AdminPanel
Nmap Scan
Foothold
I start by checking both HTTP service on port 631 and pot 3000
So here I have a 403 Forbidden from port 631 and a service to fetch URL on port 3000, seems like a classic scenario for fetching forbidden resource using the second service, but since the Query website does not reflect the fetched data this would be blind exploit so I need as much information as I can get about the Forbidden service on port 631.
Since nmap scan showed CUPS 2.4.12 at least I have a starting point to do some research.
Get dj4m’s stories in your inbox
Join Medium for free to get updates from this writer.
I could not find a vulnerability for this version of cups so I went back to port 3000 and did more fuzzing, since this a nodejs I decided to test even for .js extension to eventually find an interesting endpoint
then looking at this file I can see the source code for the app running where I identified another interesting API endpoint
The problem is that this endpoint only takes POST requests from localhost(127.0.0.1) and using the open-url endpoint will send a GET request so I cannot use it as is.
But since the open-url is simulating a browser not just fetching the page source, it would be running any javascript that is fetched, so I can create a HTML page that sends the POST request to exec endpoint then fetch it with the open-url endpoint to get it run by the chromium-browser module!
I tried using a javascript based fetch request at first but that did not work so I tested that locally and fetched my html file from burpsuite browser
with that I found that the my html was actually triggering an OPTIONS request instead of POST being sent, doing some research I found that When a page is loaded from a different origin the chromium-browser trigger a CORS preflight request to make sure it’s allowed!
To bypass that I had to submit a plain HTML request by constructing a form and then using javascript to submit it
shell Access
with my command injection success confirmed I just changed the command to a rev shell and with that I was able to get root shell on the machine and access to proof.txt flag
