✅Beep (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: LFI, RCE, ShellShock, Weak Password Policy
System Vulnerable: 10.10.10.7
Vulnerability Explanation: The application is contained multiple vulnerabilities. The vulnerbility LFI which we could read sensitive file /etc/amportal.conf that contained username and password for login with ssh service.
Privilege Escalation Vulnerability: Misconfigure on SUDO which we could run sudo on chmod to change permission of /bin/bash file without password.
Vulnerability Fix: Upgrade version of application and implement strong password policy
Severity: Critical
Step to Compromise the Host:
Reconnaissance
There are 16 TCP Ports open on the remote machine:
Port 22: OpenSSH 4.3 (protocol 2.0)
Port 25: Postfix smtpd
Port 80: Apache httpd 2.2.3
Port 110: Cyrus pop3d 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
Port 111: Rpcbind
Port 143: Cyrus imapd 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
Port 443: HTTPS
Port 878: Rpcbind
Port 993: Cyrus imapd
Port 995: Cyrus pop3d
Port 3306: MySQL (unauthorized)
Port 4190: Cyrus timsieved 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4 (included w/cyrus imap)
Port 4445: upnotifyp
Port 4559: HylaFAX 4.3.10
Port 5083: Asterisk Call Manager 1.1
Port 10000: MiniServ 1.570 (Webmin httpd)
Enumeration
Port 80 / 443 Web Server
By browsing on port 80, it will redirect to port 443 on web browser as login web page of elastix. Viewing the source code but nothing is interesting.
Let start enumerating and finding if there is any hidden subdirectory with gobuster.
Let checking on /admin directory. Try guessing the username and password as admin/admin but it doesn't work but it returns back with the application version (FreePBX 2.8.1.4)
By searching for public exploit of elastix, we found some vulnerability which we could try it.
Port 10000 MiniServ 1.570 (Webmin httpd)
Checking on port 10000, we found that it is a login webpage of webmin application and try guessing with username and password as admin/admin and root/root it doesn't work.
Searching for public exploit of webmin application and it returns a lot of vulnerabilities.
Exploitation #1 (LFI)
We have seen elastix is vulnerable to FLI. Let copy and check the exploit script. It provides the path for LFI vulnerability.
It return the result of file and contains some username and password but it's difficult to view. By typing Ctrl+U, it's provide a good view.
Fixing SSH Error:
By try login ssh with credentials admin/jEhdIekWmdjE but it doesn't work. Let try to enumerate more deeper on LFI whether we can read the user file on remote machine or not.
As we got a lot of users on the remote machine. Let copy all the text and save it on the machine. Let extract out nologin user by open file with vim and type Esc + :g/nologin/d
We got root user on machine rather than admin. Let try login with root/jEhdIekWmdjE and we now successfully login to machine with root permission.
Exploitation #2 (RCE)
It seems like the version of FreePBX 2.8.1.4 is vulnerable to remote code execution. Let copy exploit code and viewing the exploit code.
By viewing the code, there are some parts we need to change configuration:
Replacing rhost and lhost on the script
Finding the right extension
Fixing SSL error
Finding the right extension lines.
By default extension it doesn't work. We need to find out the right extension. We need to use SIPVicious and svwar is the tool used to identified working extension lines on PBX.
Fix SSL Error.
To exploit this successful, we need to changing the exploit code to fix ssl error,
the below is the right one:
Exploitation: we need to run netcat listener on port 443 and execute exploit python script.
We found python script install on machine, to improve our shell script and get fully interactive shell (auto tab):
Privilege Escalation
First thing first, I always run sudo -l once I got onto the machine. We found there are a lots of misconfiguration on the machine.
SUID Nmap
We can run nmap as root permission. We found version on nmap is vulnerable which we could perform privilege escalation.
SUID Chmod
We can run chmod without password. chmod is used to set the permission on file. We can set SUID to the /bin/bash file.
Exploitation #3 (Webmin)
Port 10000 MiniServ 1.570 (Webmin httpd)
We have have login webpage of webmin. Previously, we got credentials root/jEhdIekWmdjE. Let try login with this credentials, we successfully login.
Under system tab, we saw option Scheduled Commands which we could scheduled any command run as root. Let
Let stat netcat listener on port 443 and waiting for command to run.
Exploitation #4 (Shellsock)
Port 10000 MiniServ 1.570 (Webmin httpd)
In case, we don't have any valid credentials to login. For this application is vulnerable to shellshock.
First, we need to intercept the request traffic in burp, then we replace the user agent with our reverse shell payload:
Next, let start the netcat listener on 4444 and then send the request with our reverse shell.
Exploitation #5 (RCE-SMTP)
Previously, we have seen that machine is open port 25. Let connect via telnet to enumerate to find valid user.
We can send email via smtp protocol to asteristk@localhost with reverse shell payload.
As the application is vulnerable to LFI and we can check the directory /very/mail/asterisk for mail.
To easy reading the content, let intercept request traffic with burp.
We can execute command whoami to check if RCE is working or not. The result returning back the username asterisk which mean that it's working.
Let execute bash reverse shell with our netcat listener on port 4444. By simple execute the bash script on the request it doesn't work. It requires to perform URL encoded (Ctrl-U)
Last updated