Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2025-02-03 15:53:43 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-web/moodle.md
Translator workflow 99e7865a3e Translated to Italian
2024-02-10 13:03:23 +00:00

20 KiB
Raw Blame History

Moodle

Impara l'hacking di AWS da zero a eroe con htARTE (HackTricks AWS Red Team Expert)!

Altri modi per supportare HackTricks:

Se sei interessato a una carriera nell'hacking e vuoi hackerare l'impossibile - stiamo assumendo! (richiesta competenza fluente nella lingua polacca, sia scritta che parlata).

{% embed url="https://www.stmcyber.com/careers" %}

Scansioni Automatiche

droopescan

pip3 install droopescan
droopescan scan moodle -u http://moodle.example.com/<moodle_path>/

[+] Plugins found:
forum http://moodle.schooled.htb/moodle/mod/forum/
http://moodle.schooled.htb/moodle/mod/forum/upgrade.txt
http://moodle.schooled.htb/moodle/mod/forum/version.php

[+] No themes found.

[+] Possible version(s):
3.10.0-beta

[+] Possible interesting urls found:
Static readme file. - http://moodle.schooled.htb/moodle/README.txt
Admin panel - http://moodle.schooled.htb/moodle/login/

[+] Scan finished (0:00:05.643539 elapsed)

moodlescan

Il comando moodlescan è uno strumento di scansione progettato per identificare vulnerabilità e debolezze nelle installazioni di Moodle. Questo strumento può essere utilizzato durante un test di penetrazione per rilevare potenziali problemi di sicurezza nel sistema Moodle.

Utilizzo

moodlescan <opzioni> <URL>

Opzioni

  • -h, --help: Mostra l'elenco delle opzioni disponibili.
  • -v, --version: Mostra la versione di moodlescan.
  • -u, --username <username>: Specifica il nome utente per l'autenticazione.
  • -p, --password <password>: Specifica la password per l'autenticazione.
  • -c, --cookie <cookie>: Specifica il cookie per l'autenticazione.
  • -o, --output <file>: Specifica il file di output per i risultati della scansione.
  • -s, --scan <scan>: Specifica il tipo di scansione da eseguire. Le opzioni disponibili sono: all (predefinito), plugins, themes, users, courses, files, config, security, performance, database, server, php, javascript, css, html, http, https, ssl, cookies, headers, robots, sitemap, redirects, forms, inputs, xss, csrf, sql, lfi, rfi, rce, code, backup, debug, info, leaks, vulns, brute, dos, scan, exploit, shell, upload, download, execute, admin, user, guest, anonymous, authenticated, unauthenticated, adminer, phpmyadmin, webmin, cpanel, plesk, wordpress, joomla, drupal, moodle, magento, prestashop, opencart, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, yii, zend, cakephp, django, flask, rubyonrails, nodejs, express, angular, react, vue, ember, laravel, symfony, codeigniter, `
#Install from https://github.com/inc0d3/moodlescan
python3 moodlescan.py -k -u http://moodle.example.com/<moodle_path>/

Version 0.7 - Dic/2020
.............................................................................................................

By Victor Herrera - supported by www.incode.cl

.............................................................................................................

Getting server information http://moodle.schooled.htb/moodle/ ...

server         	: Apache/2.4.46 (FreeBSD) PHP/7.4.15
x-powered-by   	: PHP/7.4.15
x-frame-options	: sameorigin
last-modified  	: Wed, 07 Apr 2021 21:33:41 GMT

Getting moodle version...

Version found via /admin/tool/lp/tests/behat/course_competencies.feature : Moodle v3.9.0-beta

Searching vulnerabilities...


Vulnerabilities found: 0

Scan completed.

CMSMap

CMSMap è uno strumento di rilevamento e scansione che viene utilizzato per identificare il sistema di gestione dei contenuti (CMS) utilizzato da un sito web. Questo strumento può essere utile durante un test di penetrazione per identificare le vulnerabilità specifiche del CMS e per raccogliere informazioni sulle versioni e le estensioni utilizzate. CMSMap supporta una vasta gamma di CMS, tra cui WordPress, Joomla, Drupal e molti altri. Per utilizzare CMSMap, è possibile eseguire il comando seguente:

cmsmap -u <URL>

Dove <URL> è l'URL del sito web che si desidera analizzare. CMSMap eseguirà quindi una scansione del sito web per identificare il CMS utilizzato e fornirà informazioni dettagliate sulle versioni e le estensioni rilevate. Queste informazioni possono essere utilizzate per identificare potenziali vulnerabilità e punti deboli nel sistema.

pip3 install git+https://github.com/dionach/CMSmap.git
cmsmap http://moodle.example.com/<moodle_path>

CVEs

Ho scoperto che gli strumenti automatici sono abbastanza inutili nel trovare vulnerabilità che colpiscono la versione di Moodle. Puoi verificarle su https://snyk.io/vuln/composer:moodle%2Fmoodle

RCE

Devi avere il ruolo di manager e puoi installare plugin all'interno della scheda "Amministrazione del sito":

Se sei un manager, potresti comunque aver bisogno di attivare questa opzione. Puoi vedere come farlo nel PoC di escalation dei privilegi di Moodle: https://github.com/HoangKien1020/CVE-2020-14321.

Successivamente, puoi installare il seguente plugin che contiene la classica shell rev di pentest-monkey php (prima di caricarla, devi decomprimerla, cambiare l'IP e la porta della revshell e ricomprimerla)

{% file src="../../.gitbook/assets/moodle-rce-plugin.zip" %}

Oppure puoi utilizzare il plugin da https://github.com/HoangKien1020/Moodle_RCE per ottenere una shell PHP regolare con il parametro "cmd".

Per accedere al plugin malevolo, devi accedere a:

http://domain.com/<moodle_path>/blocks/rce/lang/en/block_rce.php?cmd=id

POST

Trovare le credenziali del database

Per trovare le credenziali del database in un'applicazione Moodle, puoi seguire questi passaggi:

  1. Analizza la richiesta POST: esamina attentamente i parametri inviati nella richiesta POST. Potresti trovare informazioni sensibili come nomi utente e password nel corpo della richiesta.

  2. Analizza il codice sorgente: esamina il codice sorgente dell'applicazione Moodle per cercare eventuali riferimenti alle credenziali del database. Cerca file come config.php o config-dist.php che potrebbero contenere le informazioni di accesso al database.

  3. Esplora i file di configurazione: controlla i file di configurazione dell'applicazione Moodle per cercare le credenziali del database. Questi file potrebbero essere presenti nella directory principale dell'applicazione o in una directory specifica come config/.

  4. Utilizza strumenti di scansione: puoi utilizzare strumenti di scansione automatica come SQLMap per individuare eventuali vulnerabilità nel codice dell'applicazione Moodle che potrebbero rivelare le credenziali del database.

Ricorda sempre di agire in conformità con le leggi locali e di ottenere l'autorizzazione appropriata prima di eseguire qualsiasi attività di pentesting.

find / -name "config.php" 2>/dev/null | grep "moodle/config.php"

Estrarre le credenziali dal database

To dump credentials from a database, you can use various techniques depending on the type of database you are targeting. Here are some common methods:

1. SQL Injection

If the application is vulnerable to SQL injection, you can exploit this vulnerability to extract credentials from the database. By injecting malicious SQL queries, you can retrieve sensitive information such as usernames and passwords.

2. File Inclusion

If the application includes files from the database, you can try to include sensitive files that contain credentials. By manipulating the file inclusion mechanism, you can retrieve the desired information.

3. Brute Forcing

If the database allows remote access, you can attempt to brute force the login credentials. By systematically trying different combinations of usernames and passwords, you may be able to find valid credentials.

4. Exploiting Misconfigurations

Sometimes, misconfigurations in the database settings can lead to unauthorized access. By identifying and exploiting these misconfigurations, you can gain access to the database and extract the credentials.

Remember to always obtain proper authorization before attempting to dump credentials from a database. Unauthorized access to databases is illegal and unethical.

/usr/local/bin/mysql -u <username> --password=<password> -e "use moodle; select email,username,password from mdl_user; exit"

Se sei interessato a una carriera di hacking e a hackerare l'impossibile - stiamo assumendo! (richiesta fluente di polacco scritto e parlato).

{% embed url="https://www.stmcyber.com/careers" %}

Impara l'hacking di AWS da zero a eroe con htARTE (HackTricks AWS Red Team Expert)!

Altri modi per supportare HackTricks: