Bizness

image

Recon

port scan

directory scan

  • directory scan reveals /control

  • upon visiting we get a apache ofbiz page, with some error.

Initial foothold

  • After googling, I found that the server is vulnerable to CVE-2023-51467

  • read more : https://nvd.nist.gov/vuln/detail/CVE-2023-51467

  • github poc : https://github.com/jakabakos/Apache-OFBiz-Authentication-Bypass

User shell

  • Running the script we get a user shell

Stabalizing shell

  • I made .ssh keys inside $HOME directory to get a stablize shell

now simply ssh

Root shell

  • so i tried linpeas.sh, didn't found much info

  • found a rabbit hole for python capability

  • (asked for nudge)

  • they told to see how the app stores password

  • Next thing I did was to find db files, found derby directory, which is a database used in Apache

  • used grep to find password logs

  • if you read the program, you'll see it's using sha1 for hashing, searched for "sha"

  • program : https://github.com/apache/ofbiz/blob/trunk/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java

  • used strings on those .dat files

Hash

$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I

  • if you read the prgm, it's mentioned that the hash is url safe base encoded....

  • so uP0_QaVBpDWFeo8-dRzDqRwXQ2I urlsafe base64 deocde this

  • then hex it

  • salt is d (see the hash)

  • cyber chef url : https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9-_',true,false)To_Hex('None',0)&input=dVAwX1FhVkJwRFdGZW84LWRSekRxUndYUTJJ

  • add hash & salt in a file & give it to hashcat

  • hash:salt

Hash crack

rooted

__________________heapbytes's still pwning

PreviousHeadlessNextDevvortex

Last updated