Billing (THM)
Some mistakes can be costly.
Intro
Welcome everyone today we have a fresh try hack me machine let's jump right into it.
Enumeration.
Port scanning.
There are few interesting services running we see mysql and asterisk.
asterisk is a services that help you to manage the Voice Over IP communication.
First let's check the website.
Here we have simple login page. Tried some default creds but nothing works, after some more enumeration i decided to check the name that shows in the nmap scan and look it up. MagnusBilling then i found this.
Shell as asterisk
So MagnusBilling is a helper for the asterisk and it has the GUI we seen just now the login. Search on know exploits we can find one.
I tested that and it actual works.
Shell as root.
So after i got into the machine i check the sudo premissions and found this.
i have tested this but i do now find anything at first i check some files there was some sql creds we can find it here.
And also nothing was there. I also found a CPUS running i tried and test it but also nothing were there.
Until i read more about the fail2ban-client tool so how it work is that we can set custom command to run upon some conditions. For example if some user brute-force our ssh service we can set a custom rule or script to run when it detect brute-forcing.
To set up these rule and get root shell we can do as follows.
So this command basiclly tells fail2ban to set role or action on the sshd demon called pwned.
and this command here allow for us to set pwned action as we want and as we can see here we adding suid bit to the bash file which will allow us to execute bash with premissions of its owner which is root. To trigger this action we can simple bruteforce the ssh service using hydra.
With that we wait for few seconds and check the permissions of the bash.
But wait if we just run bash now we gonna get same as our user right ?.
Yeah that actually a Linux thing which drop the permissions of security reasons to avoid that we can just add -p to the command.
Conclusion.
In the end this machine was simple and fun i have learned about fail2ban which a completely new tool on me so we can get out the machine with something new.
Last updated
