search

QuackerJack

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 192.168.233.57 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-30 16:48 +08
Nmap scan report for 192.168.233.57
Host is up (0.17s latency).
Not shown: 65527 filtered tcp ports (no-response)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3306/tcp open  mysql
8081/tcp open  blackice-icecap

hashtag
FTP Anonymous Fail

The FTP service does allow anonymous logins, but it just hangs:

Nothing much there.

hashtag
SQL Injection -> RCE

Port 8081 was hosting an rConfig instance:

This version was vulnerable to a few exploits:

The bottom one just didn't work, while the top one requires credentials to work. There a few other exploits that I found online, such as an SQL Injection here:

LogorConfig 3.9 - 'searchColumn' SQL InjectionExploit Databasechevron-right

The above exploit was tested on Version 3.9.4, so it should work.

The above hash is crackable on CrackStation.

We can then run the RCE exploit 48241.py:

We can then grab the user flag.

hashtag
Privilege Escalation

hashtag
Find SUID -> Root Shell

We can enumerate for SUID binaries on this machine:

We can run find as the root user. Following GTFOBins, we just need to run this:

Rooted!

PreviousPlanetExpressNextReadys

Last updated