Ignite
A CTF challenge by TryHackMe.com
Difficulty: Beginner
https://tryhackme.com/room/ignite
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-17.png)
We start off by scanning the box with nmap as always to see what ports, and services are open and running on the box.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-18-1024x345.png)
It looks as if an Apache webserver is running on port 80 of the box, and there is a robots.txt entry as well. Lets navigate to the webserver in our browser to see what we can find. We also want to check out the robots.txt entry to see if there is a directory at “/fuel” on the webserver.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-19-1024x569.png)
Lets take a look at the robots.txt entry to verify what we found on our nmap scan.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-20-1024x209.png)
This verifies what we found. Lets try and see if there is something located at the /fuel directory location on the webserver.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-21-1024x502.png)
We now have a login form to start prodding for potential usernames and passwords. Lets open up burpsuite to capture the login string, as well as determine if the login uses GET requests or POST.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-23-1024x169.png)
Now that we have determined that the CMS uses POST requests to authenticate, lets try and use hydra to see if we can brute force the login page. We can use the captured information from burp to craft our http-post-form that hydra will need for this to work.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/Inkedletsgo_LI.jpg)
We successfully found a working set of credentials for the CMS. Lets login and see what we can leverage to get a shell on the box.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-26-1024x278.png)
I searched the dashboard for a bit trying to find a way to upload a reverse web shell, but it looks like this may be a dead end. Let’s take a look for any potential exploits for the Fuel CMS Version 1.4 on searchsploit.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-27-1024x169.png)
It looks like we found several options available on searchsploit. Since we discovered earlier the webserver is running Fuel CMS version 1.4 we might be in luck. Lets take a look at the last exploit on the list labeled Remote Code Execution.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-28-1024x570.png)
After downloading the exploit, I needed to make some changes in order to make the exploit work. I imported the script into Pycharm IDE to make the changes that I needed.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-30-1024x375.png)
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-29-1024x353.png)
Running the python script should give us Remote Code Execution on the box. Lets give it a shot!
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-31-1024x135.png)
So far so good! Lets try a command to confirm we have code execution on the target. The whoami command should let us know who we have access to on the system.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-32-1024x69.png)
This proves that our code execution is working on the system. Now lets see if we can find some other tools on the system to help us get a fully functional shell. This limited shell is great for simple commands, but we need a fully interactive shell in order to escalate our privileges. Lets look to see if the target has “nc” installed.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-33-1024x80.png)
Now that we have confirmed netcat (“nc”) is installed on the system. We can pipe in a reverse shell to our exploit command prompt, and catch the reverse shell back on our local machine. Lets set up a local listener on the machine. Since I want to minimize interference from the firewall, I start my listener on the DNS transfer port 53. This will make the firewall more likely to trust the connection, and not drop the connection once it is established.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-34-1024x159.png)
Now we use a common reverse shell command from pentest monkey.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-35.png)
There are a couple of different netcat reverse shells we could use for this. In this scenario we will use the second one listed on the reverse shell cheat sheet. Lets tailor the command to our needs and enter it in our exploit command prompt to see if we can get a reverse shell.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/Inkedllllll_LI.jpg)
It worked! We now have a fully interactive shell on the system
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/Inkednnnnnnn_LI.jpg)
Lets use which to confirm python is installed as well.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/Inkedthelastone_LI.jpg)
With confirmation that python is installed, lets go ahead and import pty to spawn a (“/bin/bash”) shell instead.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-39-1024x52.png)
Now that the shell is stabilized, lets grab the user flag.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/Inkeduserflag_LI.jpg)
Now that we have the user flag, lets enumerate the system to see if we can find any information on the root user.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-41-1024x73.png)
After searching around the web directories of the system, we were able to discover a config directory for the fuel CMS. Lets take a look inside to see if we can find something of interest.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/image-42-1024x229.png)
I looks as if there is a database.php file in the directory. As this seems like an important file, lets cat out the contents to see what we can discover.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/Inkeddb_LI.jpg)
Bingo! It looks as if we may have found a possible password for the root account. Lets try and switch users in our bash shell to see if the password works for the root user.
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/Inkeddddkdkd_LI.jpg)
Awesome! We are now the root user on the system! Let go grab the final root flag!
![](https://www.badtothepwn.com/wp-content/uploads/2021/01/Inkedrootflag_LI-1.jpg)
Conclusion
This was a very fun box leveraging a specific exploit (CVE 2018-16763) to which FuelCMS version 1.4 is vulnerable. Using the RCE exploit allowed us to then perform arbitrary code of any kind of the system. We used that as leverage to gain a fully functional shell on the system via a netcat reverse shell. After gaining our initial access, we enumerated the system further to find a potential password for the root user on the system. Simply switching to the root user via the su command, and entering the discovered password, allowed us to fully compromise the system, and gain root access to the machine. Overall a very fun box, and a reminder that searchsploit can be your best friend at times. Big thanks to the creators of the box DarkStar7471, and Paradox.