# Codo

**Source**: Proving Grounds\
**OS**: Linux\
**Community Rating**: Easy

## **Enumeration & Reconnaissance**

* I started with the usual autorecon, which exposed:
  * SSH (22)
  * **HTTP (80)**

## **Service Analysis**

* I began with HTTP (80). It displayed a Codoforum page. I played around for a while before checking for a CVE. I found **CVE-2022-31854**, which provided RCE but required valid credentials. I tried the default credentials (admin:admin) and they worked. I was in to the admin panel!

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FamN7peRgIIImry5BdTiD%2Fimage.png?alt=media&#x26;token=3b128a82-18f9-4751-8e76-45286b25ecd9" alt="" width="563"><figcaption><p>Codoforum</p></figcaption></figure>

## **Gaining Initial Access**

* I attempted to run the PoC to get a shell back, but that didn't work, so I did it manually.&#x20;
  * I created a PHP reverse shell and then opened the admin panel at: `http://192.168.197.23/admin/`
  * Logged in as admin, navigated to Global Settings, and went to "Upload logo for your forum" where I uploaded my PHP shell.&#x20;

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2F25nicvZbBdFpnp3vJP5I%2Fimage.png?alt=media&#x26;token=cb20af07-2134-4505-b6d1-131206a17e69" alt="" width="563"><figcaption><p>Global Settings</p></figcaption></figure>

* To execute it, I visited: `http://192.168.197.23/sites/default/assets/img/attachments/shell.php`
* These steps were outlined in the CVE's PoC. I just followed them.
* I checked my listener and, sure enough, I got a reverse shell.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2F0fDyMO1Y4ifX7XW7apH1%2Fimage.png?alt=media&#x26;token=df0f8d30-56fd-4f5a-b884-02bf5e320ada" alt="" width="563"><figcaption><p>Getting a Shell</p></figcaption></figure>

* I then converted it into a proper tty with the following commands:

{% code overflow="wrap" fullWidth="true" %}

```bash
SHELL=/bin/bash script -q /dev/null
python3 -c 'import pty; pty.spawn("/bin/bash")'
Ctrl + Z
stty raw -echo && fg
reset
Ctrl + C
```

{% endcode %}

* I searched for a flag using&#x20;

{% code overflow="wrap" fullWidth="true" %}

```bash
find / -type f \( -name local.txt -o -name proof.txt \) 2>/dev/null
```

{% endcode %}

* That found nothing. Then I remembered that the machine has only one flag. Time to escalate privileges and search again.

## **Privilege Escalation**

* I uploaded linpeas, and it exposed a password in the PHP configuration file at: `/var/www/html/sites/default/config.php`

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2Fmsv36t6cC2MMvZFiTXys%2Fimage.png?alt=media&#x26;token=0eaa4b64-6162-4e9f-9efa-4605cdf0b7f5" alt="" width="563"><figcaption><p>config.php Password</p></figcaption></figure>

* The password found was **FatPanda123**. I first tried it for the offsec user (since there was an offsec directory in the home directory), but it didn't work there. Then I checked it for root, and it worked. We were in as root, as simple as that.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FHNfcooafqUpEPdH33n2Z%2Fimage.png?alt=media&#x26;token=7e8f4c5f-c622-485f-ad52-b07282a3d9ce" alt="" width="375"><figcaption><p>Switching to root</p></figcaption></figure>

## **Lessons Learned**

* Sometimes a web application's administrative interface can be an effective RCE vector if valid credentials are obtained also make sure to try default credentials.
* When a PoC doesn't work. Following the steps provided in the CVE's PoC manually can make it work.
* Configuration files often contain sensitive credentials.
