Time

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.85.102
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-02 10:05 EDT
Warning: 10.129.85.102 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.85.102
Host is up (0.039s latency).
Not shown: 45364 closed tcp ports (conn-refused), 20169 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

JSON Beautifier

Port 80 was running a JSON Beautifier:

This would accept JSON inputs, but I had no idea what kind of engine this was using. There were 2 modes to this: Beautify and Validate, of which the latter was in Beta. I tried sending some random input and managed to trigger an error:

We can view the rest of this error either in Burp or by examining the page source.

So this was using a software called Jackson to validate JSON input. Googling for exploits led me to some deserialisation related exploits where we could achieve RCE. Here's the PoC I used:

LogoGitHub - jas502n/CVE-2019-12384: Jackson Rce For CVE-2019-12384GitHub

We first need to create a reverse shell in SQL interestingly:

Afterwards, we need to send this input to the application to be parsed:

When we send this, it would download the file and give us a reverse shell.

Privilege Escalation

GetText

I ran a LinPEAS scan for enumeration. Within the output, this caught my eye:

It seems that we own a script or something. Since this is within the system's PATH variable, we can just edit it. Here's the content of the script:

This looks like something that the root user would have on a cronjob. As such, we can just append chmod u+s /bin/bash to the script.

Easy root!

PreviousTheNotebookNextUnattended