Surveillance
Last updated
Last updated
Craft CMS (probably 4.4.14)
Ubuntu
Nginx 1.18.0
The version 4.4.14 of Craft CMS is vulnerable to unauthenticated Remote Code Execution (RCE) CVE-2023-41892:
The vulnerability affects Craft 4 only. Sites running Craft 3 are not affected. This is because the vulnerability is in the ConditionsController class (used by the condition builder) that was added in version 4.0.0.
Run it:
From this simple php webshell, obtain a more stable reverse shell:
We can use python3 to run the reverse shell:
Exploring the wild, we can find under backups directory and interesting zip:
Download on attacking machine and unzip it:
Using an online tool in order to beautify the SQL code we find an INSERT statement SQL for users table:
email: admin@surveillance.htb
password hash: 39ed84b22ddc63ab3725a1820aaa7f73a8f3f10d0848123562c9f35c675770ec
The hash is probably a SHA256 mode:
Crack it with hashcat:
Password is: starcraft122490
The login as admin:starcraft122490 not work against CMS private area:
But if we try to connect to SSH using matthew username and cracked password is a win:
And the user.txt is here:
Enumerating manually we find other users that exist on this box:
Using linpeas we find these useful infos:
Searching manually for this configuration file:
Try entering the MySQL database locally using zmuser and password ZoneMinderPassword2023 we find these useful infos inside zm database:
admin | $2y$10$BuFy0QTupRjSWW6kEAlBCO6AlZ8ZPGDI8Xba5pi/gLr2ap86dxYd.
We need to do an SSH tunnelling in order to access the remote ZoneMinder panel locally:
Instead of cracking the password we change manually it by replacing the bcrypt hash.
Compute the new bcrypt hash for the password P@ssword1!:
Then update the row of admin user:
Login is successfully:
After a while, the current session is invalidated and logout is forced.
We know that the version is 1.36.32 and googling for some sort of CVE we find that there is an anauthentication RCE by exploiting Snapshots command injection:
Using metasploit we can obtain a reverse shell as zoneminder user:
Stabilize the session by spawning a pseudo-tty in python3:
If we type sudo -l in the terminal we see a strange line of sudoers file:
Here is what it means:
(ALL : ALL): Specifies the permissions to which this rule applies. In this case, ALL indicates that the rule applies to all users (ALL) and all groups (ALL).
NOPASSWD: Indicates that no password is required to execute the specified command.
/usr/bin/zm[a-zA-Z]*.pl: The specific path to the command to which the rule applies. This command is /usr/bin/zm[a-zA-Z].pl, where [a-zA-Z] denotes any sequence of lowercase or uppercase letters.
In summary, this line allows all users and groups to run the command beginning with /usr/bin/zm followed by a sequence of letters (lowercase or uppercase) followed by .pl, and does not require them to enter a password to do so.
List all the possible PERL script under /usr/bin in order to analyze the code and spot the vuln:
Scripts are owned by root and are only executable/readable by other users, so we have to inspect the parameters of these binaries. Download all the binaries using download command of meterpreter:
After analyzing each parameter of each PERL script downloaded, we find a possible miscoding in zmupdate.pl script.
If we pass as user the following string $(/bin/bash -i) we obtain a shell because:
$(...): This is the syntax of "command substitution" in bash. Anything inside the parentheses is executed as a separate command, and its output is captured and used as input for the external command.
/bin/bash -i: This is the command that is executed inside the brackets. /bin/bash is the full path to the bash shell, while the -i (or --interactive) option indicates to run the shell in interactive mode, which means that an interactive interface is provided for the user, allowing for example, auto-completion of commands.
Due to a failure to sanitize the input, qx() executes the command but anything specified within $(...) takes precedence in execution and thus a shell is spawned.
Dump the root.txt flag:
