Posts for: #Suid

PG: Astronaut

#offsec  #proving-grounds  #easy  #linux  #grav-cms  #cve-2021-21425  #rce  #suid  #gtfobins 
ターゲット // Astronaut
PlatformOffSec Proving Grounds
OSLinux
DifficultyEasy
IP192.168.155.12

Enumeration

Nmap

▶ Nmap output
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))

Two ports. SSH is a dead end without creds, so the web server is the way in. The Apache directory listing on port 80 exposes a grav-admin/ folder — a Grav CMS install. robots.txt confirms a stock Grav layout (/user/, /system/, /cache/…).

[]

PG: Dibble

#offsec  #proving-grounds  #medium  #linux  #nodejs  #eval-rce  #mongodb  #suid  #gtfobins 
ターゲット // Dibble
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.179.110

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE VERSION
21/tcp    open  ftp     vsftpd 3.0.3
22/tcp    open  ssh     OpenSSH 8.3 (protocol 2.0)
80/tcp    open  http    Apache httpd 2.4.46 ((Fedora))
3000/tcp  open  http    Node.js (Express middleware)
27017/tcp open  mongodb MongoDB 4.2.9

Fedora box with a busy surface. Anonymous FTP is allowed but the listing hangs and holds nothing. Port 80 is a stock Drupal 9.0.6 install page (/core/install.php) — a red herring that goes nowhere. The two ports that matter are the MongoDB on 27017 (exposed with no auth) and the Node.js/Express app on 3000.

[]

PG: Nibbles

#offsec  #proving-grounds  #medium  #linux  #postgresql  #default-credentials  #rce  #suid  #gtfobins 
ターゲット // Nibbles
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.184.47

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE    VERSION
21/tcp   open  ftp        vsftpd 3.0.3
22/tcp   open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp   open  http       Apache httpd 2.4.38 ((Debian))
5437/tcp open  postgresql PostgreSQL DB 11.3 - 11.9

Four services on a Debian 10 (Buster) box. FTP rejects anonymous login, SSH is a dead end without creds, and Apache serves nothing worth fuzzing. The odd one out is PostgreSQL on 5437 — not the default 5432. A database exposed straight to the network, on a port someone deliberately moved, is where the attention goes.

[]