OpenAdmin HTB Writeup
User.txt
From port scanning two ports are open 80
and 22
. I brute force the root directory / using gobuster and find out /ona/ visiting this /ona/ I see it is openadmin. I search using searchsploit
and found out a shell script which gives me rce. Using dos2unix
I convert this script to unix format to prevent errors. Using the script I can run commands. I use wget and download a php reverse shell to the box. Then I run the script using php, and get a interactive shell. I look for configuration file to find possible passwords. After a little I find one at /var/www/ona/local and then use that password to su as jimmy(found on /etc/passwd). As jimmy user I can list all files inside internal folder because it’s owned by jimmy. I find some php files there. index.php
, main.php
and logout.php
. Inside index.php
a function checks if the user is jimmy
and the password is same as a sha512sum of the password we give and if succeded we get ssh private key for joanna user. I see if I can find the password on hashes.org and I found it to be Revealed
. Now all I need is to access the website from my machine and then submit it. I run netstat -alnp
and see that the site is on port 52846
. I create a ssh key pair on my machine and then transfer the public key to .ssh/authorized_keys and ssh into the box. then using ENTER and ~C and then enter -L 9001:localhost:52846
. Now on my host I visit http://localhost:52846 and using the form I submit the credentials and after I receive the ssh private key. I use ssh2john and rockyou.txt as wordlist, I crack the private key using john. Using the private key and the password I can now ssh as joanna, and get user.txt.
root.txt
I type sudo -l
and find out that I can run /bin/nano /opt/priv
on gtfo bins I found how I can get a shell from when I am inside nano. I run sudo -u root /bin/nano /opt/priv
and then use
1 |
|
Now I am root.!