βœ…TartarSauce (Medium)

Lesson Learn

Report-Penetration

Vulnerable Exploit: Remote File Inclusion

System Vulnerable: 10.10.10.88

Vulnerability Explanation: The machine is vulnerable to RFI on WordPress plug in which can be exploited by non-authenticated attacker to include remote PHP file and execute arbitrary code on the vulnerable system.

Privilege Escalation Vulnerability: Misconfiguration of permission

Vulnerability Fix: Apply patch and restrict permission

Severity: High

Step to Compromise the Host:

Reconnaissance

Enumeration

Port 80 Apache httpd 2.4.18

There's only port 80 open on the machine. Let check it out. It just a simple webpage.

Let go through /robots.txt to check if there is other directory we can access.

Out of that 5 disallow, we can access to /webservices/monstra-3.0.4/ which display a webpage.

I just click all the button available on the application to see how the application work. We just see one more login page of Monstra version 3.0.4.

I have tried login with credential admin/admin and it's worked.

Let search for public exploit in case this version of the application is vulnerable.

There are many exploit but we need to focus on RCE and Arbitrary File Upload. Unfortunately non of them are working.

Let run gobuster to check if there is any hidden directory. Immediately, we got WP which is for WordPress framework.

Following through the directory, we found a webpage power by WordPress.

We can run wpscan or check the source code.

Searching for public exploit of gwolle, we found Remote File Inclusion.

Exploitation

Shell as www-date

Checking the script of exploit Remote File Inclusion.

Modify php-reverse-shell code with our IP, Port and rename file to wp-load.php. Then, start HTTP server to share the file.

Also start netcat listener on port 4444.

Let browse with the path that vulnerable to RFI and point to our kali machine.

Privilege Escalation

Shell as onuma

Once I'm on the machine, I will run sudo -l to check if there is misconfigure.

/bin/tar

We can execute /bin/tar under user onuma without password.

Shell as root

Let start HTTP Server and share file linenum.sh. But we didn't see any interest.

Let start running pspy to enumerate the process. We can download from link below

Auto script

Once we run the file pspy32, we see the process running in the background.

Let create the script in C and compiles it.

In case error, we can install lib for Gucci.

Let switch to root user. Add SetUID to the file chmod +s setuid.

Let start HTTP Server to share file to our victim machine.

Let wait for 5mns and check the folder we found other file.

Then copy the exploit.tar.gz to .67ea8f0ff41222a4114795e2bf4fcadf4b103557 and wait for 5mns.

Let wait for 30 seconds, we found there is another folder pop up "check"

Following the directory check, we can go and executed the file setuid.

PreviousSolidState (Medium)NextWindow Boxes

Last updated