Sona
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 4000 -Pn 192.168.240.159
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-07 11:22 +08
Nmap scan report for 192.168.240.159
Host is up (0.17s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT STATE SERVICE
23/tcp open telnet
8081/tcp open blackice-icecapTelnet Creds -> Nexus RCE
Port 8081 was hosting a vulnerable version of Nexus Repository Manager:
This version has RCE exploits, but we need credentials.
Weak credentials like admin:admin or nexus:nexus didn't work. In this case, let's check out out Telnet on port 23.
We can somehow recover the password from this. We can interact with this application a bit:
I wasn't sure how to get this, so let's use the ANSONE and ANSTWO options to check our options. I made a list of colours and zodiac signs:
Afterwards, we can create a Python script to brute force out the answer based on this.
This would slowly brute force the first answer, which is black:
Now we can do the same for the zodiac signs and ANSTWO.
So the correct answers are 'black' and 'leo'. We can create a wordlist with these words, which is just:
blackleo is the correct password:
Using this, we can run the exploit with these parameters:
I had a lot of trouble getting a shell on this machine for some reason. Eventually, I just decided to use msfconsole to exploit this.
Privilege Escalation
Cronjob -> Python Module Hijack
I ran a linpeas.sh scan on the machine and found an interesting permission set:
We can write to base64.py, which is the module being used here. I ran pspy64 as well to see if this file was being executed in anyway.
This file was being run every minute:
Within the /tmp directory, there was a log.crypt file that contained a huge base64 encoded file:
The file was also owned by root, meaning that this likely being generated by the logcrypt cronjob. I just echoed in import os;os.system("chmod u+s /bin/bash") within the base64.py file and it worked!
Last updated