Erit Securus 1

Reconnaissance

Lets run nmap scan to find open ports and services

Webserver

Lets visit the site

Looking through the site, we can see what the page was built with

Exploit

Lets look at the exploit the room gave us

Lets download this to our machine and make the exploit file a executable

Now , lets look at the exploit

Looking at the exploit, it looks like we need to supply a username and a password. First we need to find the login page to see if we can try some default usernames and passwords to login.

Lets go to google and try to find where the login page is located on Bolt CMS.

Lets go to /bolt

We have a login page. Lets try logging in with default usernames and passwords.

After trying different credentials, I found the right ones

Username: admin

Password: password

Now that we know the username and the password, we can run the exploit.

Now we will create a simple php-shell on the server so that we can run commands on the server as netcat is not allowed on the server and so uploading this shell, we can run a netcat reverse shell to get a shell on the server.

We can follow these steps, but there is an easier way to do this, first we run the exploit and then put in a python reverse shell which will give us a shell on the machine

So first we start a netcat listener

Next we run the exploit

Now we run a python reverse shell

And we have a reverse shell

Lets stabilize the shell

We are logged in a as www-data