# Vulnerability Capstone

<figure><img src="https://3461608318-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvIBoDwNF7vBZPc7jgbdE%2Fuploads%2FYRiMPBF7PiguFbc0AqVX%2Fimage.png?alt=media&#x26;token=26201399-7b0d-4771-a0fd-871964c5f825" alt=""><figcaption><p><br></p></figcaption></figure>

## Introduction

* This box is about applying the knowledge we learned from the last two rooms. It will likely involve using the tool *SearchSploit* on a web application. I'm using the attackbox because it is recommended to use it to complete this room.

## Active recon

* I'm doing a simple scan to identify the port where is running the web application.\
  `22/tcp open ssh` \
  `80/tcp open http`
* This is the default port for a web app so I just need to type [`http://10.10.183.4/`](http://10.10.183.4/)  in the url.<br>

<figure><img src="https://3461608318-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvIBoDwNF7vBZPc7jgbdE%2Fuploads%2FlQmu3AAuvmZ4IObGHITu%2Fimage.png?alt=media&#x26;token=5aee06a0-bb92-4b5e-aeb4-4e5182fb2c6e" alt=""><figcaption></figcaption></figure>

* We're looking for the name of the application and its version. I think it's pretty self-explanatory, so I won't say much more.

*What is the name of the application running on the vulnerable machine?*                                                               **Q2.2** - `Fuel CMS`&#x20;

*What is the version number of this application?*                                                                                                       **Q2.3** - `1.4`&#x20;

* We want to know the number of the CVE tha allows a RCE on this application. Let's use *Searchsploit* as we learned to use from the past room.

<figure><img src="https://3461608318-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvIBoDwNF7vBZPc7jgbdE%2Fuploads%2FrFBicyEV3Q2un2rT59Qo%2Fimage.png?alt=media&#x26;token=a30a2bb6-01eb-4acd-b9ce-40c3451dd75c" alt=""><figcaption></figcaption></figure>

* There are 2 exploits exactly corresponding to the web app's version, and only one RCE available. Let's use the path to learn more from this specific exploit.

<figure><img src="https://3461608318-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvIBoDwNF7vBZPc7jgbdE%2Fuploads%2F4PEgTSmYOHvGtGgPwAbw%2Fimage.png?alt=media&#x26;token=e00071af-9d25-4479-8a08-77e674fc78da" alt=""><figcaption></figcaption></figure>

*What is the number of the CVE that allows an attacker to remotely execute code on this application*?                                                                                                       **Q2.4** - `CVE-2018-16763` <br>

* Let's inspect the code to then configure the exploit and use it.

<figure><img src="https://3461608318-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvIBoDwNF7vBZPc7jgbdE%2Fuploads%2F7D7hE77WBWvyQGitwdOx%2Fimage.png?alt=media&#x26;token=0e560204-e456-4f5d-8421-59bc521e85cf" alt=""><figcaption></figcaption></figure>

* I tried to run the exploit, but I encountered an error. Then I fixed a typo and ran it again, but there was still another mistake, so I had to fix it again. However it was still not working, looking at question  five I knew that it was probably not the right exploit. So looked for the hint and got this path :\
  `/usr/share/exploits/vulnerabilitiescapstone`&#x20;

<figure><img src="https://3461608318-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvIBoDwNF7vBZPc7jgbdE%2Fuploads%2FhJ3Ywu0WVRPT9lFuH5oW%2Fimage.png?alt=media&#x26;token=5708caef-39c6-44b2-9c4c-306f361b9e4b" alt=""><figcaption></figcaption></figure>

* There is a juicy exploit in this directory, let's try to use it.

<figure><img src="https://3461608318-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvIBoDwNF7vBZPc7jgbdE%2Fuploads%2FsrqQil4DAC62W0vrv4cV%2Fimage.png?alt=media&#x26;token=da0b0374-b431-4e47-83d3-d1abe4ea6281" alt=""><figcaption></figcaption></figure>

* After a few mistakes I finally get the reverse shell, now we just need to find the flag located in /home/unbuntu .

<figure><img src="https://3461608318-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvIBoDwNF7vBZPc7jgbdE%2Fuploads%2FVt6JORubQxGQf1WQeaor%2Fimage.png?alt=media&#x26;token=614b969f-ae55-4737-8121-a6edf3acacf9" alt=""><figcaption></figcaption></figure>

*What is the value of the flag located on this vulnerable machine? This is located in /home/ubuntu on the vulnerable machine.*                                                                                                                                                    **Q2.6** - `THM{ACKME_BLOG_HACKED}`&#x20;
