openadmin

nmap

http

there is a /artwork and /sierra directory but /music is the only webpage that has a login feature
images/1746-2.png

gobuster

/ona

following the login button on the /music page we see /ona which stands for opennetadmin
images/1747-1.png

gobuster 10.10.10.171/ona

initial foothold

searchsploit netopenadmin reveals there's a RCE exploit we can utilize to get a foothold

images/1735-1.png

we have a foothold but it is very limited, lets call back a reverse shell
images/1735-2.png

opennetadmin.sh script error & reddit post help

downloading the exploit straight from searchsploit may lead to this error:

images/1749-1.png

fix it by saving the raw code from exploit db to the file
images/1749-2.png

script fix

saving this raw code directly onto the box fixes the problem
images/1750-2.png

rev.php

we have remote code execution with our sh script, but it's limited and we cannot traverse the webserver, we'll have to call back a shell with more capabilities

images/1743-1.png

now set up an http server and download the php script to our victim:
images/1743-3.png

checking /var/www/ona we see our reverse shell is there, lets run it in our web browser
images/1743-5.png

Next navigate to our rev.php file on the box to call back our reverse shell
images/1743-6.png

user enumeration

looking at the home directory we see there are users jimmy and joanna

images/1752-1.png

priv esc to jimmy

doing some enumeration, we see there's a file database_settings.inc.php in the /ona/local/config directory that leaks some credentials
images/1734-1.png

we see we have a password stored n1nj4W4rri0R!
images/1734-3.png

ssh jimmy@10.10.10.171

trying pw n1nj4W4rri0R! with jimmy gets us in!

images/1751-1.png

priv esc to joanna

to priv esc to joanna we have to find the main.php script that openadmin's 2nd webserver runs and download her encrypted ssh_key, decrypt it with ssh2john and then use it to login as joanna