Sense

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.60 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, port 80 (HTTP) and port 443 (HTTPS) are open. Let's try to obtain more information about the services and versions running on those ports. The following command will scan ports 80 and 443 more in depth and save the result into a file:

nmap -sC -sV -p80,443 10.10.10.60 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Nmap identifies that port 80 redirects to the port 443. We can also see, that the SSL certificate has no commonName. Let's take a look at the website.

We have a pfSense login page. We could try to brute force the credentials or do an SQL injection, but none of those attacks are going to work. In fact, if you try to brute force the login page, the firewall will ban you. Let's try to list .txt files and directories with gobuster.

gobuster dir -u https://10.10.10.60 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -x txt -k

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

  • -k skips TLS certificate verification.

Exploitation

Gobuster found two interesting .txt files. The /changelog.txt file, which warns that a vulnerability remains to be fixed. And the /system-users.txt, which show us some credentials.

Let's search for the pfSense default credentials on Google. I found the following link, which shows that the default password for the pfSense login page is pfsense. Let's try the user rohit with the password previously found.

And we got in! At this point, I started looking for common exploits on exploit-db.

Exploit-DB is a great database of exploits and proof-of-concepts used by penetration testers and vulnerability researchers.

https://www.exploit-db.com/

And I found a pfSense Command Injection exploit. If you analyze the exploit, you could see that all the exploit is doing is making a GET request to an specific directory, injecting a command in the URL.

I preferred to exploit this vulnerability manually with a python script. All this script does is logging in with the valid credentials, taking the cookies and the CSRF token, and then doing the GET request with the encoded payload. The payload sends a reverse shell to our machine. The script also uses the pwn library which automatically spawn a shell.

All you have to do is change the IP address in the payload, and run the exploit with python3.

python3 exploit.py

And finally, as we got the shell as the root user, all we have to do is reap the harvest and take the flags.

Last updated

Was this helpful?