Broker - Hack The Box
Enumeration
Nmap
Initial NMAP scan revealed SSH, HTTP, MQTT and ActiveMQ ports are open.
WEB Enumeration
WEB page had default credentials “admin:admin”, so I got access to it.
Directory Brute Force
The directory brute force revealed admin and api pages open. The admin page revealed the version of ActiveMQ.
Exploitation
CVE-2023-46604
Analyzing the version revealed a public exploit. This repo includes a public PoC to get a reverse shell.
So I updated to poc-linux.xml and started a netcat listener. Then got a reverse shell.
Got The User
Privilege Escalation
sudo -l
The “sudo -l” revealed the user can run nginx as sudo. There were no GTFOBins page but searching through the internet revealed this repo.
Using sudo privileges of nginx, I can create a ssh key to login as root.
Pwned
The machine was pwned.