Chemistry
Port scan
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-20 01:09 IST
Nmap scan report for 10.129.162.207 (10.129.162.207)
Host is up (0.29s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 b6:fc:20:ae:9d:1d:45:1d:0b:ce:d9:d0:20:f2:6f:dc (RSA)
| 256 f1:ae:1c:3e:1d:ea:55:44:6c:2f:f2:56:8d:62:3c:2b (ECDSA)
|_ 256 94:42:1b:78:f2:51:87:07:3e:97:26:c9:a2:5c:0a:26 (ED25519)
5000/tcp open upnp?
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200 OK
| Server: Werkzeug/3.0.3 Python/3.9.5
| Date: Sat, 19 Oct 2024 19:39:14 GMT
| Content-Type: text/html; charset=utf-8
| Content-Length: 719
| Vary: Cookie
| Connection: close
<< SNIP >>
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 128.44 seconds
Web (python eval - RCE)
We can register ourselves on the webpage.
http://10.129.162.207:5000/static/example.cif this URL downloads a simple example of CIF file.
Uploading that gives us a UI'd version of the above data
Recon
To know more about backend we can start looking at the headers, it's using python in the backend.
Now to know what service this is, we can goodle more about what's CIF files,
Now if we take any text from the example.ctf file _symmetry_space_group_name_H-M and google this, we can get the github repo of this open source project.
It's https://github.com/materialsproject/pymatgen Next thing we can do is google vulnerabilites of this project
POC : https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f
Following the POC, we can craft malicious CIF file and get RCE since it's using eval in the backend.
Malicious file
DONE, just update the payload and get a shell.
There's a database file in /home/app/instance called database.db
User - rosa
After taking it in our system we can view contents with sqlite3
3|rosa|63ed86ee9f624c7b14f1d4f43dc251a5 Lets crack rosa password, since it's a user on the box.
creds: rosa:unico <SNIP> sados
Root
we see there's another app running under port 8080
Server is aiohttp/3.9.1
Looking out for vulnerabilites, we can find this blog
Let's do portforwading and bring that web service to our local system
A static website not worth looking for, let's dive for LFI
POC
For a proper shell, we can try getting files under /root/.ssh/
GET /assets/../../../../../../../../../../../../../../../root/.ssh/id_rsa gives us the private key.
SHELL
________________________heapbytes' still pwning
Last updated