OpenAdmin Walkthrough

Here we come back again with one of HackTheBox machines ‘OpenAdmin’ which seems like all categories CTF, real life, etc so let’s take a look at its info

As you can see it depends on CVE so let’s get started…

Nmap scan

As usual, we start our scan with nmap to get more info about our target

nmap -A -T4 -oG openadmin.gnmap 10.10.10.171

We have only 2 open ports http and ssh so I understand that I’ll get an entry point like leaked credentials or any custom exploitation from the http:80 and then used it to log in to the box using ssh:22 so let’s start enumerating the website

HTTP Enumerate

If we access 10.10.10.171:80 and openadmin.htb we will get the default page of the server

So we need to brute-force the directories by using dirsearch or gobuster or dirbuster

I’ve 3 directories is available so let’s can check the first one

I searched for any CMS or any admin panel to try to find an exploit for it, but unfortunately, there’s nothing found so let’s check /music

Good we have another directory with login page, let’s check it

It redirects us to this URL 10.10.10.171/ona so what’s ona which has version v18.1.1? Let’s check its source code

That’s good ona means opennetadmin

Generating a shell

Let’s search for exploits related to this CMS

We have one here with the same version and this exploit is also available at metasploit so let’s check it

We have only one, let’s use it and edit its options

I’ve tried the payload x86 but unfortunately, it doesn’t work, so I changed it and as you can see it works now, let’s open a shell and get an interactive one

Now we’re www-data and I’m not sure that I’ve permission to read the user.txt flag, let’s try

As I expected, permission was denied, so let’s search for any misconfiguration or anything else which manages us to login as one of these users

After few time of searching for any important files, I found this file in opt/www/local/config which contain a containsdatabase.

I tried to use it to login as joanna but it failed but succeeded with Jimmy

And now we’re in the server as jimmy let’s try to read user.txt

Hmm !! Nothing here !! Okay

I’ve tried to check the network status to know if there’s anything thereby netstat -tunlp

We have the localhost listening on 2 ports, so keep it now and try to find any interesting files again

Here we have an interesting file in /var/www/internal which seems that returns back /home/joanna/.ssh/id_rsa from joanna directory if it accessed by a link

I’ll try to access it through the localhost with the open ports which it listens on them and sees what will happen

Very good, we have the encrypted RSA for joanna

Getting user.txt

Let’s try to decrypt it by using openssl and note that we have a password → ninja

openssl rsa -in encrypted_file -out decrypted_file but unfortunately, it faces a problem that I can’t understand how to solve it, so I tried to crack it using john the wripper

python ssh2john enc_key > rsa.hash → to generate john hash

john rsa.hash --wordlist=rockyou.txt

And we have the results now bloodninjas as the password

I’ve tried to login with ninja and bloodninjas as password, but it failed, so I’ll try to login using the key itself

And finally we can read the user.txt