HackTheBox ~ Blunder Walkthrough

#blunder; another great egotisticalSW box! While an easy box, it will test your enumeration and CVE searching skills. It's pretty realistic and a great set of skills to hone. Beating up on the Bludit CMS, we obtain user access and use a wide-reaching sudo vulnerability to get root quickly. Follow along as we #HackTheBox!

00:00 Intro
02:36 NMap
03:24 Enumeration: HTTP
05:20 gobuster (directory enumeration)
09:14 Bludit exploit search
09:45 gobuster (todo.txt)
11:35 CVE-2019-17240 [Bludit Brute Force Mitigation Bypass]
https://rastating.github.io/bludit-brute-force-mitigation-bypass/

13:19 CVE-2019-17240 exploit (noraj)
https://github.com/noraj/Bludit-auth-BF-bypass

14:09 CeWL password list creation
17:38 CVE-2019-16113 [Bludit - Directory Traversal Image File Upload]
18:53 CVE-2019-16113 exploit via MetaSploit Framework

**** Lessons Learned ****
**** Don't forget to stop http fuzzing/enumerating when trying to examine specific pages/exploit functions ****

23:52 MSF Trick #1: Upgrade generic shell to meterpreter reverse shell
25:43 MSF Trick #2: launch directly into upgraded TTY shell using python
27:17 System Enumeration (www-data)
28:38 Grep Tricks: search website files for user data (password hash)
33:03 User #2: Hugo ~~USER.TXT~~
33:33 Enumeration: sudo -l
36:45 CVE-2019-14287 [sudo vulnerability]
https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287

38:38 ~~ROOT/ROOT.TXT~~

AFTER ROOT:
39:22 User to Root enumeration: linpeas
42:47 Summary




#HTB #BridingTheGap