Momentum: 2

By Lawcky 18/01/24

Introduction

Momentum: 2

Difficulty : Medium

Additionnal info :

Name: Momentum: 2
Release date: 28 Jun 2021
Author: AL1ENUM
Series: Momentum

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• ffuf
• file upload (packet forging)
• python3 privesc

---

Write-UP

FUZZING

ffuf -w /usr/share/SecLists/Discovery/Web-Content/common.txt:FUZZ -u http://192.168.1.59/FUZZ -fc 403 -e .txt,.html,.php

dashboard.html allows the uploads of files

ajax.php not readable

/js/main.js

found the upload function

after using a stronger wordlist found :

/owls/

---

File Upload

the dashboard.html only allows files that ends with .txt

which are then uploaded at /owls/

we were able to download the bak of ajax.php using the browser

http://192.168.1.59/ajax.php.bak

we can upload php files if we are the admin, for that we need the cookie &G6u@B6uDXMq&Ms with one more Upper case letter and with specific parameters in our request, we can forge this request and send it while fuzzing for the last Uppercase letter of the alphabet with tools like burp for exemple.

---

Forging a packet

here is the default packet of the server when uploading a file:

we need to add the POST parameter secure with the value= val1d

and the admin cookie that’ll be fuzzed for the 26 Uppercase letters of the Alphabet.

note: the §F§ represents the character that’ll be modified for each different POST requests.

it worked and the last uppercase letter was R

we now have successfully uploaded a php file

---

Privilege Escalation

from www-data to user

4WpJT9qXoQwFGeoRoFBEJZiM2j2Ad33gWipzZkStMLHw

first flag found

athena:myvulnerableapp*

got athena

---

Privilege Escalation

from athena to root

sudo -l

the script in question :

after reviewing the code i understood that the seed was getting echo’d to the log.txt file before the end of the script. which means we can use the echo command to execute command by using

echo $()

which mean we can execute one command as root

before the shell crashes taking also down the ssh connection, since just entering $(/bin/bash) is getting root which then instantly crashes we need something else, like a reverse shell, or changing root password in a single command.

option 1 :

changing root password in a single command

echo -e "1234\n1234" | passwd

option 2:

getting a reverse shell

4bRQL7jaiFqK45dVjC2XP4TzfKizgGHTMYJfSrPEkezG

got second flag