PIT

Scanning

NMAP

  • TCP

➜  ~ nmap -T4 -p- -A pit.htb
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-18 12:10 EDT
Nmap scan report for pit.htb (10.10.10.241)
Host is up (0.21s latency).
Not shown: 65532 filtered ports
PORT     STATE SERVICE         VERSION
22/tcp   open  ssh             OpenSSH 8.0 (protocol 2.0)
| ssh-hostkey: 
|   3072 6f:c3:40:8f:69:50:69:5a:57:d7:9c:4e:7b:1b:94:96 (RSA)
|   256 c2:6f:f8:ab:a1:20:83:d1:60:ab:cf:63:2d:c8:65:b7 (ECDSA)
|_  256 6b:65:6c:a6:92:e5:cc:76:17:5a:2f:9a:e7:50:c3:50 (ED25519)
80/tcp   open  http            nginx 1.14.1
|_http-title: Test Page for the Nginx HTTP Server on Red Hat Enterprise Linux
9090/tcp open  ssl/zeus-admin?
| fingerprint-strings: 
|   GetRequest, HTTPOptions: 
|     HTTP/1.1 400 Bad request
|     Content-Type: text/html; charset=utf8
|     Transfer-Encoding: chunked
|     X-DNS-Prefetch-Control: off
|     Referrer-Policy: no-referrer
|     X-Content-Type-Options: nosniff
|     Cross-Origin-Resource-Policy: same-origin
|     <!DOCTYPE html>
|     <html>
|     <head>
|     <title>
|     request
|     </title>
|     <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
|     <meta name="viewport" content="width=device-width, initial-scale=1.0">
|     <style>
|     body {
|     margin: 0;
|     font-family: "RedHatDisplay", "Open Sans", Helvetica, Arial, sans-serif;
|     font-size: 12px;
|     line-height: 1.66666667;
|     color: #333333;
|     background-color: #f5f5f5;
|     border: 0;
|     vertical-align: middle;
|     font-weight: 300;
|_    margin: 0 0 10p
| ssl-cert: Subject: commonName=dms-pit.htb/organizationName=4cd9329523184b0ea52ba0d20a1a6f92/countryName=US
| Subject Alternative Name: DNS:dms-pit.htb, DNS:localhost, IP Address:127.0.0.1
| Not valid before: 2020-04-16T23:29:12
|_Not valid after:  2030-06-04T16:09:12
|_ssl-date: TLS randomness does not represent time

add dms-pit.htb to hosts file

  • UPD

    after a while i realize no way to start attack on TCP ports so go for UPD scan

161/udp open|filtered snmp it the way

Enumeration

cat 10.10.10.241.snmp

We find this directory /seeddms51x/seeddms

i tried some default credentials but nothing ...

back to SNMP file searching for Credintials

after some tries credentials michelle:michelle

Exploit

now we know the version of DMS seedDMS 5.1.15

exploit

create backdoor

in this directory DMS /Docs /Users /Michelle /

upload shell.php as 1.php step 3

documentid=30 check yours ...

step 4

http://dms-pit.htb/seeddms51x/data/1048576/30/1.php?cmd=cat%20/etc/passwd

shadow not accessible

reverse shell not working

i tried Path Traversal to access DB credentials it work

http://dms-pit.htb/seeddms51x/data/1048576/30/1.php?cmd=cat%20../../../conf/settings.xml

inspect this page

search username

lets use this credentials to login main App

after some tries Credentials michelle:ied^ieY6xoquu

WE IIIIIIIIIIIIIIIIIN 🎉

and Terminal tap calls us

Privilege Escalation

from snmp enum we find this

can't access this dir

lets check permission on this dir

michelle -wx we can write and execute

Lets create a SSH payload with out public key and put it into the /usr/local/monitoring directory

on attacker machine

after creating the key place it in this payload and save

save as check.sh

start local server

this line to execute script check this

PreviousDYNSTRNextSEAL

Last updated