Joomla! < 4.2.8 - Unauthenticated information disclosureGitHub

The CVE-2023-23752 Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

LogoJoomla! Developer NetworkJoomla! Developer Network™

We need to install Ruby dependecies:

Download Gemfile, install dependencies using bundle install and run exploit:

Info

  • Database info

    • username: lewis

    • password: P4ntherg0t1n5r3c0n##

    • db name: joomla

    • db type: mysql

    • db prefix: sd4fg_

Enumeration 2

Access /administrator section of Joomla using lewis credentials:

Add a new file cmd.php with your preferred webshell:

List OS users:

We need to spawn a reverse shell in order to have a semi-TTY and interact with MySQL database:

Enumerate on MySQL:

List tables:

List all users:

Try to crack this password with hashcat.

Identify the mode:

Crack it:

Privilege Escalation (logan)

Login in SSH using logan:tequieromucho credential

Verify what commands logan can run using sudo:

apport-cli is a command-line tool in Ubuntu (and its derivatives) that allows users to interact with the Apport crash reporting system. Apport is a system that automatically collects data about crashes, errors, and other malfunctions on the system, and then presents them in a user-friendly format for reporting to developers and Ubuntu maintainers.

Here's a brief overview of apport-cli:

  1. Reporting Crashes: apport-cli allows users to manually report crashes and errors to the Ubuntu developers. This can be useful for providing detailed information about the issue encountered, which can help developers diagnose and fix the problem.

  2. Collecting Data: When a crash occurs, apport collects various data such as log files, stack traces, and other diagnostic information related to the crash. This data is then presented to the user for review and optionally for reporting.

  3. Non-Interactive Mode: apport-cli can also be used in non-interactive mode, where it collects crash information and sends it to the Ubuntu error tracker without user intervention. This can be useful for automated error reporting or debugging tasks.

  4. Usage: The basic usage of apport-cli involves specifying the package name or process ID (PID) of the crashed application, along with any additional options for collecting debug information.

LogoNVD - CVE-2023-1326nvd.nist.gov
LogoGitHub - diego-tella/CVE-2023-1326-PoC: A proof of concept for CVE-2023–1326 in apport-cli 2.26.0GitHub

A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrator would configure sudo to allow unprivileged users to perform this class of exploit.

To generate a .crash report, run a simple command like this one:

Note the PID:

Send SIGSEGV signal:

To spawn a root shell, wait that the pager less provide to you the command prompt ':' and then type /bin/bash

Now we're finally root:

PreviousManagerNextPov

Last updated