Shibboleth
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.78.109
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-27 15:26 +08
Nmap scan report for 10.129.78.109
Host is up (0.0080s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT STATE SERVICE
80/tcp open httpWe have to add shibboleth.htb to our /etc/hosts file before we can view the web application.
FlexStart -> Bare Metal BMC
The web application is a typical corporate page:
Most of the site was static and didn't do anything. However, there was one interesting part at the bottom:
I ran a subdomain scan with wfuzz and found a few subdomains present:
All 3 subdomains all pointed to the same place. The zabbix instance required credentials:
A directory scan with gobuster does show some directories, but there weren't anything in them.
Since there weren't many leads, I searched a bit more on the Bare Metal BMC Automation thing, because it looked as if it was intentionally left there since the rest of the site is basically Lorem Ipsum.
Searching on Hacktricks for Bare Metal BMC reveals that it opens port 623 for UDP traffic using the IPMI protocol.
An nmap scan reveals it is open but filtered:
IPMI Exploit -> Zabbix Creds
Hacktricks uses both Metasploit and ipmitool to run certain exploits on this, and we can try all of the exploits there. First, we can enumerate the version and other information:
Then, we can try the dump hashes method on this. Metasploit has a built in wordlist to use for it.
We have a hash! Based on the protocol, we can head to the example hashes page for hashcat and find that this uses mode 7300.
Then, we can crack it.
With these credentials, we can login to the Zabbix instance:
Zabbix RCE
At the bottom of the page, it says it is running Zabbix 5.0.17. This has an RCE exploit that is publicly available.
We can run this PoC and get a shell:
Privilege Escalation
We cannot read the user flag from the ipmi-svc user yet, so we can first enumerate processes or any misconfigurations left behind by the user.
Credential Reuse
There was nothing in the machine as the zabbix user. However, attempting to do password reuse with the password found earlier works.
Pspy -> MySQL Exploit
I found some interesting processes using pspy64 here:
The most interesting was the mysqld one, since it was running MySQL as the root user. We can first enumerate the mysql version present:
Turns out, this is vulnerable to an RCE exploit:
To exploit this, we first need to generate a Shared Object file using msfvenom:
Then we can transfer this to the machine. Then, we need to find the password for the MySQL instance. I took a look at the /etc/zabbix files since the ipmi_svc user can read some of the files:
Great! Now we have the creds needed. We just need to login using those credentials and run this command:
This would spawn a root shell on our listener port!
Rooted!
Last updated