┌──(zwique㉿zwique)-[~/Downloads]└─$nmap-sC-sV172.17.0.2StartingNmap7.95 ( https://nmap.org ) at 2025-09-03 21:54 +08Nmapscanreportfor172.17.0.2Hostisup (0.0000010s latency).Notshown:999closedtcpports (reset)PORTSTATESERVICEVERSION80/tcpopenhttpApachehttpd2.4.58 ((Ubuntu))|_http-server-header:Apache/2.4.58 (Ubuntu)|_http-title:MyBBMACAddress:02:42:AC:11:00:02 (Unknown)Servicedetectionperformed.Pleasereportanyincorrectresultsathttps://nmap.org/submit/.Nmapdone:1IPaddress (1 hostup) scanned in 6.42 seconds
Great!!! We're given only one open port, which is http.
Visit the homepage of the website built with MyBB using the following URL. Then it leads to the panel page, where you can see admin's account. Afterward, I ran gobuster , ffuf , and other fuzzing tools on the website. You'll eventually find this endpoint of admin's dashboard. [22:00:32] 200 - 810B - /admin
www-data
It shows us the login page. So, I thought bruteforcing the password could be possible since the username is known as admin. However, first, there has to be the error message from server in order to complete filtering successful logins.
Invalid administration session. -> after giving wrong password
Final Command to bruteforce the password using hydra
Try the list of possible passwords one-by-one until you login as admin.
Credentials of admin: admin:babygirl
CVE-2023-41362
As you can see, it clearly shows the late version of MyBB Open Source Forum Software, which led me to search for RCE.
Cool. It's vulnerable to Temple Code Injection. More detailed information can be found here.
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
Using penelope for get more powerful/optimized shell.
Alice
Check /etc/passwd to see the registered users. Alice, nice, but we'll need password of this username.
The MyBB database backup directory is located at the admin/backups/ folder within your MyBB installation, but this is a non-public directory and the backups are not meant to be stored there permanently for security reasons. For security, you should download backups and store them in a separate, off-server location, and regularly remove them from the admin/backups/ directory after downloading.
Inside /backups directory, there's a kinda log file that tracks the login dates of users. As you can see below, user alice's password is saved as hash bcrypt.
Hash Cracking
Done!!! creds are alice:tinkerbell
Root
A simple privilege escalation technique can be applied here, as the scripts directory allows any ruby script to run without restrictions.
Set up the payload (calling shell as root):
Make it executable and run the file. Done
Feel free to edit the index.html at the end in /var/www/html directory.
┌──(zwique㉿zwique)-[~/Downloads]
└─$ john --format=bcrypt hash
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X2])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 5 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:/usr/share/john/password.lst
tinkerbell (?)
1g 0:00:00:12 DONE 2/3 (2025-09-03 22:35) 0.08032g/s 149.3p/s 149.3c/s 149.3C/s tabatha..trombone
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
