search

Exghost

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 -Pn 192.168.183.183
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-11 20:36 +08
Nmap scan report for 192.168.183.183
Host is up (0.18s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT   STATE  SERVICE
21/tcp open   ftp
80/tcp open   http

FTP and HTTP.

hashtag
Port 80 Dead End

Port 80 just shows a 403 page:

Running directory scans only shows one directory:

hashtag
FTP Brute Force -> Wireshark

Anonymous credentials don't work with this FTP system, and because we had no other choice, I started brute forcing the FTP login with hydra. This took quite a while, but eventually I found some credentials:

Great! Now we can login and view the files present:

The backup file was a PCAP file:

We can open this up in wireshark and view the TCP streams. Within TCP Stream 1, we can find this HTTP request:

Seems that we are able to upload files through POST requests at exiftest.php:

From the PCAP file, we can actually export the exiftest.php file:

Interestingly the second exiftest.php was the response, and here's the contents:

hashtag
File Upload -> Exiftool RCE

It appears that the website is accepting images, and then running exiftool on it as a response. This version of exiftool is vulnerable to an RCE exploit.

LogoGitHub - OneSecCyber/JPEG_RCE: Exiftool bug which leads to RCEGitHubchevron-right

We can create the payload by following the PoC:

We can then upload it using this script:

After uploading it, we would get a shell as www-data:

hashtag
Privilege Escalation

hashtag
Sudo Exploit -> Root

I ran a linpeas.sh scan on the machine. This found that sudo was outdated:

LogoGitHub - joeammond/CVE-2021-4034: Python exploit code for CVE-2021-4034 (pwnkit)GitHubchevron-right

We can just download the Python script and execute it to get a root shell:

PreviousExfiltratedNextFail

Last updated