search
GithubTwitterMediumLinkedin

BBSCute - Easy

hashtag
Enumeration

hashtag
Nmap

┌─[sheinn101@parrot]─[~/offsec/BBSCute]
└──╼ [??]$ sudo nmap -sC -sV -oN nmap.out 192.168.129.128
Starting Nmap 7.92 ( https://nmap.org ) at 2021-11-07 08:56 +0630
Nmap scan report for 192.168.129.128
Host is up (0.29s latency).
Not shown: 995 closed tcp ports (reset)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 04:d0:6e:c4:ba:4a:31:5a:6f:b3:ee:b8:1b:ed:5a:b7 (RSA)
|   256 24:b3:df:01:0b:ca:c2:ab:2e:e9:49:b0:58:08:6a:fa (ECDSA)
|_  256 6a:c4:35:6a:7a:1e:7e:51:85:5b:81:5c:7c:74:49:84 (ED25519)
80/tcp  open  http     Apache httpd 2.4.38 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.38 (Debian)
88/tcp  open  http     nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: 404 Not Found
110/tcp open  pop3     Courier pop3d
|_pop3-capabilities: STLS LOGIN-DELAY(10) PIPELINING USER IMPLEMENTATION(Courier Mail Server) UTF8(USER) UIDL TOP
| ssl-cert: Subject: commonName=localhost/organizationName=Courier Mail Server/stateOrProvinceName=NY/countryName=US
| Subject Alternative Name: email:postmaster@example.com
| Not valid before: 2020-09-17T16:28:06
|_Not valid after:  2021-09-17T16:28:06
|_ssl-date: TLS randomness does not represent time
995/tcp open  ssl/pop3 Courier pop3d
|_pop3-capabilities: TOP LOGIN-DELAY(10) PIPELINING USER IMPLEMENTATION(Courier Mail Server) UTF8(USER) UIDL
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost/organizationName=Courier Mail Server/stateOrProvinceName=NY/countryName=US
| Subject Alternative Name: email:postmaster@example.com
| Not valid before: 2020-09-17T16:28:06
|_Not valid after:  2021-09-17T16:28:06
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 34.67 seconds
ba

hashtag
Directory Scanning

hashtag
Web

Default install page for Apache on Port 80

In index.php , We got a login page.

I tried default credentials and some sql injection but nothing work. So let's create a new users.

As you see , we need Captcha to register account, but it's not load on the page.

But in the source code, we can see captcha.php

When we click on that, we will get captcha text .

We can use this Captcha to register accounts.

hashtag
Finding Exploit

In the bottom of page, we can see that is running Cutenews 2.1.2 , When I google about this and I found and exploit for this.

https://github.com/CRFSlick/CVE-2019-11447-POCarrow-up-right

Clone this repo and run it.

python3 CVE-2019-11447.py <username> <pass> http://IP/index.php

hashtag
Getting Reverse Shell

Now we get a shell. To get a stable shell , Listen with netcat and run the following command

Now we get a stable shell. As a easy box, let's find what binary has SUID bit is set.

hashtag
Privilege Escaplation

We can see hping3 has SUID bit. When we find hping3 in GTFObinarrow-up-right and we can see like this,

hping3 has already SUID bit and we don't need to add sudo . Run hping3 and type /bin/bash -p

Now we pwned it.

PreviousFunboxEasyEnum - EasyNextCapture The Flag (CTF)

Last updated