Silent Monitor
Enumerate a running internal service, exploit a vulnerable web application, pivot through the system, and crack your way to root. - by slava.thm
The following post by 0xb0b is licensed under CC BY 4.0
Scenario
Green Lights, Dark Corners
CorpNet's internal network operations centre has been running quietly for years. Monitoring hosts, logging events, and keeping the infrastructure alive. Or so it seems. A tip from a disgruntled contractor suggests that someone on the NOC team has been cutting corners, leaving doors open, and hiding things in places no one thinks to look.
The portal is up. The services show green. The audit log looks clean.
But clean logs can be written by anyone.
Your job is to get in, move through the system, and find out what is really running behind the secret dashboard.
Summary
Summary
In Silent Monitor, we enumerate the target and identify a web service running on port 5050, which exposes an /internalportal protected by a login form. We bypass authentication using the SQL injection payload ' or 1 or ' and gain access to an internal dashboard, which surfaces a /internal/health endpoint vulnerable to command injection. We exploit this by injecting a busybox nc reverse shell against a Penelope listener and land a callback on the host. While enumerating the filesystem, we discover a secret.config file containing the sysadmin user's credentials, which we leverage to pivot via SSH and establish a stable session as sysadmin. From there, we locate a KeePass database infrastructure.kdbx in a backups folder and exfiltrate it by hosting a Python HTTP server on the target and pulling it down with wget. On our attacking machine, we convert the database to a crackable hash using keepass2john and recover the master password with John the Ripper against rockyou.txt, revealing that the vault was protected by a weak password. Unlocking the KeePass file exposes the root user's credentials, allowing us to escalate privileges with su root and retrieve the final flag from root's home directory, fully compromising the host.
Recon
We use rustscan -b 500 -a silent-monitor.thm --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
Besids SSH on port 22 we have a web service running on port 5050.
We visit the site and have a infrastructure monitoring site infront of us. At first glance this seems like a static site.
A directory scan via Feroxbuster did not lead to any results, even though the following directory was also included in the wordlists used. At the following endpoint we have log in infront of us.
Access as netops
We catch the request using Burp Suite. We try to get access using SQL injection. For this we will try the following payloads:
We send the request to the intruder module, paste the wordlist of different SQL injection bypass payloads, highlight the value of the username and start the attack.
After a short duration we have a redirect with the following payload.
We uses this to log in.
We are being redirect to the dashboard.
In the audit logs we can see that another user tried to get access via SQL injection and command injection on the health endpoint. This gives us a hint that the attacker might have been successful by injecting a command via newline.
Shell as www-data
We move to the health endpoint and thest for command injeciton.
But first, we spin up a listener to catch our reverse shell.
We tried different payloads also the suggested in the logs, but without success. It turns out the newline was indeed the actual mechanic to bypass the filter and inject the command, but not url encoded.
After submitting the payload we get a connection on our reverse shell listener. We are www-data.
Shell as sysadmin
In the current directory we find a secret.config file which contains credentials for the sysadmin user.
We can't swtich users with the credentials using su, but we are able to SSH into the machine using the credentials. We are sysadmin and find the users flag in the home directory.
Shell as root
In the backups folder we find a keepass file.
We exfiltrate it using a python webserver.
On our machine we generate a hash using keepass2john to eventually crack the keepass file. It turns out the file is poorly secured by a weak password.
We unlock the keepass file with the cracked password and are able to retrieve the root users password.
Next, we try to switch users to root using su and are successful. We find the final flag in the roots home directory.
Last updated