HackTheBox: Curling

Curling is a very interesting easy machine which first challenges us with the Joomla CMS, followed by a privilege escalation with Polkit’s pkexec on Linux.

Enumeration

Nmap

Looking at the scan, we see that only ports 22 and 80 are open.

# Nmap 7.94SVN scan initiated as: nmap -p22,80 -sCV -n -Pn 10.129.150.135
Nmap scan report for 10.129.150.135
Host is up (0.095s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Home
|_http-generator: Joomla! - Open Source Content Management
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We go to the website hosted on port 80, where we find a blog.

Web Enumeration

We enumerate the website and find that it is managed by Joomla.

Joomla! is a free and open-source content management system (CMS) for publishing web content.

curl -s http://<DOMAIN>/ | grep Joomla

Version:

curl -s http://<DOMAIN>/README.txt | head -n 5

Knowing the website uses Joomla, we found the administrator panel by going to /administrator.

We couldn’t find any credentials by bruteforcing, so we went in search of a user on the blog.

User Enumeration

On the main page we find a post made by a person who left their name, which hints at a username. The post also has the word curling2018 that looks a lot like a password, but it didn’t work.

Finally, we have a possible username: floris.

We continued looking through the source code and saw a comment was left, pointing to a document. We open it and find what appears to be a base64-encoded string.

echo Q3VybGluZzIwMTgh | base64 -d

Now we have a password.

Foothold

Now that we have access to the administrator panel, we can use several techniques to achieve RCE.

RCE

We go to Templates at the bottom left, under Configuration.

Next, we click on the Templates option.

We can choose the Protostar template for our purpose.

Now let’s select a page to insert our webshell; for this we can use error.php.

We insert our payload into the PHP code, then click Save & Close.

Using curl we execute our webshell.

curl -s "http://10.129.81.108/templates/protostar/error.php?cmd=whoami"

We list the folders on the server, find a single user in /home, and within it a password_backup file.

Looking at its content, we find that it is a hexdump.

To obtain clear text, we used CyberChef. After passing the text through different decoding modes, we obtained what appears to be a text file with some content inside.

We tried this text with the user floris via SSH, and it worked.

Now we got our first flag.

Privilege Escalation

For privilege escalation we start by noting that the user does not have permission to use sudo on the server.

Next, we notice that the kernel and sudo versions are outdated.

We found this version to be vulnerable to PwnKit: a self-contained exploit for CVE-2021-4034, a local privilege escalation in Polkit’s pkexec.

https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034

For our purpose we used Metasploit.

After backgrounding a session, we use the cve_2021_4034_pwnkit_lpe_pkexec exploit, which directly gave us a session as root.

Here we got our final flag.

Thanks for reading.