# \[Linux] Ignite

## Reconnaissance

```bash
sudo nmap 10.10.2.133
sudo nmap -A -p 80 10.10.2.133
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FrzRpn6IX1LlY06wrxkUq%2Fimage.png?alt=media&#x26;token=6005029a-978b-4642-a65c-75d4508ae027" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FDCqWdVQeaeElsYIaWhFm%2Fimage.png?alt=media&#x26;token=f868604b-fe96-4c88-b4ad-9e4d898f09c3" alt=""><figcaption></figcaption></figure>

## Enumeration

### HTTP

The last [nmap ](https://kmanu225.gitbook.io/cs/cybersecurity/ctf/tools/network/enumeration/nmap)scan shows the [robots.txt](https://kmanu225.gitbook.io/cs/cybersecurity/web-applications/enumeration/robots.txt) file contains a Disallow entry for the webpage `/fuel`.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FDSZRjGmN7SiCbmjtKLZi%2Fimage.png?alt=media&#x26;token=db197e13-0cb8-49dd-ae35-18f639481abb" alt=""><figcaption></figcaption></figure>

We can enumerate subpages with [gobuster](https://kmanu225.gitbook.io/cs/cybersecurity/ctf/tools/web/gobuster).

```bash
gobuster dir -u http://10.10.2.133/ -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.10.2.133/fuel -w /usr/share/wordlists/dirb/common.txt
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FK67kSVcwsHqyxB6DCPMc%2Fimage.png?alt=media&#x26;token=9e6aa131-9ea1-436a-97eb-473c33e1c690" alt=""><figcaption></figcaption></figure>

At the webpages `/home`, `/0`, `/index`, and `/index.php`, we obtain valid credentials for the login page at `/fuel`. However, the pages `/offline` and `/assets` are inaccessible. The [`robots.txt`](https://kmanu225.gitbook.io/cs/cybersecurity/web-applications/enumeration/robots.txt) file confirms what was discovered during the [Nmap ](https://kmanu225.gitbook.io/cs/cybersecurity/ctf/tools/network/enumeration/nmap)scan.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2F8Z72fWmUQaHHrT8vMV3X%2Fimage.png?alt=media&#x26;token=fa8a6d78-b769-4d19-808e-25696664f300" alt=""><figcaption></figcaption></figure>

The default password has not yet been changed.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FH7omKtRo0aoIJvFlyTpc%2Fimage.png?alt=media&#x26;token=2ad68053-0ddf-4851-a94e-2860f1a67f2e" alt=""><figcaption></figcaption></figure>

We're unable to upload a PHP file to obtain a web shell or reverse shell. Since Fuel is a CMS, we can investigate known vulnerabilities associated with it to find potential exploits.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FuNmLnYtFJCA7UtnbhdgC%2Fimage.png?alt=media&#x26;token=2ab71900-70b2-4c67-af4b-9936b8f9d479" alt=""><figcaption></figcaption></figure>

### Vulnerabilities research

```bash
searchsploit fuel
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2Ff6NzNHyw7eBEWQyB4RvA%2Fimage.png?alt=media&#x26;token=b8a7b9dd-9aaa-4fd0-8f34-da7a289d4978" alt=""><figcaption></figcaption></figure>

Our fuel version is 1.4 so it is vulnerable to RCE attack.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FC9jNcPZODBNeucNS8vuN%2Fimage.png?alt=media&#x26;token=2e0b6dc0-656c-4ed9-83b8-b15c68fe29a2" alt=""><figcaption></figcaption></figure>

## Initial access

We can attempt to exploit the Remote Code Execution (RCE) vulnerabilities in Fuel CMS. By leveraging this vulnerability, we may be able to execute commands remotely and establish a reverse shell for deeper access to the system. We get the user flag at `/home/www-data`.

```bash
locate webshell
cp /usr/share/webshells/php/php-reverse-shell.php .
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FTeJyeGeHNuHI01YdVsnv%2Fimage.png?alt=media&#x26;token=4a95e5f0-cf15-4cf5-a459-cbb0e1b4b1ee" alt=""><figcaption></figcaption></figure>

## Escalation

Exploring the subdirectories, we discovered a database configuration file containing the root password. Fortunately, this root database password also serves as the root user’s Unix password, allowing us to gain root access to the system. The root flag is at /root.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FNk5LH68FKPLAuL2yBtmA%2FCapture%20d&#x27;%C3%A9cran%202024-11-01%20072930.png?alt=media&#x26;token=70b4330b-d454-4a30-b6ec-14e63dc66f91" alt=""><figcaption></figcaption></figure>

## Remediation

To enhance security:

* [ ] Replace default application passwords with strong, unique passwords for each account.
* [ ] Update the application to the latest version to patch known vulnerabilities.
* [ ] Avoid reusing passwords across different systems; the Unix password should differ from the database password to reduce the risk of credential compromise.
