✅OpenAdmin (Easy)

Lesson Learn

Report-Penetration

Vulnerable Exploit: Curl Injection, OpenAdmin out of dated

System Vulnerable: 10.10.10.171

Vulnerability Explanation: By enumerating hidden directory, we found a login page which exposed application version that out of dated which contained vulnerable with command injection.

Privilege Escalation Vulnerability: Password reuse and misconfigure privilege of the application.

Vulnerability Fix: Update application version to the latest or stable. Ensure that there is no reuse password in used and least privilege.

Severity: High

Step to Compromise the Host:

Reconnaissance

Enumeration

Port 80 Apache/2.4.29

By going through port 80, there is a default webpage of apache

Start running gobuster to find hidden directory

Checking on /music

On login button, there is href to /10.10.10.171/ona

There is version 18.1.1. Let search for public exploit

Exploitation

Proof of Concept Code: https://www.exploit-db.com/exploits/47691

Trying manual exploit with curl command

Again, add / and the end http://10.10.10.171/ona/

It's a lot of information. Let search for user www-data, we found

Now we can modify the script to ease of view the output

Confirms that we can execute command.

Let start netcat listener on port 4444

Privilege Escalation

Shell as jimmy

By enumerate on the machine, we found a database file which stored password of user jimmy

We have checked password reuse and it's worked on user jimmy

Shell as joanna

Checking on /var/www, we found /internal own by user jimmy

We found there is a localhost listening on port 52846

This directory could be other web server

Let check with the curl command on port 52846

Crack private key

Let try to crack the private key with the hint of "ninja"

We can write an unencrypted copy of the key

Port Forwarding

Create a php command execute script on /var/www/internal

Confirms that we can remote execute arbitrary command

Shell as Root

Check misconfigure on sudo -l

/opt/priv sudo -l

Nothing on /opt/priv. https://gtfobins.github.io/gtfobins/nano/#sudo

PreviousNibbles (Easy)NextSense (Easy)

Last updated