EvilCPUs (HTB)
We are unbreakable
Intro.
Hello my fello friends it been a while since i post something but today we have a reitred HTB machine so we can have some fun here too SHALL WE !?.
Enumeration.
So from this results we can see an uncomment port which is 631 let's see what it has.
Enumerate port 631.
So a quich search we can find that this port is an ( Internet Printing Protocol) which am not so familiar with it.
Getting shell.
So after a lot of search i found that the version of CUPs if vuln to a chain of attacks which results in RCE.
Thanks to these guys we are able to understand and exploit the vulnerable service and give a remote code execution.
Running this command will advertises an evil printer which going to be added to our printers in the website.
so pressing on this printer and test it our command will be executed.
and by then we should revive a connection from the machine.
Stable shell.
i face a problem where it would kill the shell in some period of time to solve this we can use nohub command and & as follow.
getting root.
so once we are in the machine we can see that the folder /var/spool/cpus which has the available printers, does not allow us to list so what we can do. after some search i found that we maybe able to guess the name of a cached job and read its content so what is the format of the cached jobs.
so from my understanding i think it refers to print number as a printer number and page is how many page it prints so let's test this.
and after some tries i get it.
am not sure if this was luck or it just the how it should be. but how care we get it. And in the file we would also see the password for the root user.
using this password are able to login as root.
Conclusion.
Last updated
