Astronaut - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed HTTP and SSH ports were open.
WEB Enumeration
The website was Grav CMS website.
I found admin login page on the website. Tried some default credentials but none of them worked.
Exploitation
CVE-2021-21425
While searching grav exploit on google, I found a post from mehmet ince which explains a unauthenticated RCE on grav cms. It also included metasploit script.
And found a github repo that included exploit script for this CVE.
I tried to exploit and it worked. I got a reverse shell.
Metasploit script also worked and got me a reverse shell.
Privilege Escalation
admin.yaml
While searching through web files I found a yaml file which included admin’s hashed password. I tried to crack it but could not. So it was useless.
PHP (SUID Bit)
I checked SUID binaries and found that PHP was SUID binary.
I found GTFOBins page for php SUID exploitation.
Then applied the steps and got root.