ZenPhoto

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 192.168.175.41 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-01 20:19 +08
Nmap scan report for 192.168.175.41
Host is up (0.17s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
23/tcp   open  telnet
80/tcp   open  http
3306/tcp open  mysql

Of all things, Telnet is open.

Web Enum -> ZenPhoto RCE

Port 80 just shows this:

A gobuster scan reveals the following directories:

Visiting /test reveals a ZenPhoto instance:

Viewing the page source reveals the version of ZenPhoto that is running:

There are RCE exploits available for this instance:

This exploits works in getting me a webshell:

We can get a reverse shell using this one-liner:

Privilege Escalation

Kernel Exploit -> Root

This machine was running on a really old Linux kernel version:

There are quite a few exploits that might work for this version of Linux running. I used this one:

LogoLinux Kernel 2.6.37 (RedHat / Ubuntu 10.04) - 'Full-Nelson.c' Local Privilege EscalationExploit Database

Compile it on the machine itself using gcc exploit.c -o exploit. Then, run it to get a root shell:

Rooted!

PreviousXposedAPINextZino

Last updated