XposedAPI

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 192.168.183.134
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-11 22:46 +08
Nmap scan report for 192.168.183.134
Host is up (0.18s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT      STATE SERVICE
22/tcp    open  ssh
13337/tcp open  unknown

This box likely has some API exploitation, so we can start proxying traffic through Burp.

API -> RCE

Port 13337 shows some basic documentation for an API:

The most interesting was the /update endpoint, which accepted a user-controlled URL and says it updates the application via a 'Linux Executable'. This might be vulnerable to RCE if we can chain commands to the end of the URL.

But we didn't have a username yet. There's also a /logs endpoint:

Attempting to visit it results in a WAF blocking us:

Since the application mentioned that this is meant to be open to localhost only, we can try appending the X-Forwarded-For header.

This looks vulnerable to LFI, and it works!

There's a clumsyadmin user present, and this might be the user we need. Then, we can use the /update endpoint to send requests to our HTTP server:

Since our parameters was being passed to a 'Linux Executable', I assumed that the URL parameter was not being properly sanitised (and is probably using wget or something).

To test, I sent this JSON data:

This confirms we have RCE. We can get a reverse shell via this JSON object:

Privilege Escalation

Wget SUID Binary

I searched for SUID binaries on the machine, and found that wget was one of them:

Using this, we can get a root shell:

PreviousWheelsNextZenPhoto

Last updated