search

Privesc

id command tells are we are part of the adm arrow-up-rightgroup!

uid=1004(webdev) gid=1004(webdev) groups=1004(webdev),4(adm)

So we can read logs using aureport which produces a summary of audit logs.

webdev@dmz01:/var/www/html/monitoring$ aureport --tty | less
Error opening config file (Permission denied)
NOTE - using built-in logs: /var/log/audit/audit.log
WARNING: terminal is not fully functional
-  (press RETURN)
TTY Report
===============================================
# date time event auid term sess comm data
===============================================
1. 06/01/22 07:12:53 349 1004 ? 4 sh "bash",<nl>
2. 06/01/22 07:13:14 350 1004 ? 4 su "ILFreightnixadm!",<nl>
3. 06/01/22 07:13:16 355 1004 ? 4 sh "sudo su srvadm",<nl>
4. 06/01/22 07:13:28 356 1004 ? 4 sudo "ILFreightnixadm!"
5. 06/01/22 07:13:28 360 1004 ? 4 sudo <nl>
6. 06/01/22 07:13:28 361 1004 ? 4 sh "exit",<nl>
7. 06/01/22 07:13:36 364 1004 ? 4 bash "su srvadm",<ret>,"exit",<ret>
8. 06/01/22 07:13:36 365 1004 ? 4 sh "exit",<nl>

We get credentials for a user srvadm. We switch user to srvadm:

Typing this will return the shell

Our nmap scan showed we have SSH open (doesnt happen irl, SSH open externally). We can connect using that for a more stable connection.

I did sudo -l and openssl can be run with sudo. As per GTFObin we cannot elevate our shells (thats what happened to me when I tried) and the SUID bit for this binary was not set. So no luck.

But what we can do is read filesarrow-up-right with openssl with elevated privilege. Which means reading SSH private keys of the root user!

I saved it in a file and did chmod of course.

And we are root.

PreviousFootholdNextPivoting

Last updated