BBSCute - Easy
Enumeration
Nmap
┌─[sheinn101@parrot]─[~/offsec/BBSCute]
└──╼ [??]$ sudo nmap -sC -sV -oN nmap.out 192.168.129.128
Starting Nmap 7.92 ( https://nmap.org ) at 2021-11-07 08:56 +0630
Nmap scan report for 192.168.129.128
Host is up (0.29s latency).
Not shown: 995 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 04:d0:6e:c4:ba:4a:31:5a:6f:b3:ee:b8:1b:ed:5a:b7 (RSA)
| 256 24:b3:df:01:0b:ca:c2:ab:2e:e9:49:b0:58:08:6a:fa (ECDSA)
|_ 256 6a:c4:35:6a:7a:1e:7e:51:85:5b:81:5c:7c:74:49:84 (ED25519)
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.38 (Debian)
88/tcp open http nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: 404 Not Found
110/tcp open pop3 Courier pop3d
|_pop3-capabilities: STLS LOGIN-DELAY(10) PIPELINING USER IMPLEMENTATION(Courier Mail Server) UTF8(USER) UIDL TOP
| ssl-cert: Subject: commonName=localhost/organizationName=Courier Mail Server/stateOrProvinceName=NY/countryName=US
| Subject Alternative Name: email:postmaster@example.com
| Not valid before: 2020-09-17T16:28:06
|_Not valid after: 2021-09-17T16:28:06
|_ssl-date: TLS randomness does not represent time
995/tcp open ssl/pop3 Courier pop3d
|_pop3-capabilities: TOP LOGIN-DELAY(10) PIPELINING USER IMPLEMENTATION(Courier Mail Server) UTF8(USER) UIDL
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost/organizationName=Courier Mail Server/stateOrProvinceName=NY/countryName=US
| Subject Alternative Name: email:postmaster@example.com
| Not valid before: 2020-09-17T16:28:06
|_Not valid after: 2021-09-17T16:28:06
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 34.67 seconds
baDirectory Scanning
Web
Default install page for Apache on Port 80
In index.php , We got a login page.
I tried default credentials and some sql injection but nothing work. So let's create a new users.
As you see , we need Captcha to register account, but it's not load on the page.
But in the source code, we can see captcha.php
When we click on that, we will get captcha text .
We can use this Captcha to register accounts.
Finding Exploit
In the bottom of page, we can see that is running Cutenews 2.1.2 , When I google about this and I found and exploit for this.
Clone this repo and run it.
python3 CVE-2019-11447.py <username> <pass> http://IP/index.php
Getting Reverse Shell
Now we get a shell. To get a stable shell , Listen with netcat and run the following command
Now we get a stable shell. As a easy box, let's find what binary has SUID bit is set.
Privilege Escaplation
We can see hping3 has SUID bit. When we find hping3 in GTFObin and we can see like this,
hping3 has already SUID bit and we don't need to add sudo . Run hping3 and type /bin/bash -p
Now we pwned it.
Last updated