OpenAdmin #25
Nmap Result:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
| 256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_ 256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
dirsearch:
/music/
/ona/
openadmin.htb
Version: 18.1.1
Tried this exploit:
Got a shell with www-data!
ona_sys
n1nj4W4rri0R!
jimmy joanna were found during the enum.
got in as jimmy.
interesting.
Pass
00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1
Revealed
/etc/apache can be seen.
Port number 52846
Port forward it to the 52846.
ssh [email protected] -L 4545:localhost:52846
Now visit http://127.0.0.1:4545 (NEW) SO COOL!!!
Logging with the creds, I got Joanna's SSH key!
Cracked it with john.
bloodninjas
ssh -i id_rsa.bak [email protected]
Finally in Joanna!
/bin/nano /opt/priv
Now we are root.
Finding creds was the hardest part on this box!