Wheels

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.157.202
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-14 11:18 +08
Nmap scan report for 192.168.157.202
Host is up (0.17s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

We can proxy traffic through Burpsuite.

Web Enum -> XPath Injection

The website is for a car repair service:

There's an employee portal and a register page. When I try to register a user and access the portal, we are denied access. I tried to brute force the admin credentials, but they don't work.

At the bottom of the page, we can find an email:

I tried to register an administrator user with this email, and it worked in showing us the Employee Portal.

If we submit a query, we are returned information in this manner:

I tried to append a ' character to the query, and received an XML error:

We can try XPath injection since it seems to load xpath(). I tested all forms of XPath Injection and tried to dump passwords, and eventually this payload worked:

I also found some users when testing payloads:

The first password works for bob:

Privilege Escalation

SUID Binary -> Arbitrary Read

I searched for SUID binaries and the first result stood out:

I used ltrace to see what calls were being made.

It uses seems that our string is directly passed into a cat command. There's also a check for special characters before executing. This doesn't protect against subshells using $(), and it only checks for whether customers or employees are substrings within the string we submit.

This is easily exploitable for a root shell:

PreviousWallaNextXposedAPI

Last updated