search

Solid State

hashtag
Overview

Initial Foothold : Default creds in James Remote Admin

Privilege Escalation : Misconfiguration of permissions

hashtag
Enumeration

hashtag
Port Scanning

Start with full nmap port scanning

Haven't Got much information on webserver

There was interesting port which is port 4555 where JAMES Remote Admin 2.3.2 was running i.e. mail server was running

Lets try to access this using telnet

Try to use default username root and password root to login and we successed to login

Lets list users running on this mail server using listusers command

Got some users

We can reset there password using setpassword command

you can find this information using help command

Lets reset all the users passwords

Now lets access pop3 mail server on port 110

POP3 contains mail which the users have recieved by them from others

Use the username and password which got from above

LIST the mail avaiable to this user using LIST command

James have no mails available

Try mindy account and see what we can find

Retrive 2 mail using RETR command

And got the ssh creds of the mindy user

hashtag
Summary

Got SSH creds of mindy user in mailbox of mindy

hashtag
Exploitation

Lets login as mindy using creds

mindy : P@55W0rd1!2@

Got the shell but it was restricted you can see from rbash text

Lets try to bpass this restricted shell

There is a good post on this

LogoMultiple Methods to Bypass Restricted ShellHacking Articleschevron-right

Now we will use ssh to bypass the rbash shell

Only add -t "bash --noprofile" to bypass the rbash shell using ssh

Got the shell without any restriction

hashtag
Privilege Escalation

Find out files which are writable by our user using find command

There we saw a odd file named tmp.py in /opt folder

lets see its content and permissions

Observe the content of the file

This script was removing the files from /tmp/ folder and also this script was running with root permission

Also the user has write access

so we can add our malicious in this script and when it will execute as root user we will get root shell

Here we added reverse shell code in this script and start listener on port 1234

Got the root shell

That's all for this box

Good Bye :)

PreviousIrkedNextCronos

Last updated