MY-CMSMS OffSec Walkthrough

MY-CMSMS OffSec Walkthrough: We are going to exploit one of OffSec Proving Grounds Medium machines which called My-CMSMS and this post is not a fully detailed walkthrough, I will just go through the important points during the exploit process.

Enumeration:

• Nmap: 
• Login to the remote mysql using root:root: 
• Exploring cmsms_db Database:

• Updating the admin password:I couldn’t crack the MD5 hash, so let’s just try to update the password to something we already know, I found this blog post and it shows the MySQL query to update the password: 
• Executing MySQL Query:
  • This query will update the admin password to admin:update cms_users set password = (select md5(CONCAT(IFNULL((SELECT sitepref_value FROM cms_siteprefs WHERE sitepref_name = 'sitemask'),''),'admin'))) where username = 'admin';

Getting RCE:

1. Generating bash reverse shell payload and starting a Netcat Listener: 
2. Injecting bash payload to the application: 

1. hit the submit button, then open the shell:

1. Hit Run:

1. We got RCE: 

Privilege Escalation:

• LinEnum:

• Decoding: 
• Creds:
  • User: armour
  • Pass: Shield@123
• Getting root: 

Finaly this lab solved see you on next lab Happy Hacking 😉

Also Read | FunBox OffSec Walkthrough