PlanetExpress

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 -Pn 192.168.183.205
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-09 22:27 +08
Nmap scan report for 192.168.183.205
Host is up (0.17s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
9000/tcp open  cslistener

Nmap done: 1 IP address (1 host up) scanned in 35.83 seconds

Did a detailed scan to enumerate port 80 and 9000 further:

$ sudo nmap -p 80,9000 -sC -sV -O --min-rate 4000 -Pn 192.168.183.205
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-09 22:31 +08
80/tcp   open  http        Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-generator: Pico CMS
|_http-title: PlanetExpress - Coming Soon !
9000/tcp open  cslistener?

Port 8000 was running Pico CMS, which does have some exploits.

Web Enum -> PHPInfo

Port 80 had a countdown:

There isn't much on this page, so we can do a gobuster directory scan with the PHP extension since PicoCMS was being used:

Using the PicoCMS Github repository, we can view more about these directories.

LogoGitHub - picocms/Pico: Pico is a stupidly simple, blazing fast, flat file CMS.GitHub

Viewing the config.yml file shows that this is indeed running PicoCMS:

There's also a custom plugin developed for this website, and we can visit that at plugins/PicoTest.php based on the Github repo. This would show us the PHPInfo of the site:

Here, we can find that /var/www/html/planetexpress is the document root. Also, we can find a lot of disabled functions:

FastCGI -> RCE

There wasn't much else on the webpage for us to test, however there was still port 9000. Googling it revealed that it was running FastCGI:

Logo9000 - Pentesting FastCGI - HackTricksbook.hacktricks.xyz

There are RCE exploits for this service here. The script given allows us to inject PHP code into the service to be run. However, there are a lot of functions that are disabled based on PicoTest.php. I checked the functions against all functions that are able to execute system commands via PHP, and passthru was not disabled.

Using passthru and the document root directory allows us to get RCE:

We can then get a reverse shell via the mkfifo one-liner.

Privilege Escalation

Relayd SUID -> Shadw Hash

I searched for SUID binaries and found one that stood out:

We can check the help menu for this :

The option that stood out the most to me was the -C flag, because it allows us to read from files. I attempted to read the /etc/shadow file:

This made the file readable by all. We can then grab the root hash:

We just need to put this hash and the entry for root in /etc/passwd into another file, then run unshadow to convert it to a crackable hash.

Then, we can crack it in john (or in my case, just show because I cracked it before):

We can then ssh in as root:

Rooted!

PreviousPostfishNextQuackerJack

Last updated