✅SolidState (Medium)

Lesson Learn

Report-Penetration

Vulnerable Exploit: Apache James version out of dated

System Vulnerable: 10.10.10.51

Vulnerability Explanation: The machine is vulnerable to Remote Command Injection on username field and default credential in used. We exploit this by create new user and send reverse shell payload through mail and once any user login, we will gain initial shell on the machine.

Privilege Escalation Vulnerability: Misconfigure file permission

Vulnerability Fix: Apply patch and update the Apache James version to the lasted and stable

Severity: High

Step to Compromise the Host:

Reconnaissance

Enumeration

Port 80 Apache/2.4.25 (Debian)

Let start with port 80, we have a webpage of Solid State Security. Checking on source code didn't found anything.

Running gobuster but nothing is interesting.

Port 4555 JAMES Remote Administration Tool 2.3.2

I have seen Remote Administration Tool. I don't know what that is. Let me search for public exploit for this version and service.

Let check the exploit code for Remote Command Execution. On the exploit code I just notice some parts that the script going to do.

  • This is an authenticated exploit. The exploit uses the default credentials root/root.

  • It's going to connect to the server IP that we provided the argument.

  • The script first creates a user with username “../../../../../../../../etc/bash_completion.d” and password “exploit”.

Exploitation

Let start connect to port 4555, We can login with root/root as expected.

Let check HELP for list of command to check out which command we can run.

Let start to use listusers command. As we can see, there are 5 users.

Actually, there is a command to change the password of the user. Let start change the password of those users.

Let connect to mail protocol POP3 (110) to check the mail box of each users.

On user james, we didn't see any email.

On user thomas also we didn't see any email.

On user mailadmin also we didn't see any email.

On user john, we found 1 email which is interesting. As it mentions that will send temporary password for mindy.

On mindy account, we found SSH key was transfer via email to mindy.

Let start ssh to the machine with user mindy and password P@55W0rd1!2@.

We are now on the machines but unfortunately, we can issue command only ls and cat.

Escape restrict rbash

ReverseShell via Mail

Let get back to our exploit code, seem like it's going to create user and inject on username field with ../../../../../../../../etc/bash_completion.d.

Let create a user with inject the exploit script.

Sending a mail with reverse shell via email to use we just create.

Start netcat listener on port 4444 and wait for any user login to the machine.

Let login ssh to the machine with user mindy so that we get reverse shell as user mindy.

Privilege Escalation

First we need to perform basic enumerate on the machine or run linenum.sh check for vulnerable. But we don't get any interest result back. Let check for process running.

Let start HTTP Server for transfer file pspy to the victim machine.

Auto script python

After waiting for sometimes, there is cron jobs schedule to run python script.

Let check on the file /opt/tmp.py. As we have write permission. So we can inject or overwrite the file with reverse shell payload.

Let inject bash reverse payload to the tmp.py and start netcat listener on port 5555.

Let wait for sometimes, the shell pop up with root permission.

PreviousPoison (Medium)NextTartarSauce (Medium)

Last updated