{"uuid": "119ae031-c146-4119-9b5d-e170595adaeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/hacking_Attack/42979", "content": "Hacking Articles\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunnelling an internal application (Laravel) to a local machine and running a PoC exploit on Laravel v 7.4.18 Table of ContentNetwork Scanning\n\n* nmap\n\nEnumeration\n\n* Subdomain enumeration using wfuzz\n* Strapi password reset exploit\n\nExploitation\n\n* Exploiting strapi CVE-2019-18818 to gain a reverse shell\n* Initial information gathering\n* Setting up my SSH key in the victim\u2019s authorized_keys file\n\nPrivilege Escalation\n\n* Tunnelling internal website to our system\n* Exploiting Laravel CVE-2021-3129 to snag root flag\n\nLet\u2019s begin Network ScanningFirst, we will run a nmap scan on the victim machine\nnmap -sV -sC -Pn 10.129.149.92 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince there was a website running on port 80, we added the address in our hosts file for resolution.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgwHC_tGTATWngd_dgXA-pUAoRGFprzxSxuAmRfl_NxWvjAqHwtYx98isQx33lw-Pk3q6v8Q7-tpRnFasx6qntPzKTpdYuzdY4-pQF7tIAZpkL8x-t8Z239lAQyjcHT_-2zJgTHYX_kL6XcNFtfXaxRLFWKj6I9AuIlnEzixwhDTRno1k8wZeSO6WhMBg=s16000 \n\nWe tried to look for exploitable vectors on the website itself but couldn\u2019t find any which indicated that we need to enumerate directories.\n\nEven directories enum didn\u2019t yield any results so we tried to enumerate subdomains.\nwfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92 \nThis returned back an interesting subdomain called api-prod\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjljDsUWotESFbHKm6-bWJCD12yfeQWqhWLTbpm0kPZQdpJ_xowE71mD7kN7mhG9QEk3gdWMGoZRbZfJjpYfqxp_vNI3aq0ebVNgqi3s6XhGsUoj71ravIYXcuS2rRR0ZtkjlpmPXDDmlHo1JwHJh0blgFHO9x6BrzxHqxcCOoaKBskwYg7JRUzgNIzNw=s16000 \n\nWe add this subdomain in hosts file and try to open the website.\necho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hosts \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 \n\nIt seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.\nwhatweb http://api-prod.horizontall.htb/admin/ \nhttps://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 \n\nWe observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit results showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password without needing authentication tokens. You can read more about the vulnerability here. We downloaded the exploit using searchsploit.\nsearchsploit -m 50239 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEi5MFzlFitOzFqNd_7o471GSyoxDAOHL7QYU6SX4cAgVjYKlGVn[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:55.060745Z"}