Easy Linux box. A public Gitea repo leaks the Pluck CMS password hash, CVE-2023-50564 gives RCE, and Depix recovers the root password from a pixelated PDF.
GreenHorn runs a Pluck CMS site on port 80 alongside a Gitea instance on port 3000 that serves the site’s own repository to anonymous users. Diffing that repository against the upstream pluck 4.7.18 release surfaces data/settings/pass.php, a SHA-512 hash of the CMS admin password, which hashcat cracks straight out of rockyou.txt. Pluck 4.7.18 is vulnerable to CVE-2023-50564, an authenticated arbitrary file upload through the module installer, and a public proof of concept uses the admin session to upload a zipped PHP payload and return a reverse shell as www-data. The same cracked password belongs to the local user junior, so a straight reuse moves sideways into that account. Junior’s home directory holds Using OpenVAS.pdf, whose embedded image contains the root password with a pixelation filter over it, and pdfimages plus Depix reverse the pixelation well enough to read the password and log in as root over SSH.
BS01: Exposed Secrets - Gitea
Explanation
There is a Gitea instance running on http://greenhorn.htb:3000, that allows for unauthenticated remote users to view the source code for the GreenHorn main website on port 80. By reviewing the repository at http://greenhorn.htb:3000/GreenAdmin/GreenHorn, we identified the existence of files in the source code of GreenHorn that are not present in the original Pluck CMS github repository for the same version. Among these files,
importfilecmpimportosimportsysdefcompare_directories(dir1,dir2):"""
Compare two directories and report differences in file content,
added files, and deleted files.
"""# Create a dircmp object for comparison
dir_comparison=filecmp.dircmp(dir1,dir2)report_differences(dir_comparison)defreport_differences(dir_cmp):"""
Recursively report differences between directories.
"""# Report files only in the first directory
ifdir_cmp.left_only:print(f"\nFiles only in {dir_cmp.left}:")foritemindir_cmp.left_only:print(f"{item}")# Report files only in the second directory
ifdir_cmp.right_only:print(f"\nFiles only in {dir_cmp.right}:")foritemindir_cmp.right_only:print(f"{item}")# Report files that are in both directories but differ in content
ifdir_cmp.diff_files:print(f"\nFiles that differ between {dir_cmp.left} and {dir_cmp.right}:")foritemindir_cmp.diff_files:print(f"{item}")# Recursively compare subdirectories
forsub_dirindir_cmp.subdirs.values():report_differences(sub_dir)if__name__=="__main__":# Ensure correct usage
iflen(sys.argv)!=3:print("Usage: python compare_directories.py <directory1> <directory2>")sys.exit(1)# Get directory paths from command-line arguments
directory1=sys.argv[1]directory2=sys.argv[2]# Check if the provided paths are valid directories
ifnotos.path.isdir(directory1)ornotos.path.isdir(directory2):print("Both arguments must be valid directories.")sys.exit(1)# Perform the directory comparison
compare_directories(directory1,directory2)
┌──(kali㉿kali)-[~/…/htb/machines/easy/greenhorn]
└─$ python3 compare_directories.py GreenHorn pluck-4.7.18
Files that differ between GreenHorn and pluck-4.7.18:
README.md
SECURITY.md
admin.php
<SNIP>
Files only in GreenHorn/data/settings:
install.dat
options.php
pages
pass.php
themepref.php
token.php
update_lastcheck.php
Files that differ between GreenHorn/data/settings and pluck-4.7.18/data/settings:
langpref.php
<SNIP>
Grab the SHA-512 hash at GreenHorn/data/settings/pass.php and save to greenhorn.pass:
The Pluck CMS version used in GreenHorn (4.7.18) is vulnerable to CVE-2023-50564. According to NIST:
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.
There are public PoCs available to exploit this vulnerability.
The password obtained after cracking the SHA-512 hash earlier (refer to BS01) is not only valid for the admin user in the Pluck CMS instance but also valid for the local user “junior” as well. We can escalate privileges horizontally by logging in as “junior”.
Steps to Reproduce
Obtain initial access (refer to BS02).
Create rev.py, replacing “ATTACKER-TUN0-IP” by your actual tun0 ip address:
Use the same password uncovered earlier (refer to BS01) to log in as junior:
1
2
3
4
5
6
www-data@greenhorn:~/html/pluck/data/modules/payload$ su junior
Password:
shell-init: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
junior@greenhorn:/var/www/html/pluck/data/modules/payload$ id
uid=1000(junior) gid=1000(junior) groups=1000(junior)
junior@greenhorn:/var/www/html/pluck/data/modules/payload$
We can now add our SSH public key to /home/junior/.ssh/authorized_keys to obtain access through SSH.
BS04: Vertical Privilege Escalation - Informational PDF
Explanation
In user “junior” home folder, we can see an informational PDF:
1
2
3
4
5
6
7
junior@greenhorn:/var/www/html/pluck/data/modules/payload$ cd ~
chdir: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
junior@greenhorn:~$ ls -l
total 64
-rw-r----- 1 root junior 33 Oct 29 22:21 user.txt
-rw-r----- 1 root junior 61367 Jun 11 14:39 'Using OpenVAS.pdf'
junior@greenhorn:~$
The “Using OpenVAS.pdf” contains the following message:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Hello junior,
We have recently installed OpenVAS on our server to actively monitor and identify potential security
vulnerabilities. Currently, only the root user, represented by myself, has the authorization to execute
OpenVAS using the following command:
`sudo /usr/sbin/openvas`
Enter password: [CENSORED PASSWORD IMAGE, USING PIXELIZATION]
As part of your familiarization with this tool, we encourage you to learn how to use OpenVAS
effectively. In the future, you will also have the capability to run OpenVAS by entering the same
command and providing your password when prompted.
Feel free to reach out if you have any questions or need further assistance.
Have a great week,
Mr. Green
However, censoring sensitive information like passwords with pixelization is not secure, and there are tools available that can uncover the real text if the right conditions are met. That is exactly what happened, we were able to revert the original text from the pixelated image and use this password to log in as root, which completely compromises the host.
Steps to Reproduce
Download the PDF to your attacking machine using SCP or netcat or other means
Extract the censored password image from the PDF:
1
2
3
4
5
$ pdfimages pdf.pdf pdf-image -png
┌──(kali㉿kali)-[~/…/htb/machines/easy/greenhorn]
└─$ ls -l pdf-image-000.png
-rw-rw-r-- 1 kali kali 502 Oct 30 10:21 pdf-image-000.png
Use this tool to recover the password from the censored image:
