Nukem

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 192.168.183.105
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 18:50 +08
Nmap scan report for 192.168.183.105
Host is up (0.17s latency).
Not shown: 65529 filtered tcp ports (no-response)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
3306/tcp  open  mysql
5000/tcp  open  upnp
13000/tcp open  unknown
36445/tcp open  unknown

RDP is open. Ran a detailed scan as well:

$ sudo nmap -p 80,5000,13000 -sC -sV --min-rate 3000 192.168.183.105
[sudo] password for kali: 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 18:53 +08
Nmap scan report for 192.168.183.105
Host is up (0.18s latency).

PORT      STATE SERVICE VERSION
80/tcp    open  http    Apache httpd 2.4.46 ((Unix) PHP/7.4.10)
|_http-server-header: Apache/2.4.46 (Unix) PHP/7.4.10
|_http-title: Retro Gamming – Just another WordPress site
|_http-generator: WordPress 5.5.1
5000/tcp  open  http    Werkzeug httpd 1.0.1 (Python 3.8.5)
|_http-title: 404 Not Found
13000/tcp open  http    nginx 1.18.0
|_http-server-header: nginx/1.18.0
|_http-title: Login V14

First thing I took note of was the outdated Wordpress site on port 80.

Wordpress -> RCE

I ran a wpscan on the port 80 application.

There were loads of vulnerabilities, but the one that looked the easiest to exploit was the Simple File List RCE:

Unauthenticated = good in this case. searchsploit shows that there are 2 exploits publicly available:

I found that the first one worked better. Within the exploit, I also changed the payload to drop a webshell instead:

We can then run the exploit and confirm that it works:

Tested loads of ports, and only reverse shells to port 80 work:

Privilege Escalation

Commander Creds

The /srv/html/wp-config.php file contained some creds for the user commander:

VNC + Dosbox SUID

I checked the SUID binaries available and found dosbox was one of them.

dosbox SUID privilege escalation exploits require a GUI to work, and conveniently, VNC on port 5901 is available on the machine:

Also, within the user's directory, there's a .vnc file which presumably contains credentials we need:

We can transfer the small passwd file over to our machine via base64 encoding. Then, we can port forward VNC via chisel. Using vncviewer, we can connect to it:

Within the terminal we can run this:

This would spawn a dosbox instance (which is basically a cmd.exe instance). Using the C: command, we can view the root flag:

There's no scrolling on this Dosbox instance, and the handling of control characters is a little inaccurate (so you can't really backspace). Other than that, we have root access over the file system and can do whatever we want.

Rooted!

PreviousNappaNextPayday

Last updated