Silver Platter | TryHackMe | WriteUp

First thing first, Starting with nmap scan;

nmap -T4 -sC -sV -Pn -o nmap.scan 10.10.46.53

22->ssh

80-> http

8080-> http-proxy

10.10.46.53:80 doesn’t load in my browser, so tried 10.10.46.53:8080 treated with 404 not found.

checked the source code, but useless.

Going to scan for hidden directories;

gobuster dir -u http://10.10.46.53:8080 -w /usr/share/wordlists/dirb/common.txt -o dir.scan

got

/console

/website

Doesn’t seems to work, so again starting from scratch:

http://10.10.46.53:80/

why the hell it’s not loading, but http://10.10.46.53:8080 is loading.

Starting the silver platter machine again, problem is still there.

Going to use TryHackMe AttackBox for this room,

now http://machine-ip:80/ is working here

In the Contact section a service called Silverpeas comes with a username.

silverpeas seems a directory but on which port 80 or 8080.

http://10.10.227.106:8080/silverpeas/defaultLogin.jsp

Get Unkn9wn’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

we have a username but where is the password???

we may try to bruteforce the password but it’s already told that they check against the rockyou.txt, that will no use.

Trying most default credentials, admin admin; Admin Admin;not working;

simple google search… what is default credentials for silverpeas? Not able to find some useful.

Let’s search for vunlerablities in silverpeas.

source: github.com

fireup the burpsuite and capture the request, remove the Password parameter.

Got the dashboard for admin i guess. Language is different on webpage.

found from one of the writeups,

CVE-2023–47323: Silverpeas Core Broken Access Control Allows Reading All Messages

http://localhost:8080/silverpeas/RSILVERMAIL/jsp/ReadMessage.jsp?ID=[messageID]

Just change the value of ID parameter like ID=0,1,2,3,4,5,6,… until we find something that has some use to us.

i think i guess some ssh credentials,

got the shell as tim.

for the user flag:-

read the /home/tim/user.txt

Privilege Escalation

Although, LinEnum.sh finds /usr/bin/write.ul with SGID…

manual enumeration: cat /etc/passwd

it’s look like tyler is root here. looking for backups files, log files

cd /var/log/

grep -R tyler

Look through the output. You will find the tyler password for a service.

That’s it.