{
    "id": "2d34d134-4786-409e-a504-d65107822d83",
    "name": "Tiki-Wiki Auth Bypass",
    "slug": "tiki-wiki-auth-bypass",
    "status": "published",
    "lab_type": "pta",
    "is_sample": false,
    "duration_in_seconds": 1800,
    "metadata": {
        "courses": [
            "1dce1618-55b6-4205-9799-e509ad2b2c77",
            "ebd09929-68db-4691-a1a3-5be2c88be72d"
        ],
        "pta_sdn": "554",
        "collections": [
            "bd6f07ba-b00e-4a43-afa5-6b2bdc3a25d8"
        ],
        "pta_namespace": "my.ine",
        "learning_paths": [],
        "has_published_parent": true
    },
    "session": null,
    "company": "a491bc32-c056-4946-9169-cc053387bada",
    "created": "2022-11-03T15:39:56.243239Z",
    "modified": "2024-11-27T14:52:46.479157Z",
    "is_beta": false,
    "lab_objectives": [],
    "main_learning_area": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
    "learning_areas": [
        {
            "id": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
            "name": "Cyber Security",
            "slug": "cyber-security"
        }
    ],
    "categories": [],
    "tags": [],
    "difficulty": "professional",
    "is_web_access": false,
    "is_lab_experience": true,
    "is_featured": false,
    "cve": "CVE-2020-15906",
    "severity": "critical",
    "year": "2020",
    "classification": null,
    "is_trackable": false,
    "cpe_credits": null,
    "is_skill_check": false,
    "external_url": "",
    "solution_video": null,
    "explanation_video": null,
    "description": "# Description\n\nIn 2020, a high-risk vulnerability was found in Tiki-Wiki CMS. The Tiki-Wiki before 21.2 is vulnerable to authentication bypass vulnerability by setting a blank password of the admin user after the 50 invalid login attempts.\n\nThe CVE assigned to this vulnerability is **CVE-2020-15906**. The severity base score of this vulnerability is **9.8**, which is considered critical. \n\n**Read More:**\n\n- https://nvd.nist.gov/vuln/detail/CVE-2020-15906\n\nThis security research was performed by [Maximilian Barz](https://github.com/S1lkys/CVE-2020-15906)",
    "description_html": "<h1>Description</h1>\n<p>In 2020, a high-risk vulnerability was found in Tiki-Wiki CMS. The Tiki-Wiki before 21.2 is vulnerable to authentication bypass vulnerability by setting a blank password of the admin user after the 50 invalid login attempts.</p>\n<p>The CVE assigned to this vulnerability is <strong>CVE-2020-15906</strong>. The severity base score of this vulnerability is <strong>9.8</strong>, which is considered critical. </p>\n<p><strong>Read More:</strong></p>\n<ul>\n<li>https://nvd.nist.gov/vuln/detail/CVE-2020-15906</li>\n</ul>\n<p>This security research was performed by <a href=\"https://github.com/S1lkys/CVE-2020-15906\">Maximilian Barz</a></p>",
    "tasks": "# Lab Environment\n\nIn this lab environment, the user is going to get access to a Kali GUI instance. A Tiki-Wiki CMS is vulnerable to authentication bypass vulnerability, identified by CVE-2020-15906, is running on the target server. It can be accessed using the tools installed on Kali at http://demo.ine.local\n\nYour task is to fingerprint the Tiki CMS using the tools available on the Kali machine. Then, exploit it using the appropriate method.\n\nThe setup is based on: [vulhub](https://github.com/vulhub/vulhub/tree/master/tikiwiki/CVE-2020-15906)\n\n**Objective:** Exploit the Tiki CMS using the burp and other tools to access the admin control panel.\n\n\n![0](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/0.png)\n\n# Tools\n\nThe best tools for this lab are:\n\n- Nmap\n- Bash Shell\n- Metasploit Framework\n- Burp Suite\n- Python\n\n**Please go ahead ONLY if you have COMPLETED the lab or you are stuck! Checking the solutions before actually trying the concepts and techniques you studied in the course will dramatically reduce the benefits of a hands-on lab!**",
    "tasks_html": "<h1>Lab Environment</h1>\n<p>In this lab environment, the user is going to get access to a Kali GUI instance. A Tiki-Wiki CMS is vulnerable to authentication bypass vulnerability, identified by CVE-2020-15906, is running on the target server. It can be accessed using the tools installed on Kali at http://demo.ine.local</p>\n<p>Your task is to fingerprint the Tiki CMS using the tools available on the Kali machine. Then, exploit it using the appropriate method.</p>\n<p>The setup is based on: <a href=\"https://github.com/vulhub/vulhub/tree/master/tikiwiki/CVE-2020-15906\">vulhub</a></p>\n<p><strong>Objective:</strong> Exploit the Tiki CMS using the burp and other tools to access the admin control panel.</p>\n<p><img alt=\"0\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/0.png\" /></p>\n<h1>Tools</h1>\n<p>The best tools for this lab are:</p>\n<ul>\n<li>Nmap</li>\n<li>Bash Shell</li>\n<li>Metasploit Framework</li>\n<li>Burp Suite</li>\n<li>Python</li>\n</ul>\n<p><strong>Please go ahead ONLY if you have COMPLETED the lab or you are stuck! Checking the solutions before actually trying the concepts and techniques you studied in the course will dramatically reduce the benefits of a hands-on lab!</strong></p>",
    "published_date": "2022-11-03T15:39:56.243239Z",
    "solutions": "**What is Tiki Wiki CMS?**\n\nTiki Wiki CMS Groupware is a free and open-source wiki-based content management system and Online office suite containing a number of collaboration features allowing it to operate as a Geospatial Content Management System.\n\nSource: https://en.wikipedia.org/wiki/Tiki_Wiki_CMS_Groupware\n\n**Vulnerable Version**\n\n- Tiki Wiki Cms Groupware 16.x - 21.1\n\n**Affected File**\n\n- tiki-login.php\n\n# Solution\n\n**Step 1:** Open the lab link to access the Kali machine.\n\n**Kali machine**\n\n![1](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/1.jpg)\n\n**Step 2:** Check if we can access the provided machine.\n\n**Command**\n\n```\nping -c 4 demo.ine.local\n```\n\n![2](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/2.jpg)\n\nThe provided machine is reachable.\n\n**Step 3:** Now, check all open ports on the machine.\n\n**Command**\n\n```\nnmap demo.ine.local\n```\n![3](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/3.jpg)\n\nThree ports are open, i.e., 22, 80, and 3306.\n\n**Step 4:** Run the firefox browser and access the Tiki CMS on port 80.\n\n**URL: http://demo.ine.local**\n\n**Note: Wait for 1-2 minutes to Tiki-Wiki CMS to load**\n\n![4](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/4.jpg)\n\nIn the default installation, there is a file in the tiki cms folder, i.e., changelog.txt; in this file, we can find the currently running version of Tiki CMS.\n\n**URL http://demo.ine.local/changelog.txt**\n\n![4_1](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/4_1.jpg)\n\nWe can notice that the Tiki cms version is 21.1.\n\n**Step 5:** We can use the searchsploit tool to find the vulnerability and a PoC code to the Tiki version 21.1\n\n**Commands**\n\n```\nsearchsploit tiki | grep 21.1\n```\n![5](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/5.jpg)\n\nTiki Wiki CMS Groupware 21.1 is vulnerable to authentication bypass vulnerability.\n\n**Step 6:** Now, let's start the burp suite and intercept the tiki-login.php request.\n\nAfter exploiting the CVE-2020-15906 vulnerability attacker can gain access to the whole Tiki Wiki CMS. We are using the burp suite to send 50 invalid requests, and the **admin** user, would be locked. Then, an attacker can use an empty password using burp suite to bypass the authentication.\n\nStarting burp suite\n\n![6](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6.jpg)\n\nOn the firefox browser, enable the proxy in the FoxyProxy plugin.\n\n![6_1](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_1.jpg)\n\nNow, enter any random password with admin user and intercept the tiki-login.php page request. \n\n**URL: http://demo.ine.local/tiki-login.php**\n\n![6_2](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_2.jpg)\n\nEnter **admin:admin** as creds\n\n![6_3](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_3.jpg)\n\nLogin request captured\n\n![6_4](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_4.jpg)\n\nLet's send the captured request to the intruder.\n\n![6_5](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_5.jpg)\n\nSwitch view to **Position** and click on **clear**\n\n![6_6](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_6.jpg)\n\nIn this case, we only want to change the **pass** value, so select that and click on **Add**\n\n![6_7](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_7.jpg)\n\nNow, switch to payloads and load the sample password file.\n\n**Path: /root/Desktop/wordlists/100-common-passwords.txt**\n\n![6_8](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_8.jpg)\n\n![6_9](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_9.jpg)\n\nNow, we are all set to run the attack. Click on **Start attack** and wait till 50 requests.\n\n![6_10](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_10.jpg)\n\n![6_11](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_11.jpg)\n\nOnce we get the message on the login page **Account requires administrator approval.** this confirms that we have locked the admin user.\n\nNow, stop the attack and go to the **proxy**\n\n![6_12](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_12.jpg)\n\nHere, we will remove the **pass** value, keep it empty, and forward all requests.\n\n![6_13](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_13.jpg)\n\nWe are accessing the Tiki CMS using an empty password, allowing us to access the Tiki admin panel.\n\n**Note: Remember to turn off the proxy**\n\n![6_14](https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_14.jpg)\n\nAs we can notice, we have successfully logged in as an admin user on the Tiki CMS by exploiting the **CVE-2020-15906**.\n\nThere is also a python script that makes this job more manageable. But before you use this script, restart the lab because we have already locked the admin user account.\n\n**Python script:** https://github.com/S1lkys/CVE-2020-15906/blob/master/TikiWiki_21.1_Authentication_Bypass.py \n\n# References\n\n 1. [Tiki-Wiki CMS](https://tiki.org/HomePage)\n 2. [PoC](https://github.com/S1lkys/CVE-2020-15906/blob/master/Tiki-Wiki%20Authentication%20Bypass.pdf)\n 3. [CVE-2020-15906](https://nvd.nist.gov/vuln/detail/CVE-2020-15906)",
    "solutions_html": "<p><strong>What is Tiki Wiki CMS?</strong></p>\n<p>Tiki Wiki CMS Groupware is a free and open-source wiki-based content management system and Online office suite containing a number of collaboration features allowing it to operate as a Geospatial Content Management System.</p>\n<p>Source: https://en.wikipedia.org/wiki/Tiki_Wiki_CMS_Groupware</p>\n<p><strong>Vulnerable Version</strong></p>\n<ul>\n<li>Tiki Wiki Cms Groupware 16.x - 21.1</li>\n</ul>\n<p><strong>Affected File</strong></p>\n<ul>\n<li>tiki-login.php</li>\n</ul>\n<h1>Solution</h1>\n<p><strong>Step 1:</strong> Open the lab link to access the Kali machine.</p>\n<p><strong>Kali machine</strong></p>\n<p><img alt=\"1\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/1.jpg\" /></p>\n<p><strong>Step 2:</strong> Check if we can access the provided machine.</p>\n<p><strong>Command</strong></p>\n<pre class=\"codehilite\"><code>ping -c 4 demo.ine.local</code></pre>\n\n<p><img alt=\"2\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/2.jpg\" /></p>\n<p>The provided machine is reachable.</p>\n<p><strong>Step 3:</strong> Now, check all open ports on the machine.</p>\n<p><strong>Command</strong></p>\n<p><pre class=\"codehilite\"><code>nmap demo.ine.local</code></pre>\n<img alt=\"3\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/3.jpg\" /></p>\n<p>Three ports are open, i.e., 22, 80, and 3306.</p>\n<p><strong>Step 4:</strong> Run the firefox browser and access the Tiki CMS on port 80.</p>\n<p><strong>URL: http://demo.ine.local</strong></p>\n<p><strong>Note: Wait for 1-2 minutes to Tiki-Wiki CMS to load</strong></p>\n<p><img alt=\"4\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/4.jpg\" /></p>\n<p>In the default installation, there is a file in the tiki cms folder, i.e., changelog.txt; in this file, we can find the currently running version of Tiki CMS.</p>\n<p><strong>URL http://demo.ine.local/changelog.txt</strong></p>\n<p><img alt=\"4_1\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/4_1.jpg\" /></p>\n<p>We can notice that the Tiki cms version is 21.1.</p>\n<p><strong>Step 5:</strong> We can use the searchsploit tool to find the vulnerability and a PoC code to the Tiki version 21.1</p>\n<p><strong>Commands</strong></p>\n<p><pre class=\"codehilite\"><code>searchsploit tiki | grep 21.1</code></pre>\n<img alt=\"5\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/5.jpg\" /></p>\n<p>Tiki Wiki CMS Groupware 21.1 is vulnerable to authentication bypass vulnerability.</p>\n<p><strong>Step 6:</strong> Now, let's start the burp suite and intercept the tiki-login.php request.</p>\n<p>After exploiting the CVE-2020-15906 vulnerability attacker can gain access to the whole Tiki Wiki CMS. We are using the burp suite to send 50 invalid requests, and the <strong>admin</strong> user, would be locked. Then, an attacker can use an empty password using burp suite to bypass the authentication.</p>\n<p>Starting burp suite</p>\n<p><img alt=\"6\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6.jpg\" /></p>\n<p>On the firefox browser, enable the proxy in the FoxyProxy plugin.</p>\n<p><img alt=\"6_1\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_1.jpg\" /></p>\n<p>Now, enter any random password with admin user and intercept the tiki-login.php page request. </p>\n<p><strong>URL: http://demo.ine.local/tiki-login.php</strong></p>\n<p><img alt=\"6_2\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_2.jpg\" /></p>\n<p>Enter <strong>admin:admin</strong> as creds</p>\n<p><img alt=\"6_3\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_3.jpg\" /></p>\n<p>Login request captured</p>\n<p><img alt=\"6_4\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_4.jpg\" /></p>\n<p>Let's send the captured request to the intruder.</p>\n<p><img alt=\"6_5\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_5.jpg\" /></p>\n<p>Switch view to <strong>Position</strong> and click on <strong>clear</strong></p>\n<p><img alt=\"6_6\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_6.jpg\" /></p>\n<p>In this case, we only want to change the <strong>pass</strong> value, so select that and click on <strong>Add</strong></p>\n<p><img alt=\"6_7\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_7.jpg\" /></p>\n<p>Now, switch to payloads and load the sample password file.</p>\n<p><strong>Path: /root/Desktop/wordlists/100-common-passwords.txt</strong></p>\n<p><img alt=\"6_8\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_8.jpg\" /></p>\n<p><img alt=\"6_9\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_9.jpg\" /></p>\n<p>Now, we are all set to run the attack. Click on <strong>Start attack</strong> and wait till 50 requests.</p>\n<p><img alt=\"6_10\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_10.jpg\" /></p>\n<p><img alt=\"6_11\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_11.jpg\" /></p>\n<p>Once we get the message on the login page <strong>Account requires administrator approval.</strong> this confirms that we have locked the admin user.</p>\n<p>Now, stop the attack and go to the <strong>proxy</strong></p>\n<p><img alt=\"6_12\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_12.jpg\" /></p>\n<p>Here, we will remove the <strong>pass</strong> value, keep it empty, and forward all requests.</p>\n<p><img alt=\"6_13\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_13.jpg\" /></p>\n<p>We are accessing the Tiki CMS using an empty password, allowing us to access the Tiki admin panel.</p>\n<p><strong>Note: Remember to turn off the proxy</strong></p>\n<p><img alt=\"6_14\" src=\"https://assets.ine.com/content/labs/vulnerability-labs/Tiki-Wiki_Auth_Bypass_CVE-2020-15906/6_14.jpg\" /></p>\n<p>As we can notice, we have successfully logged in as an admin user on the Tiki CMS by exploiting the <strong>CVE-2020-15906</strong>.</p>\n<p>There is also a python script that makes this job more manageable. But before you use this script, restart the lab because we have already locked the admin user account.</p>\n<p><strong>Python script:</strong> https://github.com/S1lkys/CVE-2020-15906/blob/master/TikiWiki_21.1_Authentication_Bypass.py </p>\n<h1>References</h1>\n<ol>\n<li><a href=\"https://tiki.org/HomePage\">Tiki-Wiki CMS</a></li>\n<li><a href=\"https://github.com/S1lkys/CVE-2020-15906/blob/master/Tiki-Wiki%20Authentication%20Bypass.pdf\">PoC</a></li>\n<li><a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-15906\">CVE-2020-15906</a></li>\n</ol>",
    "flags": [],
    "min_points_to_pass": null,
    "access_type": "default",
    "user_status": "unstarted",
    "user_lab_status": null,
    "user_status_modified": null,
    "user_flags": [],
    "global_running_session": null
}