Apex

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 192.168.183.145
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-11 22:07 +08
Nmap scan report for 192.168.183.145
Host is up (0.17s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE
80/tcp   open  http
445/tcp  open  microsoft-ds
3306/tcp open  mysql

Interesting ports open.

SMB Enumeration

Using smbmap, we can find some shares that are open.

$ smbmap -H 192.168.183.145              
[+] Guest session       IP: 192.168.183.145:445 Name: 192.168.183.145                                   
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        print$                                                  NO ACCESS       Printer Drivers
        docs                                                    READ ONLY       Documents
        IPC$                                                    NO ACCESS       IPC Service (APEX server (Samba, Ubuntu))

The docs share just had some files related to OpenEMR:

Web Enumeration -> FileManager LFI

Port 80 shows a medical website:

SMB enumeration revealed that this website might be running a vulnerable version of OpenEMR, and there are quite a few RCE exploits for OpenEMR.

However, most of these require credentials. I scanned the website for potential directories to other services, and found a File Manager using gobuster:

When we visit /filemanager, we can see that it is running Responsive FileManager:

There are a few exploits related to this:

The LFI works!

SQL Creds -> RCE

Since we have LFI, we can try reading the SQL credentials that are present within OpenEMR (based on reading the OpenEMR Github repository).

Logoopenemr/sites/default/sqlconf.php at master · openemr/openemrGitHub

There was something blocking us from reading PHP files here, and its probably the .htaccess file. Within the FileManager instance, I noticed that the same PDFs on SMB were present within it.

The LFI exploit copies and pastes files into directories, and this means that we should be able to read the file from the SMB share. We just need to modify the paste_clipboard function within the exploit:

After changing the directories a few times, I got it within the SMB share:

Here's its contents:

Now we have some SQL creds, we can login to the database present.

We can then find the credentials for OpenEMR:

This hash can be cracked using john:

Afterwards, we can run the RCE exploit for OpenEMR:

Privilege Escalation

The root user has the same password as the MySQL database of thedoctor:

PreviousLinuxNextBadCorp

Last updated