OpenAdmin
Linux · Easy
10.10.10.171
Reconnaissance:
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.171
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
| 256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_ 256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Aggressive OS guesses: Linux 3.2 - 4.9 (96%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), Linux 3.16 (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 5.1 (93%), Oracle VM Server 3.4.2 (Linux 4.1) (93%), Android 4.1.1 (93%), Linux 3.18 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 50.10 secondsnmap shows two ports open, SSH on 22 and HTTP on 80
EM: Website - TCP 80
The site is just the default Apache page: http://10.10.10.171/ Apache/2.4.29 (Ubuntu) Server at 10.10.10.171 Port 80
/music: The page is for a music site:
/ona: Most of the links point back to index.html, or a couple other sides on the page. But the one that really matters is the Login link at the top - it points to http://10.10.10.171/ona (which doesn’t make a whole lot of sense).
This is an instance of OpenNetAdmin: http://solmusic.com/ona/
I can see the version is 18.1.1, which it is warning is not the latest.
FOOTHOLD: Shell as www-data
Exploit POC: Searchsploit shows a remote code execution vulnerability in this version:
There’s a link to this exploit on exploit-db.com. It’s super simple. The script runs an infinite bash loop taking commands and printing the output:
I can test it out with just curl. One lesson I learned is that it is important to have the trailing / at the end of the url:
I can see the output of id at the end of the Module Output section. The exploit from the site just adds an echo before and after the command the user runs and then uses sed to cut out the command output and ignore the rest. I could do this myself, but I’ll just get a reverse shell and leave that as an exercise for the motivated reader.
Shell: Since I want a legit shell, I’ll use curl to push a bash reverse shell:
It hangs, but in my nc listener, I’ve got a shell:
Priv Esc: www-data –> jimmy
Enumeration: On the box, I can see two user home directories, but I can’t read into either of them as www-data:
Heading back to /var/www, there are three directories:
html has the various sites:
I hadn’t found the marga one. But it looks like the rest of the dummy sites. internal is owned by jimmy, and I can’t access it:
Both ona and html/onaare links to /opt/ona/www.
ONA DB: Since OpenNetAdmin was the only site I found that seemed like it would require any kind of DB connection, went looking in there. Reading the config files, I eventually found
I figured I’d check for password reuse, and it worked for jimmy:
No user.txt in jimmy’s home directory. I suspect I need to pivot to joanna.
Priv Esc: jimmy –> joanna
Enumeration:
As jimmy, I can now access /var/www/internal:
I can do some digging to see if this site is running, and how it’s hosted (different vhost, or path, or port) by looking at the configs in /etc/apache2/sites-enabled:
openadmin.conf shows the site I found, listening on port 80, with root at /var/www/html (comment lines removed):
internal.conf shows a listener on localhost:52846:
It’s also interesting that it runs as jonanna.
Internal Site: I’ll reconnect as jimmy over SSH with a tunnel so that I can reach the internal site:
Now I can visit http://127.0.0.1:52846/ and get the page: http://127.0.0.1:52846/
Path 1: Webshell
The initial way I solved this was to write a webshell into the root directory for this folder:
Now I can access that and get execution as joanna:
To get a shell, I can start nc and curl:
Path 2: Log In and SSH
Log In and Get Key: The site above required username and password. If I check index.php, I can see the hardcoded username and password in the php source:
http://127.0.0.1:52846/main.php
Decrypt Key: Then it breaks in john instantly:
Priv: joanna –> root
Enumeration: Always check sudo on HTB, and it pays off here:
sudo nano: gtfobins has a page on nano. The path to get shell from sudo is as follows:
Not that it matters, but /opt/priv is an empty file:
I’ll run sudo /bin/nano /opt/priv and be dropped into nano:
Now I’ll hit Ctrl+r to read a file, and the menu at the bottom pops up:
Ctrl+x is “Execute Command”. Typing that gives a prompt “Command to execute: “. If I just enter /bin/sh, it will freeze, because the stdin/stdout/stderr are messed up. That’s what the reset; /bin/sh 1>&0 2>&0 fixes. When I run it, the remnants of nano are still there, but there’s a # as a prompt:
If I enter id, it works:
Last updated