THM CMSpit Walkthrough

Description: Dive into the world of web app hacking and privilege escalation with this TryHackMe machine, exploiting recent vulnerabilities.

Difficulty: Medium

Machine Link: CMSpit on TryHackMe

1. Enumeration

Two ports are open:

• 22 [SSH]
• 80 [HTTP]

At port 80, I spot Cockpit CMS on the landing page.

2. Exploitation

Searching for “cockpit” in msfconsole, I identified a promising exploit.

Configuring rhost, lhost, and lport, I executed the exploit successfully. Here’s the output.

Next, I selected the ‘admin’ user and reran the exploit, gaining a shell.

3. Privilege Escalation

Now operating as www-data, I navigated to the home directory and discovered a user named stux.

Accessing user stux’s homepage, I stumbled upon an intriguing dbshell file. Examining its contents revealed the second flag and what appears to be a password.

I tested the discovered password and successfully gained access. Running sudo -l provided an interesting output:

With the acquired sudo permissions for user stux, After a brief search, I stumbled upon this exploit: CVE-2021-22204 ExifTool

The exploit requires some prerequisites:

sudo apt install djvulibre-bin exiftool

The usage involves setting up a listener:

nc -nvlp 9090  # or the port you specify in the exploit.py file
python3 exploit.py

Then, upload the generated image to the target machine and run:

sudo /usr/local/bin/exiftool image.jpg

Executing this payload triggered a successful root shell!