⚡Bolt

This room is designed for users to get familiar with the Bolt CMS and how it can be exploited using Authenticated Remote Code Execution.

1.Reconnaisance

1.1 Nmap

Using nmap to scan and identify open ports and services

  • We find 3 open ports. 22, 80 and 8000 running ssh and 2 web servers respectively

2. Enumeration

Going over to port 80, we see that it is a default Apache page, Dead End!

But port 8000 takes us to a webpage built with Bolt CMS

  • While exploring the webpage, we come across an entry message-from-admin

  • From here, we get a potential username bolt

  • Another entry message-for-it-department if found

  • We get a password boltadmin123

    bolt : boltadmin123

  • While reading the documentation of Bolt CMS, we come across the endpoint /bolt which is the default directly for Bolt CMS backend

  • Navigating to it, we are redirected to /bolt/login where we can use the credentials obtained above to log in to the admin panel

  • We can determine that the CMS is Bolt 3.7.1

3. Gaining Access

3.1 Msfconsole

  • We find out that metasploit has a module RCE exploit/unix/webapp/bolt_authenticated_rce for Bolt CMS 3.7.0. Might work here

  • In this module, we need an authenticated user to get a reverse shell, and we go have the credentials, so entering the required options.

  • Running the module, we get a reverse shell as root

  • Finding the flag.txt

PreviousBlueNextCyborg

Last updated