-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oNsave the scan result into a file, in this case the allports file.
# Nmap 7.92 scan initiated Fri Jan 7 12:40:32 2022 as: nmap -sS --min-rate 5000 -p- -T5 -Pn -n -oN allPorts 10.10.10.60
Nmap scan report for 10.10.10.60
Host is up (0.069s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
443/tcp open https
# Nmap done at Fri Jan 7 12:40:58 2022 -- 1 IP address (1 host up) scanned in 26.60 seconds
As we see, port 80(HTTP) and port 443(HTTPS) are open. Let's try to obtain more information about the services and versions running on those ports. The following command will scan ports 80 and 443 more in depth and save the result into a file:
nmap -sC -sV -p80,443 10.10.10.60 -oN targeted
-sC performs the scan using the default set of scripts.
-sV enables version detection.
-oNsave the scan result into file, in this case the targeted file.
# Nmap 7.92 scan initiated Fri Jan 7 12:47:19 2022 as: nmap -sCV -p80,443 -oN targeted 10.10.10.60
Nmap scan report for 10.10.10.60
Host is up (0.068s latency).
PORT STATE SERVICE VERSION
80/tcp open http lighttpd 1.4.35
|_http-title: Did not follow redirect to https://10.10.10.60/
|_http-server-header: lighttpd/1.4.35
443/tcp open ssl/https?
| ssl-cert: Subject: commonName=Common Name (eg, YOUR name)/organizationName=CompanyName/stateOrProvinceName=Somewhere/countryName=US
| Not valid before: 2017-10-14T19:21:35
|_Not valid after: 2023-04-06T19:21:35
|_ssl-date: TLS randomness does not represent time
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Jan 7 12:47:32 2022 -- 1 IP address (1 host up) scanned in 13.30 seconds
Nmap identifies that port 80 redirects to the port 443. We can also see, that the SSL certificate has no commonName. Let's take a look at the website.
We have a pfSense login page. We could try to brute force the credentials or do an SQL injection, but none of those attacks are going to work. In fact, if you try to brute force the login page, the firewall will ban you. Let's try to list .txt files and directories with gobuster.
Gobuster found two interesting .txt files. The /changelog.txt file, which warns that a vulnerability remains to be fixed. And the /system-users.txt, which show us some credentials.
And we got in! At this point, I started looking for common exploits on exploit-db.
Exploit-DB is a great database of exploits and proof-of-concepts used by penetration testers and vulnerability researchers.
I preferred to exploit this vulnerability manually with a python script. All this script does is logging in with the valid credentials, taking the cookies and the CSRF token, and then doing the GET request with the encoded payload. The payload sends a reverse shell to our machine. The script also uses the pwn library which automatically spawn a shell.
All you have to do is change the IP address in the payload, and run the exploit with python3.
python3 exploit.py
[+] Trying to bind to :: on port 1234: Done
[+] Waiting for connections on :::1234: Got connection from ::ffff:10.10.10.60 on port 25574
[*] Switching to interactive mode
sh: can't access tty; job control turned off
# $
And finally, as we got the shell as the root user, all we have to do is reap the harvest and take the flags.
Let's search for the pfSense default credentials on Google. I found the following , which shows that the default password for the pfSense login page is pfsense. Let's try the user rohit with the password previously found.
And I found a . If you analyze the exploit, you could see that all the exploit is doing is making a GET request to an specific directory, injecting a command in the URL.
