OpenAdmin
OpenAdmin is a easy Linux box that takes a look at CVE's, code review & Web Exploitation
Recon
we start off by scanning OpenAdmin's IP 10.10.10.171 with nmap
From our scan we get the following results
Checking the WebPage we get nothing, So lets move on to DirBusting it
With this we get the following Directories
Checking out the directory /music we find a login page that redirects to ona (OpenNetAdmin)
we can now check for a public exploit for this
We'll be using the OpenNetAdmin 18.1.1 - Remote Code Execution exploit
And we have shell, now we can upgrade to a full shell with
Exploit
Doing cat /etc/passwd lists the users on the system
After enumerating the box we come across a config ona/local/config/database_settings.inc.php that connects back to the db, and wouldn't you know it, it has some credentials
Using the credentials jimmy:n1nj4W4rri0R! let's see if we can get a ssh connection
and there we go! ssh
Going back and checking the /var/www/ folder we find that only we can access internal
So let's take a look at what we have in here. Straight out of the box we see that index.php has some credentials
Let's get our friend John to crack it, we see that its a SHA512 hash so lets do
and we get the password Revealed
Checking /var/www/internal/main.php we find that it outputs /home/joanna/.ssh/id_rsa so we should get to that.
Doing
Show's us we have port 52846 running locally, normally we'd plink to access it but let's take another approach today
we can use
To login to the page, get the session ID and then use it to display main.php. from this we get
Great let's crack this SSH key
And we have another set of credentials now joanna:bloodninjas
Post Exploitation
Now as joanna we can try and escalate our priveleges, lets check out if we can do anything we sudo -l and yes we can
we can run nano on the file /opt/priv as sudo! sounds like we can bypass this with https://gtfobins.github.io/gtfobins/nano/
so lets run
And we have Root!
Useful Links
Last updated