Headless
Recon
Let's start with a simple nmap scan.
We have two ports 22 and 5000. 5000 seems like a webpage let's try visiting it.
We have a webpage. Let do some enumeration on this now.
Feroxbuster revealed two directories /dashboard and /support.
Initial Access
We are not able to visit /dashboard, however /support reveals a web-form. Let's try some payloads here.
Interesting. We now know that it is being detected. Let us try the same with burp suite and a python server to check if the payload is trying to fetch something.
After some trial and error. Adding the payload in place of User-Agent worked.
It worked and we now have and admin cookie. We should be able to use that to access the /dashboard page.
The dashboard seems to generate a report for a specified date. It takes input lets see if we can get a reverse shell this way.If we attempt to intercept the packet and establish a connection directly with our machine, we won't obtain a correct response.
What occurs if we curl our local machine and execute the retrieved content using bash?
Let's add the above payload into a file called shell.sh.
We set up a python server so the file can be accessed and a net cat listner so we can capture the shell.
Then we add the below payload after the date variable in Burp Suite.
We have our reverse shell and should get the user flag.
Privilege Escalation
Lets see what we are able to do as sudo.
We can see that dvir user has permission to execute /usr/bin/syscheck binary as the root user. Let’s see the contents of this binary using the cat command.
We will find that there is a bash script (initdb.sh) that gets executed without specifying its full path. We can simply exploit this vulnerability by creating a malicious bash script with the same name. We need to run the following commands to achieve the same:
When we execute the syscheck binary, then our malicious script will be executed as it is in our current directory. This script will assign the root user’s SUID bit to the /bin/bash file. Let’s see this in action by running the following command:
After running the above command, we need to execute the /bin/bash with the privileges of the owner (root). We can do this with the help of the following command:
We are now root. We can get our root flag now.
Last updated
Was this helpful?