filebrowser
Nmap Scan
The finger print for port 8080 was too long and no interesting details there for now
Foothold
I start looking at port 8080 HTTP
here I tried some trivial credentials, before anything else, like colons “ ‘ “ for sql injection which did not work but admin:admin worked and I was logged in
Ow Waww, Already have access to local.txt flag and .ssh directory.
I download both, then I will skip the flag for now (I prefer dumping flags once I have shell on system) then if ind the username and hostname checking id_rsa.pub
I added the host to my /etc/hosts then tryied connecting with id_rsa file but that did not work, it still asked me for the password
makes sens since that would have been too easy even to enjoy the machine!
Looking back at the authenticated web page I can identify the “file browser” version
even with that searchsploit did not return any existing exploits, so before I start searching google for any, I always check the settings/config pages if they exist on an authenticated web service and there I notice something very interesting
I can run shell commands from the web service.
Get dj4m’s stories in your inbox
Join Medium for free to get updates from this writer.
Tried to run “id” just to find the output was not reflected so if this is actually running it would be blind RCE by design, to confirm the command is running I start a python http.server as a web hook and use curl command to fetch my web service, if this works, I can be certain that the command is running on the target.
testing different ways to run curl did not work, so I get backk to checking the features of the web service and notice this
digging further I was able to find how to add allowed command to my user
then at the bottom of the page I added the commands I need to get a rev shell
now I confirm the commands do run here
Initial Access
Now that I can run the commands that I allowed on the web interface I just start w rev shell and catch it with my listener and was able to get local.txt flag from the shell session this time
Privilege Escalation
Checking the SUID executable on the system I found “aa-exec” so like always I check if that is listed on GTFObins
the SUID exploit was there so I just run it and i was already root on the target with access to proof.txt flag
