0

I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables and stuff like that, no RCE visible escalation. So i discovered an exploit on exploit-db.com that leads to LFI, after some research i was able to do RCE through User-Agent and GET requests sending . So i'm able to read the directories and "cat" some of the files out while reading the httpd-access.log file, but i can't run any reverse shell on the server, seems like i can't even 'nc' to my machine. I managed to send a php code through the User-Agent doing the reverse shell but when i did it, the server simply crashed. Any ideas on how i could continue to explore the machine? Thanks

Update-1: Sorry, i was a bit tired when i first posted it. So, i'll put here what i got till now.

  • Whoami = www

  • I can read apache logs & conf files, passwd, groups.

  • There's two users with /bin/bash in this machine. (Root and gerencia)

  • SSH is enabled. I tried to brute-force it with rockyou.txt as the pass_file for gerencia, but didn't work out.

  • Reverse shells used(pentest monkey): bash, php, python.(none of them worked)

  • I searched for id_rsa files in the home directories, found none.

  • When i list the /home directory it show nothing, but when i list /home/gerencia it works.

  • Found something a bit different, some /home directories are in /usr/local instead of the / dir.(/gerencia and /gerente)

  • I can't 'echo' into files, doesn't matter if i'm in a rwx dir.(but i can 'touch' new files)

  • Wget doesn't seem to work.

  • Found out that ossec is running on the machine.

  • Tried to echo a reverse-shell into sh script, didn't work as well.

I first started to study pentesting this year, still learning, sorry. Hahaha

1
  • There are many, many ways to proceed. There could be no netcat, or a different version than you expect. There could be outbound firewall rules. You could have an error in your PHP code that you upload. Keep enumerating, and see what other utilities are available. You could even script up a webshell CLI to make it easier to run commands and transfer files through this interface, if that's all you have. However, I don't think the question is answerable as it stands. There are simply too many possible answers for "how i could continue to explore the machine?" Commented Jun 25, 2020 at 4:17

1 Answer 1

0

You may want to update the question and show us the reverse shell that you are trying. Also, if you are able to read file, have you tried reading /etc/passwd? Is SSH port open? how about /home/someuser/.ssh/id_rsa? If you get lucky then you can possibly SSH into the server using this user private key? You can read webroot dir config file where users normally have database connection credentials. Try login with it to SSH, FTP, CMS, etc. There are numerous things you can do

2
  • Thank you, i managed to enumerate some apps running on the machine and i found python2.7. After setting up a reverse shell with it, i used a known freebsd-9.0 exploit to get root access, then i tried your ideia with the SSH. Now the machine is totally compromised. Thanks for the help, appreciate it. Commented Jun 26, 2020 at 20:58
  • I hope your question has been solved. In this case you can accept my answer.
    – Prakash
    Commented Jun 27, 2020 at 3:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .