Utilize information disclosure in Gitea to get credentials, Exploiting vulnerability at pluck import module, and Privesc by depixelizing redacted credentials in a document.
Reconnaisance & Information Gathering
scan open port / running service using nmap. there are 3 open ports, ssh and web (port 80 and 3000).
check the first site (port 80). it says powered by pluck at the bottom of the website. thats mean the web using pluck.
enumerate first web (pluck) dir using dirsearch. there is login.php page.
on the login page it says pluck 4.7.18. we get the version of pluck used on that web. there is a vulnerability on that version. but for now let's skip it and try the second web enumeration.
check the second site (port 3000). it is the gitea web (used for version control system / repository).
check the explore page to see public repos, there is a repo with the name "greenadmin / greenhorn".
look around at the repo, there is hash at "/data/settings/pass.php". crack the hash using crackstation.net. hash cracked, use that pass for login at the first site.
Initial Access & Foothold
we're in. remember the previous vulnerability at pluck that we found ? based on packetstorm website, we can upload fake module to the site and execute it. try uploading revshell and gaining foothold. we can use php revshell from pentestmonkey, zip it, and upload it to install modules page (options >> manage modules >> install modules). don't forget to change the ip and port at revshell php file and set up a listener.
we got shell :3
we got foothold at www-data user, try using the same password to login as user. to figure out who is the user we can simply ls the home dir. don't forget to grab the flag.
Privilege Escalation
now time to privesc. try to get more stable shell via ssh.
we can't login via ssh, there is no .ssh dir on user so there is no ssh key to log in. we stuck in this shell.
there is a pdf in user dir. maybe that's a hint, but we can't transfer it since we stuck in pentestmonkey shell and can't use ssh. we can transfer the pdf file using netcat.
open the pdf file, there is password but blurred like JAV lol.
If you often watch JAV, maybe you know the term decensored, we can use similiar technique here. thehackernews.com
extract the image from pdf using pdfimages.
use depix to depixelize the image and we got the password.
switch to root user and grab the root flag. machine pwnd :3