search

Shibboleth

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.78.109
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-27 15:26 +08
Nmap scan report for 10.129.78.109
Host is up (0.0080s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT   STATE SERVICE
80/tcp open  http

We have to add shibboleth.htb to our /etc/hosts file before we can view the web application.

hashtag
FlexStart -> Bare Metal BMC

The web application is a typical corporate page:

Most of the site was static and didn't do anything. However, there was one interesting part at the bottom:

I ran a subdomain scan with wfuzz and found a few subdomains present:

All 3 subdomains all pointed to the same place. The zabbix instance required credentials:

A directory scan with gobuster does show some directories, but there weren't anything in them.

Since there weren't many leads, I searched a bit more on the Bare Metal BMC Automation thing, because it looked as if it was intentionally left there since the rest of the site is basically Lorem Ipsum.

Searching on Hacktricks for Bare Metal BMC reveals that it opens port 623 for UDP traffic using the IPMI protocol.

Logo623/UDP/TCP - IPMI - HackTricksbook.hacktricks.xyzchevron-right

An nmap scan reveals it is open but filtered:

hashtag
IPMI Exploit -> Zabbix Creds

Hacktricks uses both Metasploit and ipmitool to run certain exploits on this, and we can try all of the exploits there. First, we can enumerate the version and other information:

Then, we can try the dump hashes method on this. Metasploit has a built in wordlist to use for it.

We have a hash! Based on the protocol, we can head to the example hashes page for hashcat and find that this uses mode 7300.

https://hashcat.net/wiki/doku.php?id=example_hasheshashcat.netchevron-right

Then, we can crack it.

With these credentials, we can login to the Zabbix instance:

hashtag
Zabbix RCE

At the bottom of the page, it says it is running Zabbix 5.0.17. This has an RCE exploit that is publicly available.

LogoZabbix 5.0.17 - Remote Code Execution (RCE) (Authenticated)Exploit Databasechevron-right

We can run this PoC and get a shell:

hashtag
Privilege Escalation

We cannot read the user flag from the ipmi-svc user yet, so we can first enumerate processes or any misconfigurations left behind by the user.

hashtag
Credential Reuse

There was nothing in the machine as the zabbix user. However, attempting to do password reuse with the password found earlier works.

hashtag
Pspy -> MySQL Exploit

I found some interesting processes using pspy64 here:

The most interesting was the mysqld one, since it was running MySQL as the root user. We can first enumerate the mysql version present:

Turns out, this is vulnerable to an RCE exploit:

LogoGitHub - Al1ex/CVE-2021-27928: CVE-2021-27928 MariaDB/MySQL-'wsrep provider' 命令注入漏洞GitHubchevron-right

To exploit this, we first need to generate a Shared Object file using msfvenom:

Then we can transfer this to the machine. Then, we need to find the password for the MySQL instance. I took a look at the /etc/zabbix files since the ipmi_svc user can read some of the files:

Great! Now we have the creds needed. We just need to login using those credentials and run this command:

This would spawn a root shell on our listener port!

Rooted!

PreviousSharedNextSilo

Last updated