Sense

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.85.96 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-02 07:48 EDT
Nmap scan report for 10.129.85.96
Host is up (0.0088s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

2 ports that are open.

pfSense Creds + RCE

Visiting the IP address redirects us to port 443 where pfSense is running:

We can run a dirbuster scan to see what else is on the port because we have no credentials right now. We can include all the common extensions using -e php,html,txt to see all possible files on the machine.

One of them is called system-users.txt. The file contains this:

So the username is Rohit and the password is the default password. In this case, the default password for this software is pfsense. We can then login and see the version running:

This is an outdated version of pfSense running, and it is vulnerable to an RCE exploit.

We can download this exploit and use it to get a reverse shell.

Rooted!

PreviousSecretNextServmon