Pelican - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed Port 8080, 8081, SMB and SSH ports were open.
SMB NULL
SMB Guest login was enabled, but no useful share was available.
WEB Enumeration
Visited website at port 8081, which forwarded me to port 8080. It was Exhibitor application.
I searched the version and found out it had RCE vulnerability.
Exploitation
I simply followed the steps and executed the exploit and got a reverse shell.
Then I read the user flag.
Privilege Escalation
User had sudo privileges on gcore binary.
Gcore exploitation
After analyzing the https://gtfobins.github.io/gtfobins/gcore/, I understood that gcore is used to dump process memory.
So, I analyzed processes with ‘ps aux’ and found that one process is named password-store.
So I used my sudo privileges and dumped that process.
Then analyzed the dump and found a plaintext password.
The password was root password, so I simply got root shell.