search

OpenAdmin

Linux · Easy

10.10.10.171

hashtag
Reconnaissance:

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.171 

22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
|   256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_  256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)

80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works

Aggressive OS guesses: Linux 3.2 - 4.9 (96%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), Linux 3.16 (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 5.1 (93%), Oracle VM Server 3.4.2 (Linux 4.1) (93%), Android 4.1.1 (93%), Linux 3.18 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 50.10 seconds

nmap shows two ports open, SSH on 22 and HTTP on 80

hashtag
EM: Website - TCP 80

The site is just the default Apache page: http://10.10.10.171/ Apache/2.4.29 (Ubuntu) Server at 10.10.10.171 Port 80

/music: The page is for a music site:

/ona: Most of the links point back to index.html, or a couple other sides on the page. But the one that really matters is the Login link at the top - it points to http://10.10.10.171/ona (which doesn’t make a whole lot of sense).

This is an instance of OpenNetAdmin: http://solmusic.com/ona/arrow-up-right

I can see the version is 18.1.1, which it is warning is not the latest.

hashtag
FOOTHOLD: Shell as www-data

Exploit POC: Searchsploit shows a remote code execution vulnerability in this version:

There’s a link to this exploit on exploit-db.com. It’s super simple. The script runs an infinite bash loop taking commands and printing the output:

LogoOpenNetAdmin 18.1.1 - Remote Code ExecutionExploit Databasechevron-right

I can test it out with just curl. One lesson I learned is that it is important to have the trailing / at the end of the url:

I can see the output of id at the end of the Module Output section. The exploit from the site just adds an echo before and after the command the user runs and then uses sed to cut out the command output and ignore the rest. I could do this myself, but I’ll just get a reverse shell and leave that as an exercise for the motivated reader.

Shell: Since I want a legit shell, I’ll use curl to push a bash reverse shell:

It hangs, but in my nc listener, I’ve got a shell:

hashtag
Priv Esc: www-data –> jimmy

Enumeration: On the box, I can see two user home directories, but I can’t read into either of them as www-data:

Heading back to /var/www, there are three directories:

html has the various sites:

I hadn’t found the marga one. But it looks like the rest of the dummy sites. internal is owned by jimmy, and I can’t access it:

Both ona and html/onaare links to /opt/ona/www.

ONA DB: Since OpenNetAdmin was the only site I found that seemed like it would require any kind of DB connection, went looking in there. Reading the config files, I eventually found

I figured I’d check for password reuse, and it worked for jimmy:

No user.txt in jimmy’s home directory. I suspect I need to pivot to joanna.

hashtag
Priv Esc: jimmy –> joanna

Enumeration:

As jimmy, I can now access /var/www/internal:

I can do some digging to see if this site is running, and how it’s hosted (different vhost, or path, or port) by looking at the configs in /etc/apache2/sites-enabled:

openadmin.conf shows the site I found, listening on port 80, with root at /var/www/html (comment lines removed):

internal.conf shows a listener on localhost:52846:

It’s also interesting that it runs as jonanna.

Internal Site: I’ll reconnect as jimmy over SSH with a tunnel so that I can reach the internal site:

Now I can visit http://127.0.0.1:52846/ and get the page: http://127.0.0.1:52846/arrow-up-right

hashtag
Path 1: Webshell

The initial way I solved this was to write a webshell into the root directory for this folder:

Now I can access that and get execution as joanna:

To get a shell, I can start nc and curl:

hashtag
Path 2: Log In and SSH

Log In and Get Key: The site above required username and password. If I check index.php, I can see the hardcoded username and password in the php source:

LogoCrackStation - Online Password Hash Cracking - MD5, SHA1, Linux, Rainbow Tables, etc.crackstation.netchevron-right
Revealed

http://127.0.0.1:52846/main.phparrow-up-right

Decrypt Key: Then it breaks in john instantly:

hashtag
Priv: joanna –> root

Enumeration: Always check sudo on HTB, and it pays off here:

sudo nano: gtfobins has a page on nano. The path to get shell from sudo is as follows:

Logonano | GTFOBinsgtfobins.github.iochevron-right

Not that it matters, but /opt/priv is an empty file:

I’ll run sudo /bin/nano /opt/priv and be dropped into nano:

Now I’ll hit Ctrl+r to read a file, and the menu at the bottom pops up:

Ctrl+x is “Execute Command”. Typing that gives a prompt “Command to execute: “. If I just enter /bin/sh, it will freeze, because the stdin/stdout/stderr are messed up. That’s what the reset; /bin/sh 1>&0 2>&0 fixes. When I run it, the remnants of nano are still there, but there’s a # as a prompt:

If I enter id, it works:

PreviousSoccerNextLegacy

Last updated