✅Valentine (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Memory Disclosure
System Vulnerable: 10.10.10.79
Vulnerability Explanation: The machine is vulnerable to memory disclosure on HTTPS service running with openssl which could leak password in base64.
Privilege Escalation Vulnerability: Misconfigure of file permission
Vulnerability Fix: Update the version of application and Restrict permission
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80 Apache/2.2.22
I will go through on Port 80 first. It just display a simple webpage.
Let start gobuster to discover hidden directory.
Going through /dev we found hype_key and notes.txt.
On hype_key, it seem like hex values and notes mention fixing decoder/encoder before live.
By converting those Hex value into text, it's RSA key.
By saving that private key on the machine and try to connect ssh but it requires the password.
Port 443 Apache/2.2.22
By going through the port 443, it just displays the same page. Let start scan for vulnerable.
Exploitation
We found the application on port 443 is vulnerable to Heartbleed. Search for public exploit code.
Proof of concept code: Heartbleed
We can run python exploit code against the machine. Once, we run this script, the output will be different each because of memory leak. After sometimes, we found leak base64 encode.
We can use the application to decode this and login with the password found.
Privilege Escalation
#1 Priv-Esc (Tmux)
By checking on history, seem like the system running tmux in the process. Enumerating on the process tmux, we found under root permission.
Let start following the history command.
Creating a bash reverse shell script and start HTTP Server as well as netcat on port 4444.
On victim machine just get the file and execute the bash script.
Last updated