search
Page cover

Oh My Webserver (CVE-2021-41773, Capabilities, Docker, CVE-2021-38647)

First, we need to scan using rustscan.

╭─hnl@hnl ~/Desktop/ctf/tryhackme/ohmyweb  
╰─➤  rustscan -a 10.10.80.91 -- -A | tee rust.log                                                                             130 ↵
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢

[~] The config file is expected to be at "/home/hnl/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.10.80.91:22
Open 10.10.80.91:80
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-03 19:33 +0630
Nmap scan report for 10.10.80.91
Host is up, received syn-ack (0.24s latency).
Scanned at 2022-04-03 19:33:45 +0630 for 17s

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    syn-ack Apache httpd 2.4.49 ((Unix))
|_http-favicon: Unknown favicon MD5: 02FD5D10B62C7BC5AD03F8B0F105323C
| http-methods: 
|   Supported Methods: HEAD GET POST OPTIONS TRACE
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.49 (Unix)
|_http-title: Consult - Business Consultancy Agency Template | Home
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.46 seconds

SSH and HTTP ports are open. Let's enumerate HTTP port first. Whatever we click, this webpage only resturn index page. So, we will run gobuster to scan directory of the website.

The scanning stage is too long, so we will search exploit using this apache version. Luckily, we found this exploit https://www.exploit-db.com/exploits/50383.

Let's reverse shell to my host machine.

In netcat session, we got reverse shell.

We are in docker container but we have permission to list root directory.

Let's execute linpea to enumerate vulnerable system configuration.

And we found vulnerable liux capabilities.

Exploit this vulnerable linux capabilities.

After exploit this capabilites, go to the root directory and read the user flag.

We see our ip is 172.17.0.2. Docker host machine ip will be 172.17.0.1.

Use this script to scan the host ip. We used bash one liner script or others. It is not ok. So, we will download static nmap binary from this source https://github.com/andrew-d/static-binaries/tree/master/binaries/linux/x86_64

Port 5985 5986 is WinRM. Let's search exploit for this. This is POC https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure/. Here is exploit code https://github.com/AlteredSecurity/CVE-2021-38647

Here is output for this exploit.

Let's get reverse shell.

In netcat session, we got reverse shell.

PreviousFlatline (FreeSwitch, OpenClinic)NextPlotted-TMS (FileUpload, Cronjob, Openssl)

Last updated