β Tabby (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: LFI
System Vulnerable: 10.10.10.194
Vulnerability Explanation: The application is vulnerable to LFI which could allow us to view the tomcat-users.xml file and gave us access to Manager Interface. We can deploy the payload and gain access to the machine.
Privilege Escalation Vulnerability: Misconfigure of lxd group
Vulnerability Fix: Sanitized user input
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80 Apache/2.4.41
Running gobuster to find hidden directory background.
By clicking on the NEWS button it redirect me to megahosting.htb domain. Let add to hosts.
Once we found parameter file, we will test on LFI.
Port 8080 Apache Tomcat
There are interesting path on the webpage, /etc/tomcat9/tomcat-users.xml, /host-manager/html, /manager/html.
As the application is vulnerable to LFI. We can perform Path traversal to execute users.xml.
Tomcat Path
But it doesn't response anything. By checking the path on our local machine,
admin-gui: gives the user the ability to configure the Host Manager application using the graphical web interface.
manager-script: gives the user the ability to configure the Manager application using the text interface instead of the graphical web interface.
On /manager/html, it returns access denied.
on /host-manager/html, it's working.
Exploitation
We can deploy service which contain revershell code.
Use curl command to upload our payload.
Start netcat listener on port 1234 and going to execute the payload.
Privilege Escalation
Shell as ash
on /var/www/html, there is zip file. We can transfer by netcat. On our machine, let start netcat listener on port 444.
On victim machine
We can check the md5sum to confirms after transfer, the file still the same.
let crack the zip file
Let switch to user ash with password we found.
Shell as root
User ash is part of lxd group.
On our kali Linux machine,
Let transfer both the files to our victim machine. Let start HTTP server first.
lxc command error
By running the command to add image via web shell it doesn't work and need to access by ssh.
Create ssh-keygen
Copy the content of private key to our kali machine.
Copy the content of the id_rsa under root user to our machine.
Last updated