Muddy

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.208.161           
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-21 16:04 +08
Warning: 192.168.208.161 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.208.161
Host is up (0.18s latency).
Not shown: 65245 closed tcp ports (conn-refused), 282 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
111/tcp  open  rpcbind
443/tcp  open  https
808/tcp  open  ccproxy-http
908/tcp  open  unknown
8888/tcp open  sun-answerbook

I did a detailed scan too:

$ nmap -p 80,443,808,908,8888 -sC -sV --min-rate 3000 192.168.208.161 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-21 16:29 +08
Nmap scan report for 192.168.208.161
Host is up (0.18s latency).

PORT     STATE  SERVICE      VERSION
80/tcp   open   http         Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Did not follow redirect to http://muddy.ugc/
443/tcp  closed https
808/tcp  closed ccproxy-http
908/tcp  closed unknown
8888/tcp open   http         WSGIServer 0.1 (Python 2.7.16)
|_http-title: Ladon Service Catalog

We can add muddy.ugc to our /etc/hosts file.

Web Enumeration -> LFI -> Dav Creds

Port 80 hosted a static looking site:

I did a directory scan for this and found some wordpress content, and a /webdav directory:

Visiting /webdav required credentials:

Weak credentials don't work, so let's come back to this later. Port 8888 hosted Ladon Service Catalog:

There are exploits for this:

Within the proof of concept code, there's a hint towards this box!

I verified that the exploit works:

Since we have LFI, we can locate the passwd.dav file to find the password required for /webdav. I found that it was within the /var/www/html/webdav file:

This hash can be cracked to give the password:

Afterwards, we can login to the /webdav instance:

Webdav Upload Shell

I tested whether we could upload files using davtest:

It works, so let's put a PHP web shell since we have Wordpress content on the page as well, indicating that PHP is being used.

We can then get a reverse shell easily:

Privilege Escalation

Cronjob -> PATH Hijack

I ran a linpeas.sh to enumerate possible escalation vectors, and it picked up on this:

The SYSTEM PATH variable has a writeable directory as its first directory, and the cronjob executed by root does not specify the full PATH for netstat and service. As such, we can just create a netstat script like so:

After waiting for a bit, we can become root:

Rooted!

PreviousMegavoltNextNappa

Last updated