Curling
Easy - Linux
Recon
Logging into the web service, we can see it is a Joomla instance. Enumerating the version, I couldn't find any particular exploits that worked, moving on. We can see a few posts on the home page, although one is signatured by Floris.
Getting RCE & Lateral Movement
Viewing the home page source, there's an HTML comment with the content: secret.txt. Navigating to that gives us a password, and logging into floris gives us the Super User account, but no ssh yet. Let's get RCE first. Inserting a simple system($_GET["cmd"]) into the template's error.php gave us command execution as www-data. That's a start. Let's try to view floris' directory. password_backup is readable, seems to be a hexdump of something. I'll exfil that to my attacking machine, run xxd -r to revert it back to its original form, and run file to identify what it is. It's a bzip compressed archive, let's run bunzip2. Another archive. It turned out to be multiple forms of archives, but finally we get a password.txt which we could use to login to floris through SSH.
Privilege Escalation
In floris' home directory, there's an interesting subdir named admin-area with two files: input and report. The contents of input were odd, but corellated with the contents of report:
To learn more about the situation, I ran pspy to view possible cron jobs running periodically.
There was indeed a cron job calling curl with the -K flag pointing to the input file and outputting it to record. Viewing the man page for curl, we can find the -K flag is taking curl arguments from a file. I first thought we might be able to insert a malicious argument, but then remembered to keep it simple. Let's try to alter the url to the root flag instead:
Sure enough, the root flag appeared in report. Another one done!
Last updated