TRYHACKME- CMSpit

Hello, I recntly completed the THM - CMSpit room on TryhHackMe in which i exploited a recent cves to get both foothold & root here & now making a walkthough, Enjoy!

CVE-2021-22204 - FootHold

CVE-2021-22204 - Root

Here we start off with an nmap scan & we find 2 ports opened;

Now looking at the web page on port 80 we find a login page of a cms;

Now after some research(google) we find out that this cms has multiple vulnerabilities, We find a good blog explaiing how the vulnerabilities work & how to exploit it(see refrence)

Now let’s get started with finding valid users.

Now compromising the users; Firstly we can generate a resetpassword token for each users;

We can query each token to return to us more User information(username, email, password hash, API key, password reset token)

Now we have the token we can change user password with token;

Now login in with changed password (my case “Newpassword123”);

we can find the web flag by browsing to /finder directory of the web page;

After studying the web app we discover we are able to upload new files, So we are going to upload a webshell here & eventually a reverse shell waiting in our netcat listener;

We can confirm our webshell by runing a simple linux “id” command;

Now we can upload our reverse shell to get our RCE waiting on netcat listener here;

Now we can stablize the shell & enumerate this www-data user, After running linpeas we find an interesting mongoDB laying around, Yes we’ll enumumerate that & we find some creds.

we can ssh into the user machine we’ve just discovered with password;

We have our user.txt here & we can now escalate our privileges to root. Running the sudo -l command we can see that stux user could execute the exiftool as the root without requiring root password (CVE-2021-22204) Visiting gtfobins and searching on the binary name we see this tool can be used to read and write files. We change it to read from a file and output it to a file in a directory we can read from.

so we run; sudo exiftool -filename=/home/stux/root.txt /root/root.txt

And dang! we have a root.txt file from root user.

Exploiting CVE-2021-22204 to get root?

https://github.com/convisoappsec/CVE-2021-22204-exiftool

https://github.com/AssassinUKG/CVE-2021-22204

REFRENCES

https://tryhackme.com/room/cmspit

https://swarm.ptsecurity.com/rce-cockpit-cms/

https://gtfobins.github.io/gtfobins/exiftool/

https://github.com/convisoappsec/CVE-2021-22204-exiftool

https://github.com/AssassinUKG/CVE-2021-22204