The most interesting locations are probably /login and /admin, but we don’t have credentials, and are instructed not to brute force the autentication - So, Let's dig for any subdomains :)
We can use tools such as ffuf or wfuzz
$ wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://cmess.thm" -H "Host: FUZZ.cmess.thm" --hw 290
Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 2.4.5 - The Web Fuzzer *
********************************************************
Target: http://cmess.thm/
Total requests: 4997
===================================================================
ID Response Lines Word Chars Payload
===================================================================
000000019: 200 30 L 104 W 934 Ch "dev"
Total time: 68.70782
Processed Requests: 4997
Filtered Requests: 4996
Requests/sec.: 72.72825
Let's add that new subdomain in our /etc/hosts file - Now, let’s see what we can get from this subdomain
$ curl -s dev.cmess.thm | html2text
***** Development Log *****
**** andre@cmess.thm ****
Have you guys fixed the bug that was found on live?
**** support@cmess.thm ****
Hey Andre, We have managed to fix the misconfigured .htaccess file, we're
hoping to patch it in the upcoming patch!
**** support@cmess.thm ****
Update! We have had to delay the patch due to unforeseen circumstances
**** andre@cmess.thm ****
That's ok, can you guys reset my password if you get a moment, I seem to be
unable to get onto the admin panel.
**** support@cmess.thm ****
Your password has been reset. Here: KPFTN_f2yxe%
We are provided with an email address and a password. Now you can log in in the /admin directory
Email: `andre@cmess.thm`
Password: `KPFTN_f2yxe%`
Once logged in, go to Content > File Manager.
Now, download a PHP shell, add a file named shell.php in the assets directory and put the content of the PHP reverse shell - Get a www-data shell :)
Lateral Movement
Checking the /etc/passwd file gives us another system user called andre, So lets hunt for any misconfigurations which will make us andre :)
Fortunately checking the /opt directory gives us a .password.bak file which had clear text credentials for the user andre - Tried connecting it with the ssh service and we get a stable shell now :)
Privilege Escalation
There was a tar wildcard injection found in the /etc/crontab - which was running every two minutes -
*/2 * * * * root cd /home/andre/backup && tar -zcf /tmp/andre_backup.tar.gz *
So asusual check for this particular misconfig on gtfobins and shoot the queries :)