Hi, we this lecture, we're going to try and login to the administrator panel or administrator dashboard
of cold fusion, but in order to do that, we're going to have to find an exploit or some kind of a
vulnerability that will lead us to the password of the administrator user.
So we're not going to do brute forcing because of the reasons that we have talked previously.
So what I'm going to do, I'm going to search for search deployed over here in my colleague and I'm
going to search for the cold fusion exploits.
So if you run this, you will see there are a lot of vulnerabilities that has been discovered before
and we can actually see them in our color, things like this.
So these are all related to adobe cold fusion and we don't actually know whether they're going to work
or not.
It depends on the version.
It depends on the security patches and every other parameter as well.
But we can try to narrow it down and we can try to understand if it works, if it's going to give us
the password or any kind of login opportunity.
OK, so let me try to actually understand, what are those?
For example, over here we see nine, less than 11.
So this is eight.
So these must be related to the version number of the cold fusion.
OK, and I believe our version is called Fusion eight.
At least this is what we see in the administrator login page and we can try to understand which one
to test first.
So we're here.
We have the directory traversal.
I don't know if it's going to help us or not.
We have this server, eight point open.
One administrator entered that system.
So it seems promising because maybe it will enter to the administrator login page somehow.
I don't know, because this is the cold fusion eight again, and this seems to be related with the version
eight over here.
So maybe it's worth a shot.
But over here we see it's only access or accessory, not access crosseyed scripting.
Maybe we can just take a look at it because as you can see, we see the whole path over here.
So you can just take the whole path and try to understand it.
So I'm going to just search for the Locate Exploit DB.
And as you can see, we have a lot of exploit DB folders in our clinics available over here.
So what I want to do, I want to just find that specific exploit and try to understand how to use it.
So in order to use it, we going to have to see the description and instructions.
So I'm going to go into the user share exploit DB.
OK, and over here, as you can see, I'm going to go to the CSM Web apps and check this out, but for
some reason I cannot do that.
Let me run Al-Saleh.
Yeah, here you go.
I believe we have to go into the exploits as well, so I'm going to go into this area less.
Leslie, now we have a lot of folders over here.
Yeah.
We have to go into the CFA or we can just get this right now.
Yeah, it says that there is nothing like that.
So let me go into the CFA and see what happens.
Let me go into the Web apps and let me run the Lesli.
So over here we have a lot of text files and actually this is the one that we are looking for.
I don't understand why didn't it work when we were on CAT?
But anyhow, now, as you can see, it says that they'll be cold fusion is prone to HDMI injection vulnerabilities.
And yeah, it gives us some kind of script and a demo script or JavaScript code over here in order to
run on testers.
So I don't think it's going to help us.
OK, but I'm going to try this anyway to see if it has the vulnerability or not.
So I'm going to copy this.
You don't have to do that by by the way, I'm just trying to understand what kind of thing that we should
do in order to run these exploits.
For example, if I run this, even if it works, it's only going to give me some Elad like an vulnerability.
I don't have that very I don't find it very helpful at this point because even if you find any sources
vulnerable.
Then we don't have anyone to report to or something like that.
It's not a bug bounty.
OK, but again, maybe it's worth a shot.
Let me just wait here for 10 seconds and see.
And nothing seems to be happening lower here.
Yeah, nothing happened.
So I don't think that's the way to go.
OK, so for example, in this case, I believe we have to just cross out all the excess vulnerabilities
because even if we can make it work, it won't do much.
OK, so we're going to go for something like a director traversal, because it may lead us to reveal
some kind of files that we are not supposed to be wearing.
OK, maybe that's how we can actually find the password.
So I'm going to try this directory traversal.
It's not under CCF this time.
As you can see, it's under multiple remote and some kind of python files.
So I'm going to just try this.
I'm going to see the dot dot over here, dot, dot.
And now I'm going to go into the multiple and then to remote and then I'm going to cut this profile.
Yeah, here you go.
We have a python file.
Let me see if we actually want to run this or not.
So over here, we see there are a lot of python codes.
Of course, if you can just read it and understand what it does.
And in the comments section, actually, we see that we are given that link.
We are given away to exploit this as well.
So maybe we don't even have to run despite don't file.
I'm just going to try this.
OK, so it's it tries to find the password at properties so that it can give us the administrator password.
So this is very good.
If it works then we can get the password of the administrator user.
Right.
So they actually found a way to exploit the director traversal and also a way to get the administrator
password out of the cold fusion directory.
So if it works, then we are good to go.
I'm going to just delete this and put the thing that we have copied to here and hit enter.
So make sure you get the exact same thing that I have copied from there, OK, or else it wouldn't work.
So I copied after this here from Questionmark.
OK, so we are changing the local parameter over here and here you go.
I believe we got something out of it.
So as you can see, we have a password appearing in the cold fusion login page, but it seems like it's
Hashd and because it says encrypted through over here and it seems like a hash to me anyway.
So and actually we have seen that when we tried with one single quotation marks, encrypted the password.
But again, it's worth a shot.
If you want, you can just come over here and take this as a note.
So I'm going to go into the CD documents, OK, and CTF.
So do we have a folder over here called Let me just go over their CD documents and CDs, CTF and Arctic.
Yep.
Here you go.
I'm going to note none of the notes text and we have the map result.
I'm going to paste a password that we have found.
I'm going to save this and go back.
OK, this is the password that we have found.
I'm going to clear this up and I'm going to run this in a hash identifier so that see if our hash is
if our password is actually hashed.
So as you can see, it says that, yeah, it's possible hash like it's Shabwah or it can mean other
things as well.
So let us try to decrypt that.
OK, it's Siobhan.
So I believe it could be very easy to decrypt this so you can do this online or you can do this offline
with callisthenics as well.
So I'm going to Siobhan Decrypt online over here, OK?
And I'm going to just choose either of these in the five decrypt that and actually this one as well.
Maybe this one as well.
Just opened a couple of them and just try and see if you can get the decrypted back, the decrypted
one back.
And here you go.
We actually found it in the first try.
So far, so good.
So it seems that the password is happy day.
OK, great.
So we know the password right now.
So I'm going to go into here and just write Happy Day and hit enter, OK, and wait for like ten seconds
and see if we can actually login to the administrator dashboard of the Cold Fusion eight.
If we get there, we're going to have to understand how to use cold fusion and.
Try to just have a reverse shellback, so let me try this one more time.
I believe I misspelled the today.
By the way, in the future, if you want to make a vulnerable machine to submit to try hacking your
heck, the bucks, please don't do it like this.
Like waiting 10 seconds time out.
Just to prevent brute forcing is not a good way, in my opinion.
Right.
So here you go.
I believe the password is correct.
So we are going into the administrator panel or dashboard of the Cold Fusion eight.
Here you go.
I think we are in and of course, if you haven't worked with Adobe Fusion before or they'll be fusion
at all, then you're going to have to understand how the cold fusion dashboard's works.
OK, so this is the cold fusion administrator page and we're going to have to understand how it works.
We're going to have to just wander around a little bit to see what kind of options, what kind of menus
we have over here, because we have a lot as you can see, I really suggest you to wander around here
a little bit, spend the time a little bit before going into the next lecture.
But I will see you in the next lecture to solve the CTF.