Payday
Nmap scan
the full scan is too big to show so here I only show the port scan to give context to the rest
Enum
First i start with SMB as this can be a quick gain
I only see the print$ Disk that might be interesting so i take a quick look at web app
Foothold
I checked searchsploit for any available exploit for CS-CART and found a bunch of exploits already there
so next thing would be to find the version of CS-CART we are running agains, I checked the page-source but did not find any trace. The app version would be probably exposed on authenticated pages specially admin pages so I try credentials admin:admin and I was able to login but only had access as a client not an admin. This means the credentials are valid but I was not using the right login page, I need to find the admin login page. I go for http://192.168.187.39/admin and i redirects http://192.168.187.39/admin.php
Use admin:admin again and I’m in
Under Administration on the right side I can see Upgrade center, this page will most probably show the current version of CS-CART, and yes it was there
Initial Access
With the application version confirmed I check searchsploit findings again and I see the authenticated RCE for the exact version 1.3.3 so I go for it
so the exploit is a .phtml file upload that triggers a reverse shell.
Get dj4m’s stories in your inbox
Join Medium for free to get updates from this writer.
I go for a different version of the attack, So I will be uploading a web shell then from the web shell I will create a cronjob that starts a revshell every 2 minutes, I prefer this method since in the case of losing the shell access all i need is to wait for a new one, this is useful specially when using dumb/basic shell since they are easy to lose
First I had to find the upload function under Look And Feel > Template Manager the I uploaded my own php webshell after I changed the extension to .phtml instead of .php
Unfortunately this did not work so I tried revshell from pentestermonkey and then i will add the cronjob. After uploading the revshell I go to /skins and just click rev.phtml to get connection back to my listener
Once connected i added the cronjob to get persistence
I was already able to get the user flag since I had read access to user patrick home directory and the local.txt file
Post enum
Looking at a/etc/group user Patrick is on multiple groups, this means a lot of permissions so I will try to get access to this user
Since the credential for web app were admin:admin I tried patrick:patrick for the user and this worked
Lateral movement
Privilege escalation
then i found this user can run all commands with sudo so i just run sudo su to get root and get proof.txt
