Pretty fun and quick box with some creative thinking required for getting the initial shell.
Browsing to port 80 we see that we have a simple website showing a credit monitoring site. But there’s nothing of much interest really. Let’s fire up gobuster to see what else there is.
Right off the bat the Welcome.action looks suspicious. Actions are used in conjuction with the Struts framework. Unless you’ve been living under a rock then you should know of the Equifax breach that occured due to a Struts vulnerability. And since our box here does credit monitoring, it seems too much of a coincidence to not be our target.
Using struts-pwn we can quickly test our target.
[!] ChunkedEncodingError Error: Making another request to the url.
Refer to: https://github.com/mazen160/struts-pwn/issues/8 for help.
Excellent! However attempting to send a reverse shell fails, most likely due to firewall settings. We’ll need to be more creative here. After much enumeration we find a db_connect file in /var/lib/tomcat8.
This gives us two username and passwords to try to connect to the database with. We also see that MySQL is running on the box.
Now, we aren’t able to get a mysql shell prompt directly but instead what we can do is try to dump the databases using mysqldump. After testing, the ssn_admin creds prove useless, however admin works just fine.
We get an error that says “access denied when using LOCK TABLES”, to work around this we can simply use the --single-transaction switch on our command.
We have Richard’s password! Now to verify his account name.
It is simply richard, let’s SSH in.
Checking richard’s sudo permissions we can see he’s able to execute a specific python file located in his home directory.
You may be tempted to run this and start solving hashes, however this is a red herring. Take a look at the top of the python file and you can see it’s importing hashlib.
Due to the way python works when using import, we can simply create a hashlib.py file with code to execute upon it’s import when running test.py.
The root flag is ours!