Savet za bug bounty: registrujte se za Intigriti, premium platformu za bug bounty kreiranu od hakera, za hakere! Pridružite nam se na https://go.intigriti.com/hacktricks danas, i počnite da zarađujete nagrade do $100,000!
Automatsko skeniranje
droopescan
pip3installdroopescandroopescanscanmoodle-uhttp://moodle.example.com/<moodle_path>/[+] Plugins found:forumhttp://moodle.schooled.htb/moodle/mod/forum/http://moodle.schooled.htb/moodle/mod/forum/upgrade.txthttp://moodle.schooled.htb/moodle/mod/forum/version.php[+] No themes found.[+] Possible version(s):3.10.0-beta[+] Possible interesting urls found:Staticreadmefile.-http://moodle.schooled.htb/moodle/README.txtAdminpanel-http://moodle.schooled.htb/moodle/login/[+] Scan finished (0:00:05.643539elapsed)
moodlescan
#Install from https://github.com/inc0d3/moodlescanpython3moodlescan.py-k-uhttp://moodle.example.com/<moodle_path>/Version0.7-Dic/2020.............................................................................................................ByVictorHerrera-supportedbywww.incode.cl.............................................................................................................Gettingserverinformationhttp://moodle.schooled.htb/moodle/...server:Apache/2.4.46 (FreeBSD) PHP/7.4.15x-powered-by:PHP/7.4.15x-frame-options:sameoriginlast-modified:Wed,07Apr202121:33:41GMTGettingmoodleversion...Versionfoundvia/admin/tool/lp/tests/behat/course_competencies.feature:Moodlev3.9.0-betaSearchingvulnerabilities...Vulnerabilitiesfound:0Scancompleted.
Otkrio sam da su automatski alati prilično beskorisni u otkrivanju ranjivosti koje utiču na verziju moodle-a. Možete proveriti za njih na https://snyk.io/vuln/composer:moodle%2Fmoodle
RCE
Potrebno je da imate ulogu menadžera i da možete instalirati dodatke unutar kartice "Administracija sajta"**:**
Zatim, možete instalirati sledeći dodatak koji sadrži klasičnu pentest-monkey php rev shell (pre otpremanja morate ga dekompresovati, promeniti IP i port revshella i ponovo kompresovati)
Savet za bug bounty: Prijavite se za Intigriti, premium platformu za bug bounty kreiranu od strane hakera, za hakere! Pridružite nam se na https://go.intigriti.com/hacktricks danas, i počnite da zarađujete nagrade do $100,000!