Blunder

HTB Writer Up

Lets start with nmap

root@liberty:/home/kali# nmap blunder.htb
Starting Nmap 7.91 ( https://nmap.org ) 
Nmap scan report for blunder.htb (10.129.4.41)
Host is up (0.019s latency).
Not shown: 998 filtered ports
PORT   STATE  SERVICE
21/tcp closed ftp
80/tcp open   http

Nmap done: 1 IP address (1 host up) scanned in 4.82 seconds
root@liberty:/home/kali# nmap -sV blunder.htb
Starting Nmap 7.91 ( https://nmap.org ) 
Nmap scan report for blunder.htb (10.129.4.41)
Host is up (0.015s latency).
Not shown: 998 filtered ports
PORT   STATE  SERVICE VERSION
21/tcp closed ftp
80/tcp open   http    Apache httpd 2.4.41 ((Ubuntu))

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.65 seconds
root@liberty:/home/kali#

Next is Nikto - Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers:

Next we will enumerate some directories with Dirb - DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary based attack against a web server and analyzing the response

This allows us to quickly locate interesting directories such as admin portals:

We also find the find site. This site has a lot of words. I think this is a perfect time for CeWL.

After fuzzing with dirb i came across this information on /to.txt

I'm thinking that fergus might be a username. Also after doing a quick google I came across this exploit:

LogoBludit 3.9.2 - Authentication Bruteforce Mitigation BypassExploit Database

There are a couple of ruby requirements for this exploit so lets install them now.

Lets give this exploit a try:

With these creds we how have access to the admin portal. After googling "blundit admin portal exploit" I came across this article:

LogoBludit 3.9.12 - Directory TraversalExploit Database

Looks like there is also a Metasploit moduleshell

LogoRapid7Rapid7

Lets stablize this shell

Lets begin our enumeration both manually and automated. To automate we will use linenum.sh:

LogoGitHub - rebootuser/LinEnum: Scripted Local Linux Enumeration & Privilege Escalation ChecksGitHub

Grep the contents on the application looking for phrases such as auth, password, and key we come across this result for users.php

Lets user hash-identifier to see what we are dealing with here:

This hash can be cracked online. Let use the password to access the system with this user.

Lets locate the user flag now that we have access outside of our php shell.

We can check our sudo permission using sudo -l

After some googling we come across this exploit:

Logosudo 1.8.27 - Security BypassExploit Database

They don't come any easier than this. Looks like our privilege escalation require this one line of code - sudo -u#-1 /bin/bash

PreviousFuseNextUnblanced

Last updated