Vulnerable Machine - bludit.lab

Let’s set up a fully functional vulnerable machine domain called bludit.lab on an Ubuntu Server! This guide walks you through setting up the vulnerable Bludit CMS 3.18.2 environment, configuring Apache and PHP, and establishing a local privilege escalation vector for testing.

---

Steps Overview

• Step 1: Server & User Setup
• Step 2: Installing Necessary Components & PHP
• Step 3: Composer Installation
• Step 4: Bludit CMS Installation & Lab Setup
• Step 5: Apache VirtualHost Configuration
• Step 6: Site Initialization & Admin Setup
• Step 7: API Plugin Configuration
• Step 8: Privilege Escalation Setup

---

1. Server & User Setup

Start by installing a clean version of Ubuntu Server (such as Ubuntu Server 24.04 LTS). This ensures no conflicting packages or existing configurations interfere with the vulnerable environment.

User Creation

Set up the initial user credentials:

• Username: core
• Password: core
• Root Password: root@123

Add User to the Sudo Group

After completing the server installation, grant core administrative privileges:

sudo usermod -aG sudo core

Adding core to the sudo group allows the user to execute commands with elevated privileges necessary for software installation and configuration.

---

2. Installing Necessary Components

Update your package lists and install Apache, PHP, and all required PHP extensions:

sudo apt update
sudo apt install -y apache2 php php-cli libapache2-mod-php php-curl php-dom php-gd php-intl php-mbstring php-xml php-zip unzip curl git

Verify Apache Installation

Check the installed Apache version:

apache2 -v

Confirm that the Apache PHP module is loaded:

sudo apache2ctl -M | grep -i php

Verify PHP Extensions

Ensure that all required PHP extensions are active:

php -m | grep -Ei 'curl|dom|gd|intl|mbstring|openssl|session|zip'

Expected modules:

• curl
• dom
• gd
• intl
• mbstring
• openssl
• session
• zip

---

3. Composer Installation

Download and install Composer globally:

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php composer-setup.php
sudo mv composer.phar /usr/local/bin/composer

Verify Composer is ready:

composer --version

---

4. Bludit CMS Installation

Create the lab web directory and clone the official Bludit repository:

sudo mkdir -p /var/www/bludit-lab
sudo git clone https://github.com/bludit/bludit.git /var/www/bludit-lab

Navigate to the directory and check out the vulnerable release (3.18.2):

cd /var/www/bludit-lab
sudo git checkout 3.18.2

Set appropriate ownership and permissions for the Apache web server:

sudo chown -R www-data:www-data /var/www/bludit-lab
sudo chmod -R 755 /var/www/bludit-lab

---

5. Apache Configuration

Create a new Apache VirtualHost configuration file for the lab domain:

sudo nano /etc/apache2/sites-available/bludit-lab.conf

Add the following VirtualHost definition:

<VirtualHost *:80>
    ServerName bludit.lab
    DocumentRoot /var/www/bludit-lab

    <Directory /var/www/bludit-lab>
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/bludit-lab-error.log
    CustomLog ${APACHE_LOG_DIR}/bludit-lab-access.log combined
</VirtualHost>

Save and exit the file (Ctrl+O, Enter, then Ctrl+X).

Enable Site and Rewrite Module

Enable the new VirtualHost and Apache’s rewrite module:

sudo a2ensite bludit-lab.conf
sudo a2enmod rewrite

Test the configuration syntax and restart the Apache service:

sudo apache2ctl configtest
sudo systemctl restart apache2

Configure Local Domain Resolution

Add a local DNS entry for bludit.lab in /etc/hosts:

echo '127.0.0.1 bludit.lab' | sudo tee -a /etc/hosts

Verify domain resolution and HTTP response:

getent hosts bludit.lab
curl -I http://bludit.lab

---

6. Site Initialization & Administrator Setup

1. Open your web browser and navigate to:

http://bludit.lab/

1. Follow the setup wizard to select your language and complete site information setup.
2. During the web installation, create an administrator account with the username admin.
3. Once completed, log in through the Bludit administration interface at:

http://bludit.lab/admin/

Verify that the CMS dashboard loads successfully.

---

7. API Plugin Configuration

Configure the API plugin to prepare for automated assessment and API testing:

1. Log in to the Admin Dashboard.
2. Navigate to Plugins → API.
3. Ensure the API plugin is enabled.
4. Note down the API endpoint and API token for testing.

---

8. Privilege Escalation Setup

Prepare the environment for testing local privilege escalation by removing core from the sudo group and adding a targeted sudoers entry.

1. Remove core from the sudo group:

sudo deluser core sudo

1. Edit the sudoers file using visudo:

sudo visudo

1. Append the following line:

core ALL=(ALL) NOPASSWD: /usr/bin/vi

This configuration simulates a privilege escalation scenario where the core user can execute /usr/bin/vi with root privileges without entering a password, allowing breakout to a root shell.

---

Conclusion

By following these steps, you have successfully deployed the bludit.lab vulnerable machine environment running Bludit CMS 3.18.2 with local routing, web server configurations, and a misconfigured sudo privilege escalation vector ready for security testing.