HTB: BoardLight — Writeup
Level of Difficulty: Easy
How many TCP ports are listening on BoardLight?
To know which ports are open, I used nmap to scan ports.
Command nmap -sC -sV -vv 10.129.231.37
The result shows two open ports:
- port
22service: SSH - port
80service: HTTP with Apache httpd 2.4.41
What is the domain name used by the box?
SSH is one of the most secure service with encryption enabled. Without valid credentials (username and password), it will be difficult to break in. So to start, I checked the port 80 in the browser. The page shows a website titled ‘BoardLight’. Upon scrolling, I found the domain board.htb
What is the name of the application running on a virtual host of board.htb?
In each pages in the web, I found that the pages are php-based. For example, Home path is 10.129.231.37/index.php. These pages do not tell me the application it was running on or anything that is helpful. I decided to try using ffuf to fuzz its virtual hosts.
Command used: ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://10.129.231.37:80 -H 'Host: FUZZ.board.htb'
The top result is interesting, it shows crm as one of the subdomains. Before trying to open the page, I put the IP address of the instance to /etc/hosts so that the computer recognizes the IP address and is able to resolve the address quickly.
So in my /etc/hosts file, the IP 10.129.231.27 is mapped to both board.htb and crm.board.htb.
I opened crm.board.htband found the answer to this question.
It shows that the application runs on the virtual host crm.board.htb is Dolibarr. This page also shows the answer to the next question:
What version of Dolibarr is running on BoardLight?
That is 17.0.0
For the next step, I googled the exploit that relates to Dolibarr 17.0.0. This is documented as CVE-2023–30253 (which answers the question “What is the 2023 CVE ID for an authenticated vulnerability that can lead to remote code execution in this version of Dolibarr?” also). I found some sources online that said this version is vulnerable for PHP Code Injection. Specifically, it is vulnerable to an uppercase manipulation.
What is the default password for the admin user on Dolibarr?
From searching online, I found this page that I think is worth trying for login. I tried login with admin username and admin password, and it leads me to an admin page.
Although it says, ‘Access denied’, I still can access the ‘Websites’ tab, which shows me this page. This could be our entry point for exploitation. I created a website and a page within the website. Click the HTML tab in the Page, and it will show you the HTML source of the page. This we can use to put in the PHP code. As seen in previous pictures of CVE googling, typing <?php shows error but changing it into <?pHp will pass the checking.
Get Irena Irmalasari’s stories in your inbox
Join Medium for free to get updates from this writer.
This script is from GitHub — ivan-sincek/php-reverse-shell: PHP shells that work on Linux OS, macOS, and Windows OS. Change the lhost and lport into our local IP and port. Don’t forget to also put a listener on our local computer. After clicking save, tap the google button on the page to trigger the page (and code) execution.
Just a little bit of a note, it seems that they have some sort of session in creating the website. As we can see from the picture below, the page and the website that were created no longer exist in just a few minutes. To mitigate this, we need to create the website, page, add the code, and trigger the code very quickly.
What user is the Dolibarr application running as on BoardLight?
After triggering the page, we can see on our listener that we have gained access to the user’s shell. This also shows us the user we are in, that is www-data. This is also the default web-server user for Apache on Ubuntu.
What is the full path of the file that contains the Dolibarr database connection information?
For Apache webserver such as BoardLight, the default document root directory is /var/www/html. Dolibarr is located at crm.board.htb. So, I look for /var/www/html/crm.board.htb/htdocs/conf/conf.php to look for Dolibarr’s database connection information. Here, I found the password for the database. I tried using this password to see if it works for logging in as user larissa.
Turns out it did! I was able to log in as larissa and get the flag.
What is the name of the desktop environment installed on BoardLight?
First of all, as we can see from the nmap scanning result, BoardLight has a port open for SSH. I tried to login as larissa using SSH with the previous password, and it worked. We will now proceed from ssh bash.
Let’s see what permission does larissa have.
As we can see, larissa does not have sudo permission. Now, we try to see suid file we can leverage. suid is an executable file that runs with the permission of the owner. So, we need to find a file that runs with root privileges so that we can escalate privilege.
Based on this, I used this command to look for suid files:
find / -perm -4000 2>/dev/null2 refers to error message that may come. So, 2>/dev/null means to output error messages to /dev/null or “null device”. Basically, this part of the command is to disregard error messages.
Upon Googling, I found this information about “Enlightenment”
From this, we know the answer to the question would be Enlightenment.
What version of Enlightenment is installed on BoardLight?
From the suid search also, we can tell the version of Enlightenment installed, that is 0.23.1. Now we can search for CVE related to Enlightenment v0.23.1.
What is the 2022 CVE ID for a vulnerability in Enlightenment versions before 0.25.4 that allows for privilege escalation?
Google searching shows that Enlightenment version before 0.25.4 allows for local privilege escalation, which is marked with CVE-2022-37706. We can leverage this to gain root access.
Clicking to one of the websites, we now can use the exploit given on BoardLight.
We now look for the flag. I found it at ../root/root.txt.
