[ 0. Summary ]─────────────────────────────────────────────────────────────//───
An easy Linux box from Hack The Box. It is very beginner friendly, as it does
not require many specialist tools, or knowledge of advanced concepts. It can be
solved with some basic (yet diligent) enumeration.
[ 1. Recon ]───────────────────────────────────────────────────────────────//───
Scanning the host with nmap reveals only two open ports: a web application
running on port 80 and ssh on port 22.
Running nmap with the `-sC` flag to probe the open ports reveals that the
application running on the server is Backdrop CMS v1, and it hosts a git
repository.
Time for a browse of the site. It's a simple blog, with only a few pages, but
does support login. We can see a user, dogBackDropSystem, has created a post,
and attempting to log in with some dummy credentials reveals that this is a
valid user name.
[ 2. Local Access ]────────────────────────────────────────────────────────//───
We can freely browse the git repo through the browser, but we should run
git-dumper to pull everything down and inspect locally with git tooling.
Inspecting the git history, there is a distinct lack of commits and developer
comments to guide us. A file in the root of the project, settings.php always
triggers the spidey-senses, and browsing uncovers a mysql connection string!
mysql://root:<REDACTED>@127.0.0.1/backdrop
The username/password combination does not allow us to log in to the site, and
is also not the password for dogBackDropSystem.
The form suggests we can also log in with an email address. The about page tells
us a valid email, dog@dog.htb. Let's search the git repository for any
occurrences of the domain to look for valid credentials.
grep -r -l '@dog.htb' ./
This provides 2 emails:
* root@dog.htb
* tiffany@dog.htb
Trying the password we found earlier with these users, and we can log in as
tiffany with admin privileges, success!
Googling `Backdrop CMS` vulnerabilities returns many results about possible RCE
exploits in early versions, involving the `module` installation feature. This is
to be expected, as `Backdrop` is a fork of `Drupal`, where exploits such as
these are well known.
In order to achieve code execution, start a web server and install your
malicious module via the URL parameter. The site only supports upload of
tar archives, and these seemed to land in the tmp files directory, where they
couldn't be executed.
*N.B. A known Drupal attack vector is to add malicious code to a downloaded
copy of a Module the site is running, and uploading that. This vector may prove
more fruitful than simply uploading an archived reverse shell in this case*
Once installed, it can be found in the /modules directory
Running our shell creates a connection to the target machine, and we're in.
We can nab the user flag by reusing the same password again to login as
the file owner.
[ 3. Root Access ]─────────────────────────────────────────────────────────//───
A simple check of sudo privileges shows the path to root access. Reading the
documentation for the binary we have enhanced privileges over shows various
options for executing arbitrary code on the host, which can easily escalate
our priveleges for complete control of the machine.
──[ EOF ]──────────────────────────────────────────────────────────────────//───