$ nmap -p- --min-rate 3000 192.168.183.134
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-11 22:46 +08
Nmap scan report for 192.168.183.134
Host is up (0.18s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
13337/tcp open unknown
This box likely has some API exploitation, so we can start proxying traffic through Burp.
API -> RCE
Port 13337 shows some basic documentation for an API:
The most interesting was the /update endpoint, which accepted a user-controlled URL and says it updates the application via a 'Linux Executable'. This might be vulnerable to RCE if we can chain commands to the end of the URL.
But we didn't have a username yet. There's also a /logs endpoint:
Attempting to visit it results in a WAF blocking us:
$ curl http://192.168.183.134:13337/logs
WAF: Access Denied for this Host.
Since the application mentioned that this is meant to be open to localhost only, we can try appending the X-Forwarded-For header.
$ curl http://192.168.183.134:13337/logs -H 'X-Forwarded-For: localhost'
Error! No file specified. Use file=/path/to/log/file to access log files.
There's a clumsyadmin user present, and this might be the user we need. Then, we can use the /update endpoint to send requests to our HTTP server:
Since our parameters was being passed to a 'Linux Executable', I assumed that the URL parameter was not being properly sanitised (and is probably using wget or something).
