Fluxcapacitor

Fluxcapacitor - 10.10.10.69

Target Enumeration:

OS: Linux
IP: 10.10.10.69
User: b8b6d46c893d0cd00c0f0380036117bc
Root: bdc89b40eda244649072189a8438b30e

Ports / Services / Software Versions Running

80/tcp open http SuperWAF

Vulnerability Exploited:

WAF Bypass on vulnerable parameter to gain code execution

Privilege Escalation:

User can run commands encoded in base64 via the /home/themiddle/.monit

Exploiting the host:

Nmap
Software Enumeration:
Burp Request & Response:
Gives a clue as follows:
Fuzz the application for a parameter to identify the next stage of the exploit.
After a while you will find:
Send that request to the repeater to explore further
We now have command execution:
The WAF is pretty tight on what we can do so ensure you use typical evasion techniques to read files etc.
/etc/passwd
Converting our IP address to decimal allows us to request files from our server.
At the moment we are restricted to the user nobody so list the whole contents of the drive for easy viewing offline
Using curl we find that as the user nobody we can execute the following command
Open the command in burp and encode the command cat /root/root.txt in base64 and send through the repeater to get the root flag.
Send the request:
Now to get a shell on the system encode the following payload:
Send through the repeater with port 443 listening
You will have a root shell
Last modified 2yr ago