Beep

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports quickly and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.7 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan those ports more in depth and save the result into a file:

nmap -sC -sV -p22,25,80,110,111,143,443,877,993,995,3306,4190,4445,4559,5038,10000 10.10.10.7 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

So it looks like we have a lot of information, let's go step by step. We know there is an HTTP server running on port 80. Let's take a look at it with the whatweb tool.

whatweb http://10.10.10.7

So, it looks like we are getting redirected to the HTTPS web page. If we search for the website on our browser, we should see a login page by elastix.

Time to look for any common exploits. I searched for elastix with the searchsploit tool and I got some exploits.

searchsploit elastix

There is a Local File Inclusion exploit which could work. Let's take a look at it.

searchsploit -x php/webapps/37637.pl

If you append the LFI exploit path to https://10.10.10.7 , you should be able to get the /etc/amportal.con file. We also could see other interesting files sush as /etc/passwd.

It looks a bit messy. If we press Ctrl+U in order to view the source code, you should see the text a bit more organized.

And look at that! We got the user admin and the password jEhdIekWmdjE.

Exploitation

At this point, there are various ways to get a shell. From logging in via ssh, to doing a shellshock attack, to taking advantage of crontab tasks via webmin, and many more.

I will be exploiting the vtiger CRM.

Let's use gobuster to list directories on the website.

gobuster dir -u http://10.10.10.7/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -k

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -k skips TLS certificate verification.

We get a lot of directories. If we go to the /vtigercrm directory, we should see another login page. Let's try the credentials we found earlier.

And we got in!

To spawn a reverse shell, we will have to go to Settings > Module Manager > Company Details.

Now we are going to create a PHP file that runs at a system level a command that sends our netcat listener a shell. Then we are going to rename the PHP file with the .jpg extension, so that the CRM will accept it. The file should look like this:

Then we upload the file into the Company Logo field.

Before hitting Save, we have to set out netcat listener.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, if we hit send, we should get the reverse shell as the user asterisk and we could grab the user flag.

Privilege Escalation

Let's start the privilege escalation phase listing the sudo privileges of the asterisk user.

sudo -l

  • -l list user privileges.

So the user asterisk can run quite a few binaries as sudo.

GTFOBins is a great list of binaries that can be used to escalate privileges if you have the right permissions:

https://gtfobins.github.io/

If we search for nmap in the GTFOBins list, we can see that we can spawn a shell as root with the sudo privilege running the following command:

sudo nmap --interactive

nmap> !/bin/bash

And that's right, we get a shell as the root user. All we have to do now is reap the harvest and grab the root flag.

Last updated

Was this helpful?