> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/warm-up/linux/exfiltrated.md).

# Exfiltrated

Writeup for Exfiltrated from offsec Proving Grounds

## Information Gathering <a href="#information-gathering" id="information-gathering"></a>

`sudo ./nmapAutomator.sh 192.168.142.163 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FzyrOIXnaevRyfsfyQ6pg%2Fimage.png?alt=media\&token=6d1feffe-211b-4953-866a-6a092babbb85)

### Service Enumeration

### HTTP (Port 80)

Notice from our initial information gathering there is a `robots.txt` directory with 7 disallowed directories. Upon navigating to `/panel/`, we see an admin login page. We also take note that this is Subrion CMS v4.2.1.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FbyhphgCykTpyQ8Y4VVu4%2Fimage.png?alt=media\&token=15a67ad5-1722-445a-a438-5f62d090d873)

## Exploit <a href="#information-gathering" id="information-gathering"></a>

We can log in using `admin:admin` to access the dashboard.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F0mkvyBMBs6tfIzI8ZOrp%2Fimage.png?alt=media\&token=bb0b895a-2d7e-4ba2-804e-15c78e6e3527)

SubrionCMS 4.2.1 is vulnerable to Authenticated Remote Code Execution. `/panel/uploads` in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a `.pht` or `.phar` file, because the `.htaccess` file omits these.

{% embed url="<https://github.com/h3v0x/CVE-2018-19422-SubrionCMS-RCE.git>" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FVfYHo9cTZC9zH5JERB0e%2Fimage.png?alt=media\&token=6bd67d34-f45e-465b-8a1c-57e7ac439ef7)

## Privesc <a href="#information-gathering" id="information-gathering"></a>

Running LinEnum on the target, we see something interesting.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F0kmVlKNkqUjiLWTEFub8%2Fimage.png?alt=media\&token=98f24212-250d-49b8-b102-911fc44589f4)

Notice that there is an unusual file inside the crontab - `/opt/image-exif.sh`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FxHxkTyDLQsfqYkELWeTT%2Fimage.png?alt=media\&token=e9bad045-cc03-4a0d-8da7-32513026b732)

This script seems to be running `exiftool`. Apparently improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image.

{% embed url="<https://amalmurali47.medium.com/an-image-speaks-a-thousand-rces-the-tale-of-reversing-an-exiftool-cve-585f4f040850>" %}

Once we got `exploit.jpg` on our attack machine, we can upload it to the target machine using `wget` and python SImpleHTTPServer.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F7MZw6WG0UH284aHtAyTP%2Fimage.png?alt=media\&token=cabc0dc7-324c-4c6b-9431-1ec7e3226c06)

Now we can check /bin/bash and we realize that it has the SUID set, which allows us to run it and get root.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FUBv49u3DfdBDvF2PIzzw%2Fimage.png?alt=media\&token=9712d2ce-e648-49a2-a60f-2eaf9109f7df)