✅Traverxec (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: nostromo version out of date and vulnerable to RCE
System Vulnerable: 10.10.10.165
Vulnerability Explanation: The application nostromo which is running and it's vulnerable to RCE by public exploit.
Privilege Escalation Vulnerability: journalctl (GTFOBins)
Vulnerability Fix: Update to the latest and stable version and use strong password with complexity.
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80 nostromo 1.9.6
By information leak on HTTP header, we found that application is running with nostromo 1.9.6.
Let search for public exploit for nostromo version 1.9.6
Let copy and run the script to confirms it's vulnerable to remote code execution
#1 Exploit (Automate)
Let start our netcat listener on port 4444 to confirms we can inject reverse shell.
Confirms that we can perform reverse shell. Let start our netcat listener on port 4444 again.
#2 Exploit (Manual)
Reviewing the script source code
Let send the request through burp and change request method to POST
Confirms it's working. Let inject netcat reverse shell and start netcat listener on port 4444.
Privilege Escalation
Shell as David
We can see that, there is a /home directory. We can assess by /~user-name
Assess through webpage but doesn't work.
Go through directory on shell,
Again, visit the file via webpage it protected by basic authentication.
There is a zip file
Let transfer that zip file to our machine.
Let extract the zip file
Crack id_rsa to get passphrase
SSH to machine with user david
Shell as root
On home direct of user david, there is a folder call bin
Executed server-stats.sh
View the file server-stats.sh
Interesting part is the last command run with sudo
Checking on gtfobin.github.io,
journalctl
Last updated