{"uuid": "ee916222-ba67-4259-8e01-df2e9fbecf41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/hacking_Attack/42952", "content": "Hacking Articles|Raj Chandel's Blog\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunneling an internal application (Laravel) to local machine and running a PoC exploit on Laravel v 7.4.18Table of Content\u00b7 nmapEnumeration\u00b7 Subdomain enumeration using wfuzzExploitation\u00b7 Exploiting strapi CVE-2019-18818 to gain a reverse shellPrivilege Escalation\u00b7 Tunneling internal website to our systemNetwork ScanningFirst, we will run an nmap scan on the victim machine nmap -sV -sC -Pn 10.129.149.92https://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince, there was a website running on port 80, we added the address in our hosts file for resolution.wfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92This returned back an interesting subdomain called api-prodecho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hostshttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 It seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.whatweb http://api-prod.horizontall.htb/admin/https://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 We observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4https://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit result showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password witho[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:15.474518Z"}