Bolt
🔗 Bolt
Task 1 - Deploy the machine
🎯 Target IP: 10.10.10.179
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
Task 3 - Hack your way into the machine!
3.1 - Find open ports on the machine
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are only three open ports on the machine: 22, 80, 8000.
3.2 - What port number has a web server with a CMS running?
3.3 - What is the username we can find in the CMS?
3.4 - What is the password we can find for the username?
3.5 - What version of the CMS is installed on the server? (Ex: Name 1.1.1)
Googling info about Bolt cms we found that panel is usually at location:
IP/bolt/login, than we go to: http://bolt.thm:8000/bolt/login
and we log in with our credentials: bolt::boltadmin123
3.6 - There's an exploit for a previous version of this CMS, which allows authenticated RCE. Find it on Exploit DB. What's its EDB-ID?
We can use searchsploit to find most famous exploit for bolt cms:
Bolt CMS 3.7.0 - Authenticated Remote Code Execution | php/webapps/48296.py EDB-ID is:
3.7 - Metasploit recently added an exploit module for this vulnerability. What's the full path for this exploit? (Ex: exploit/....)
Now we launch msfconsole to find exploit path:
3.8 - Set the LHOST, LPORT, RHOST, USERNAME, PASSWORD in msfconsole before running the exploit
RHOST is the ip of the machine
LHOST is the ip of our machine’s vpn ( note: we don’t get reverse shell if we use our own ip )
USERNAME and PASSWORD is that we found in previous enumeration
TARGETURI is where you want to put our website url. here its bolt website in port 8000
3.9 - Look for flag.txt inside the machine.
flag is usually in the path: /home
or we can spawn a bash shell
Last updated