BitForge - Proving Grounds Practice
Enumeration
Nmap
Initial nmap scan revealed SSH and HTTP ports were open. Moreover, it showed .git directory is accessible on website.
Web Enumeration
Website directed us to bitforge.lab so I added it to /etc/hosts file.
Later, I found a subdomain in the website called plan.bitforge.lab.
It was Simple Online Planning 1.52.01 (SOPlanning 1.52.01) website.
Exploitation
git-dumper
I could not find any default credentials. However, as shown in nmap output I found .git directory.
So I used git-dumper tool to dump it.
Then checked commit history using git log command.
Then used git show <commit_id> command and obtained DB password.
MYSQL
Then I logged in to mysql but I added --skip-ssl flag to avoid TLS errors.
I read the admin password hash.
However, it was not crackable. I tried and it did not work. Later, I opened https://github.dev/Worteks/soplanning to checkout default admin credentials and I found it.
Then I tried to update the password on DB and it worked.
I was able to login.
CVE-2024-27115
An authenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02.
So there was a CVE for Simple Online Planning 1.52.01 (SOPlanning 1.52.01). I found an exploit (https://www.exploit-db.com/exploits/52082) and executed it.
Later, to get a better shell I transfered pentest-monkey reverse shell.
Then obtained upgraded shell.
PSPY64
Then I transfered pspy64 and linpeas.sh files.
Executing pspy64 revealed jack’s password.
So I switched to jack and obtained user flag.
Privilege Escalation
sudo -l (NOPASSWD flask run)
At first I switched to SSH shell. Then I executed sudo -l and found I could execute flask_password_changer as sudo.
It was .sh script. It was at first changing directory to /opt/password_change_app then running flask run.
flask run commands executed app.py on current directory. And we have write access to app.py.
So I updated app.py to execute chmod +s /bin/bash. And simply obtained root.