UC404

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.202.109
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-06 21:34 +08
Nmap scan report for 192.168.202.109
Host is up (0.17s latency).
Not shown: 65527 closed tcp ports (conn-refused)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
111/tcp   open  rpcbind
2049/tcp  open  nfs
41473/tcp open  unknown
45259/tcp open  unknown
49415/tcp open  unknown
54505/tcp open  unknown

NFS is open, which might have stuff we can mount on.

Rabbit Holes

NFS had nothing:

Port 80 shows some dashboard that looks static:

A detailed nmap scan reveals that there's a .git repository present:

However, there's nothing interesting within it.

Web Enumeration -> Cmd Injection

I ran a gobuster scan on port 80 and found one interesting directory:

The under_construction part looked the most promising. It just brought us to a login page:

Default credentials don't work with this one. I was a bit stuck here, but eventually decided to check the page source of all pages. There was this interesting bit within the source for the 'Forgot Password' page:

Blacklisting some characters means that there is a potential injection point here. I was curious about that '1' and what it was reflecting. I tested this a bit by sending POST requests, but it didn't really work.

I thought for a while, and decided to change it to GET requests instead of POST, and it actually worked!

We can get a reverse shell by sending this request:

Super CTF-ish initial access. We can read the source code to see how it works:

Privilege Escalation

Brian Creds

I ran a linpeas.sh scan to enumerate for me. It picked up on this:

We can read it to find more credentials:

We can then su to brian:

Sudo Git

Since we had the password, we can check sudo privileges:

We can follow GTFOBins to get a root shell:

Rooted!

PreviousTwiggyNextVoIP

Last updated