HTB - October
Getting Root:
The box is running October CMS and we can login using admin:admin
Navigating to
/backend/cms/mediaallows us to upload php files and we can get a reverse shellEnumerating the box shows an interesting executable with the suid bit which is vulnerable to buffer overflow
Tools Used:
nmap, dirsearch.py, nc, gdb (with the peda extension)
Nmap
Enumeration
Dirsearch.py
Navigating to /backend redirect us to http://10.10.10.16/backend/backend/auth
We can login with admin:admin and the application allows us to upload php files. I uploaded a webshell and was able to get a shell.
By clicking on the hyperlink, the application open the location of the webshell in anew tab.
Now we can get a reverse shell using netcat.
Exploitation
Privilege Escalation
There is binary with the suid set /usr/local/bin/ovrflw
Let's try to see if we can exploit this binary by overriding EIP by sending a unique pattern and finding the offset using gdb with peda extension.
Creating a unique pattern of 500 bytes using pattern_create 500
We noticed EIP got overridden by pattern 'AA8A'
Finding the offset using pattern_offset AA8A we can see the offset is 112
Finding the address of libc
libc.so.6: b7610000
Finding the offset the system, exit and /bin/sh
system: b7650310 (b7610000 + 40310)
exit: b7643260 (b7610000 + 33260)
/bin/sh: b7772bac (b7610000 + 162bac)
Converting them to little endian, we have:
system: \x10\x03\x65\xb7
exit: \x60\x32\x64\xb7
/bin/sh: \xac\x2b\x77\xb7
Therefore we can try to execute the exploit as follows:
Root
Last updated