Exfiltrated
Writeup for Exfiltrated from offsec Proving Grounds
Last updated
Was this helpful?
Writeup for Exfiltrated from offsec Proving Grounds
Last updated
Was this helpful?
sudo ./nmapAutomator.sh 192.168.142.163 all
Notice from our initial information gathering there is a robots.txt directory with 7 disallowed directories. Upon navigating to /panel/, we see an admin login page. We also take note that this is Subrion CMS v4.2.1.
We can log in using admin:admin to access the dashboard.
SubrionCMS 4.2.1 is vulnerable to Authenticated Remote Code Execution. /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.
Running LinEnum on the target, we see something interesting.
Notice that there is an unusual file inside the crontab - /opt/image-exif.sh
This script seems to be running exiftool. Apparently improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image.
Once we got exploit.jpg on our attack machine, we can upload it to the target machine using wget and python SImpleHTTPServer.
Now we can check /bin/bash and we realize that it has the SUID set, which allows us to run it and get root.
