search
GitHub PortfolioTwitter/XMediumCont@ct

Bolt

tryhackme.com - © TryHackMe

🔗 Boltarrow-up-right

hashtag
Task 1 - Deploy the machine

🎯 Target IP: 10.10.10.179

Create a directory for machine on the Desktop and a directory containing the scans with nmap.

hashtag
Task 2 - Reconnaissance

I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.

Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.

hashtag
Task 3 - Hack your way into the machine!

hashtag
3.1 - Find open ports on the machine

command
result

sudo

run as root

sC

run default scripts

sV

enumerate versions

A

aggressive mode

T4

run a bit faster

oN

output to file with nmap formatting

It looks like there are only three open ports on the machine: 22, 80, 8000.

hashtag
3.2 - What port number has a web server with a CMS running?

http://bolt.thm:8000/arrow-up-right
circle-info

8000

hashtag
3.3 - What is the username we can find in the CMS?

circle-info

Bolt

hashtag
3.4 - What is the password we can find for the username?

circle-info

boltadmin123

hashtag
3.5 - What version of the CMS is installed on the server? (Ex: Name 1.1.1)

Googling info about Bolt cms we found that panel is usually at location:

IP/bolt/login, than we go to: http://bolt.thm:8000/bolt/loginarrow-up-right

and we log in with our credentials: bolt::boltadmin123

hashtag
3.6 - There's an exploit for a previous version of this CMS, which allows authenticated RCE. Find it on Exploit DB. What's its EDB-ID?

We can use searchsploit to find most famous exploit for bolt cms:

Bolt CMS 3.7.0 - Authenticated Remote Code Execution | php/webapps/48296.py EDB-ID is:

circle-info

48296

hashtag
3.7 - Metasploit recently added an exploit module for this vulnerability. What's the full path for this exploit? (Ex: exploit/....)

Now we launch msfconsole to find exploit path:

circle-info

hashtag
3.8 - Set the LHOST, LPORT, RHOST, USERNAME, PASSWORD in msfconsole before running the exploit

  • RHOST is the ip of the machine

  • LHOST is the ip of our machine’s vpn ( note: we don’t get reverse shell if we use our own ip )

  • USERNAME and PASSWORD is that we found in previous enumeration

  • TARGETURI is where you want to put our website url. here its bolt website in port 8000

root shell

hashtag
3.9 - Look for flag.txt inside the machine.

flag is usually in the path: /home

or we can spawn a bash shell

chevron-right🚩 Flag 1 (flag.txt)hashtag

THM{wh0_d035nt_l0ve5_b0l7_r1gh7?}

PreviousIgniteNextAgent Sudo