search

Chatty

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 1000 192.168.183.164
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-11 21:32 +08
Warning: 192.168.183.164 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.183.164
Host is up (0.17s latency).
Not shown: 65500 closed tcp ports (conn-refused), 33 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
3000/tcp open  ppp

hashtag
Rocket Chat -> Admin Takeover

Port 3000 hosted an instance of Rocket Chat:

We can enumerate the version by visiting the /api/info page:

This version of Rocket Chat is vulnerable to a NoSQL Injection exploit:

I registered a new account and found the administrator profile of this instance:

We can use 50108.py to exploit this. Since we created our own low priv user, we can comment the part of the script that resets the low priv user's password:

Then, we also need to change the password of the low priv user to the one that we used.

After running the exploit, we would be given RCE access, and getting a reverse shell is pretty simple:

hashtag
Privilege Escalation

hashtag
SUID Binary -> MaiDag CVE

I searched for SUID binaries within the system, and found one that stood out:

I didn't recognise maidag, and so enumerated it first.

Googling the binary and its version returns a Local Privilege Escalation exploit:

LogoGNU Mailutils 3.7 - Privilege EscalationExploit Databasechevron-right

There are online exploits on Github to make this process as easy as possible:

Logolocal-exploits/CVE-2019-18862 at master · bcoles/local-exploitsGitHubchevron-right

I used exploit.ldpreload.sh and ran it on the machine. This would spawn a binary sh within /var/tmp that would give us a root shell.

Rooted!

PreviousCharlotteNextClamAV

Last updated