> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/openadmin.md).

# OpenAdmin

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-9c76b70fa0da6b1a5cb5f8e025252834aa4ea72c%2Fimage.png?alt=media)

### Port 80

We can run a `gobuster` scan on port 80:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ee5bcad48e6a08eda552f10385fd8993f97f615b%2Fimage.png?alt=media)

I visited the `/music` directory first and it brought me to some corporate website:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-490b5aaf41271138d286185533d1da915c6595c7%2Fimage.png?alt=media)

When I clicked `login`, it brought me to `/ona`, which was a dashboard for OpenNetAdmin:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a371e13ed0c0b484fa56531956567e5df4fdbbf2%2Fimage.png?alt=media)

This version of OpenNetAdmin was vulnerable to RCE:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a76460eee9bd237c1aca7a951aad79f705024faa%2Fimage.png?alt=media)

{% embed url="<https://www.exploit-db.com/exploits/47691>" %}

We can gain a shell by following the PoC:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b365d6f5ac51067a84f23cba512736bb709b7f7d%2Fimage.png?alt=media)

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e23dce087fbc00e568bb368155aadb0c3d914898%2Fimage.png?alt=media)

## Privilege Escalation

### Jimmy Credentials

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-03339806ad956f93fc292204f3058effd8cb3d27%2Fimage.png?alt=media)

The users present on the machine are `joanna` and `jimmy`, and it seems that `ssh` with this password works on `jimmy`:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-028c84ee0afb1185f222cefaf59e1ff262520317%2Fimage.png?alt=media)

### Joanna SSH Key

When looking around the `/var/www/internal` directory, we can some code referencing the private SSH key of `joanna`:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c01ffcdecb0e84d246ce459b469ab465b1f3578b%2Fimage.png?alt=media)

When reading further, we can find the password and username hard-coded into the application:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-19640bbb03f35f88c66852ca26dc5be2a61fb12e%2Fimage.png?alt=media)

The hash can be cracked to give `Revealed`. We can read `/etc/apache2/sites-available/internal.conf` to find the hidden sub-domain and port it is open on:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-58d4fd33f22fc22166f184b4418736863b5ced3c%2Fimage.png?alt=media)

After port forwarding via `ssh -L 52846:127.0.0.1:52846 jimmy@10.10.10.71`, we can access the login page:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-45157e8af0333033c198157841493267114b9753%2Fimage.png?alt=media)

Logging in reveals a password protected RSA Private Key:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ceb72f20685149223bff270b7ac12bed47281d09%2Fimage.png?alt=media)

We can decrypt this via `ssh2john`:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cb1a62a9f4939c5eb4d8d03905c3a63f738c141d%2Fimage.png?alt=media)

Afterwards, we can use `openssl rsa -in key -out privatekey` to write the private RSA key, then `ssh` in as `joanna`:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3dfe578669cd65442896852be9e69513bba89ed6%2Fimage.png?alt=media)

### Nano GTFOBins

When checking `sudo` privileges, `joanna` can run `nano` as `root`:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ed9a0d217bfe210525cee4ff5a54f77cde99ab6b%2Fimage.png?alt=media)

Based on GTFOBins, we can simply run the following commands to gain a shell:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ce172c0c3bc11477dac10c3ff58c7dee94816e4c%2Fimage.png?alt=media)

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e960741d50f5f02097a0f4970d5fe08dc3acf1a8%2Fimage.png?alt=media)

Rooted!