Hub - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed SSH, HTTP, 8082i 9999 ports were open.
WEB Enumeration
The port 80 had nothing special. When I visited it just showed forbidden. However Port 8082 had FuguHub running.
It redirected me to set an admin for the website.
Then I logged in as admin.
After visiting about page, I found that FuguHub 8.4 was running.
Exploitation (Directly Root)
CVE-2024-27697
The about page is an editable page that executes LSP code (Lua Server Pages), a PHP/ASP-like scripting language, simplifies the design of remote real-time monitoring and controller applications for embedded systems. Its content can be changed through the Administrator panel. The vulnerability inserts a reverse shell written in lua into the About page which is viewable to both logged in and logged out users.
Customizable page can be seen below.
I found an exploit that both explains and automates that vulnerability.
At first I tried to exploit it manually as explained below.
Edited the customizable page and added reverse LSP shell.
And visiting the about page got me reverse shell.
I could also run exploit.py directly and get a reverse shell.
Then I reaad the root flag.