Cockpit - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed HTTP, SSH ports and 9090 ports were open.
WEB Enumeration
The website at port 80 seemed like dummy website. I did directory enumeration and could not find any useful folder.
Then checked 9090, it was also a website. It was Cockpit CMS website and I tried some known vulnerabilities but none of them worked.
Then I used different wordlist raft-medium-files.txt from seclists which includes common files and it worked. I found login.php file on port 80.
Exploitation
SQL Injection
At first I tried simple ‘ to check if it would throw any errors. And indeed it threw and error.
Then tried OR 1=1, AND 1=1 and other common methods bot all of them were blocked.
Then I simply tried admin’ – - and it was it, I simply got inside the website and obtained user passwords.
Cockpit CMS (Add SSH Public Key)
Then I base64 decoded user passwords and logged in to Cockpit CMS.
Then I simply added my local id_rsa.pub (ssh public key) to Cockpit CMS.
And with this I got the user and its flag.
Privilege Escalation
Tar Wildcard Abuse
sudo -l revealed I could run tar binary with wildcard (*) as root.
So it was simple. I applied steps in tar wildcard abuse:
mkdir tmp/tar_test
cd tmp/tar_test
echo 'echo "james ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > root.sh
echo "" > "--checkpoint-action=exec=sh root.sh"
echo "" > --checkpoint=1
sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *
And applying these steps got me NOPASSWD sudo for all commands.
I then simple got root.