[bl4cksku11]

Easy root:





That's it! Pwned. Enjoy

how did you found out this vulnerability?

What's up bro, the full steps are the following:

1. Register and login to the web application
2. Upload a file, you'll see that you can download it too
3. The download link has your username on it, fuzz for other usernames (There's an IDOR)
4. You'll find a privacy.odt file with credentials
5. When login to the web app with the leaked credentials, you'll see that you have admin access into the web 
6. Create a backup
7. Dump the database
8. Crackstation
9. Gain SSH access into the machine
10. Forward the 8080 port of the machine to your local machine
11. Then exploit the CVE (you can reuse the cracked hashes from the DB to access the 8080 port service)
12. You'll be root after that

[lucasmessia75]

Hi mate,
2 questions : Why perform ssh port forwarding and how do you know that the machine is vulnerable to ispconfig ?
Thans!!

[yolodolo]

how did you dump the database??

[Tekay]

Box was patched today: “Patched an unintended path on the foothold.” Based on previous posts I assume that the SQLite db used to be included in the backup, but now it’s excluded. I needed to do command injection through the password field.

[0x404]

Box was patched today: “Patched an unintended path on the foothold.” Based on previous posts I assume that the SQLite db used to be included in the backup, but now it’s excluded. I needed to do command injection through the password field.

Can you tell me how you did it?

[Tekay]

Box was patched today: “Patched an unintended path on the foothold.” Based on previous posts I assume that the SQLite db used to be included in the backup, but now it’s excluded. I needed to do command injection through the password field.

Can you tell me how you did it?

Yeah you have to bypass the filtering - took me a bit to figure it out, but you can use tabs (%09) in place of spaces, and from there it’s pretty easy and there are multiple ways to do it. Read the code for admin.php to see exactly how the zip command is being constructed.

[0x404]

Box was patched today: “Patched an unintended path on the foothold.” Based on previous posts I assume that the SQLite db used to be included in the backup, but now it’s excluded. I needed to do command injection through the password field.

Can you tell me how you did it?

Yeah you have to bypass the filtering - took me a bit to figure it out, but you can use tabs (%09) in place of spaces, and from there it’s pretty easy and there are multiple ways to do it. Read the code for admin.php to see exactly how the zip command is being constructed.

Tks man, it worked out!

[dimly5252]

How were you able to find the file? I know I can find the user using ffuf with the parameter but I am not sure what wordlist to use for the file parameter. Any hints there? Thanks!