> For the complete documentation index, see [llms.txt](https://olb.gitbook.io/thm-ctf-write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://olb.gitbook.io/thm-ctf-write-ups/bolt.md).

# Bolt

{% embed url="<https://tryhackme.com/room/bolt>" %}

Lien Gitbook: [ https://olb.gitbook.io/thm-ctf-write-ups/bolt](< https://olb.gitbook.io/thm-ctf-write-ups/bolt>)

IP=10.10.247.170&#x20;

## Nmap

<figure><img src="https://100368042-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9atCPHvlQFB0GlCVKzJB%2Fuploads%2FQoHj4emRoy8N1DXfYHOI%2FGetImage.png?alt=media&amp;token=3e41c518-5166-4c12-b88a-604012b93361" alt=""><figcaption></figcaption></figure>

* Résultats:
  * Ubuntu&#x20;
  * Port 22 open SSH&#x20;
  * Port 80 open http&#x20;
    * Apache 2.4.29&#x20;
  * Port 8000 open http&#x20;
    * Php 7.2.32-1&#x20;
    * Générator : BOLT&#x20;

On se rend sur <http://10.10.247.170:8000/>&#x20;

<figure><img src="https://100368042-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9atCPHvlQFB0GlCVKzJB%2Fuploads%2FZZrawiUCglhIUp69R4zl%2FGetImage2.png?alt=media&amp;token=6ed44264-ca8a-47b6-8aa1-eb29c1c60bbc" alt=""><figcaption></figcaption></figure>

Des infos a la lecture du blog:

* L'admin s'appelle `Jake`
* son username est `bolt`&#x20;
* Son mot de passe est `boltadmin123`&#x20;

&#x20;On creuse un peu la documentation de Bolt et on trouve la page de login:  <https://docs.boltcms.io/5.2/manual/login>&#x20;

&#x20;On se rend donc sur <http://10.10.247.170:8000/bolt/login>&#x20;

On se connecte `bolt:boltadmin123`&#x20;

Sur l'interface d'admin on obtient des infos:

* Bolt version 3.7.1&#x20;
* Cette version après recherche Google semble vulnérable <https://www.exploit-db.com/exploits/48296>&#x20;

## Metasploit

```
Msfconsole 
```

```
Msf6> search bolt 
```

Utilsation de la RCE identifiée

<figure><img src="https://100368042-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9atCPHvlQFB0GlCVKzJB%2Fuploads%2F3s7qmFwsWVkonsbKeu9Y%2FGetImage3.png?alt=media&amp;token=61d9741a-c76a-4d2e-b73c-513270d449ae" alt=""><figcaption></figcaption></figure>

<figure><img src="https://100368042-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9atCPHvlQFB0GlCVKzJB%2Fuploads%2FJlfvdpDSrmSMWYSrFihw%2FGetImage4.png?alt=media&amp;token=91d37c31-aa5a-4eeb-bbff-08943bf2abdd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://100368042-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9atCPHvlQFB0GlCVKzJB%2Fuploads%2FaIcQMaJbYTboqbs8MI5S%2FGetImage5.png?alt=media&amp;token=3dc83574-5058-42fe-875d-53809bd806d1" alt=""><figcaption></figcaption></figure>

Après plusieurs tentative je fini par y arriver en ajoutant la variable `TARGETURI` comme indiqué ci dessous

<figure><img src="https://100368042-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9atCPHvlQFB0GlCVKzJB%2Fuploads%2FFxInFpamhyDy4JIoyV27%2FGetImage6.png?alt=media&amp;token=055113a8-7580-4d55-aea3-f55984ae4041" alt=""><figcaption></figcaption></figure>

<figure><img src="https://100368042-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9atCPHvlQFB0GlCVKzJB%2Fuploads%2FjaaN8NLNP1NZyONMosZI%2FScreenshot_2024-05-17_19-02-02.png?alt=media&amp;token=525da72f-7109-442e-a549-b67fd5e9e204" alt=""><figcaption></figcaption></figure>

Ensuite cherchons directement le fichier flag.txt&#x20;

<figure><img src="https://100368042-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9atCPHvlQFB0GlCVKzJB%2Fuploads%2FnnaaSpWdZuhXPkdVg1Us%2FGetImage8.png?alt=media&amp;token=1b9a613d-05d1-4871-b754-8ab1fe04c26e" alt=""><figcaption></figcaption></figure>