Cassios

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.208.116
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-21 14:41 +08
Nmap scan report for 192.168.208.116
Host is up (0.17s latency).
Not shown: 65530 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
8080/tcp open  http-proxy

SMB Enumeration

smbmap shows that we have one share we can read and write to:

$ smbmap -H 192.168.208.116                               
[+] IP: 192.168.208.116:445     Name: 192.168.208.116                                   
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        print$                                                  NO ACCESS       Printer Drivers
        Samantha Konstan                                        READ, WRITE     Backups and Recycler files
        IPC$                                                    NO ACCESS       IPC Service (Samba 4.10.4)

We cam connect to that via smbclient.

There are loads of files, including a .ser file within. I noticed that this was running a Java application, based on the spring file, which was a Java framework. The readme.txt included some interesting information:

.ser seems to be an important file. There was also mention of a 'dashboard app`, which was likely one of the web applications hosted on this.

Web Enumeration -> Web Creds

Port 80 hosted a corporate website:

I was rather static, so I did a gobuster scan on it using a few wordlists. Using common.txt reveals a hidden directory:

The /download endpoint just gives us the source code for this website, and it was static. The backup_migrate file was more interesting:

We can download and extract the files within this using tar -xvf:

Seems that we have source code. Before delving into this, let's check out port 8080, which hosted the dashboard mentioned in the readme.txt from SMB.

The WebSecurityConfig.java file contained credentials needed to access the dashboard:

Source Code -> Deserialisation RCE

There was some functionality for this, so let's read the source code to find how it checks status and saves the current values. The code for this can be found within DashboardController.java:

We can see that the recycler.ser file is being used for both functions, where /save writes to it using the current values on screen, and /check reads from it. The thing that stood out was the readObject() function being used to read from recycler.ser, which could potentially allow for Deserialisation attacks.

LogoPage not found - HackTricksbook.hacktricks.xyz

First we need to check if its vulnerable by searching all the SMB and Recycler files for mention of commons-collections.

commons-collections4 was being used! Next, I checked to see if we could overwrite recycler.ser within the SMB directory.

Based on the timestamp, this worked. So now, we need to create our serialised payload using ysoserial.

You must use Java 8 to make it work. The latest versions of Java cannot run ysoserial.jar properly.

This would generate a serialised object that we can use. Afterwards, place this within the share and click on Check Status on the website to get a reverse shell:

Privilege Escalation

Sudoedit Double Wildcard -> Arbitrary Write

I checked our sudo privileges, and saw this:

We can abuse this by creating a symlink to the /etc/passwd file named as recycler.ser and add a new root user to it using this line:

Run the following commands:

This would bring up the /etc/passwd file, where we can add the new hacker user and use :wq to save the changes made. Then, su to hacker with hello123 as the password:

Rooted!

PreviousBunyIPNextCatto

Last updated