Personal WebsiteLinkedin

PermX

Enumeration

nmap -v -A -O -p- -T4 -Pn -sC permx.htb -oN nmap

Port 80

Trying to fuzzing vhosts we obtain some interesting results:

Navigate to lms.permx.htb after adding it to /etc/hosts:

Chamilo is an open-source learning management system (LMS) that provides a comprehensive platform for e-learning and online education. It is designed to facilitate the creation, management, and delivery of educational content and courses.

The username associated to Davis Miller, the Administrator of platform, is admin.

Foothold (www-data)

Searching on the web seems to exists a PoC for the CVE-2023-4220 associated to Chamilo versions preceding 1.11.24.

LogoGitHub - m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc: This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220GitHub

Ok, seems to be vulnerable, so upload a webshell and then trigger a revshell using the -a revshell option:

Searching in the file system we can find an interesting config file:

But trying to login using these credentials is a fail:

So get linpeas and start enumeration obtaining some passwords:

and the user with console on the system:

Privilege Escalation (mtz)

SSH as mtz user using password -> 03F6lY3uXAP2bkW8

and get the user flag 🎉

Privilege Escalation (root)

Checking the sudo privileges we see that the mtz user can run acl.sh:

This script can change the permissions of any file inside the /home/mtz directory. So let’s just make a symbolic link to the sudoers file and change our permissions on this file to read/write:

After that just open the helpfile and add mtz user to sudoers, sudo su and get root flag:

PreviousBlazorizedNextCicada

Last updated