Creator: Stuxnet
URL: https://tryhackme.com/room/cmspit
Prerequisite:
- Basic knowledge of Linux Terminal
- Basic knowledge of Burpsuite
- Basic knowledge of Metasploit
- Basic knowledge of Linux Privilege Escalation
All exploit is run and tested on Kali Linux.
Reconnaissance
Run Nmap scan to find possible entries point.
Found port 22 and 80.
Checking the website:
It is login page with Cockpit name on it. Since the title of the room is called CMSpit, maybe this is a CMS (Content Management System). With quick google we can confirm yes, this is a Cockpit CMS login page.
Let’s see what this page is about by using View Page Source in the browser.
While searching for version number, I found these three references:
link href="/assets/app/css/style.css?ver=0.11.1"script src="/storage/tmp/7a812eebe1eda3162d79b4109b4787d4.js?ver=0.11.1"/storage/tmp/4cc5a0d2487ec7f4c75b0cc9115bf601.js?ver=0.11.1
I also found how the login system worked:
form class="uk-form" method="post" action="/auth/check" onsubmit="{ submit }"
This basically means once we complete our login process, the username and password are sent to /auth/check to verify the login credentials.
Since we know the application has an /auth directory, let’s search what we have for /auth:
class="uk-button uk-button-link uk-link-muted" href="/auth/forgotpassword"Another App.request('/auth/check',
Exploiting
With quick googling I found there are vulnerabilities in Cockpit CMS version 0.11.1, CVE-2020-35846 and CVE-2020-35847, where you can enumerate usernames and reset a found user’s password.
Summary
CMSpit technically covers three CVEs:
- CVE-2020-35846
- CVE-2020-35847
- CVE-2021-22204