Levram - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed SSH and port 8000 was open.
WEB Enumeration
Website was Gerapy website.
Tried admin:admin default login and it worked.
Exploitation
CVE-2021-43857
Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.
While searching I found out this version was vulenrable to Authenticated RCE.
I ran the exploit but it did not work and gave error index out of range. After some research I understood that I need to create a project first, so I did.
Then I ran the exploit and got a reverse shell.
Then I simple read the user flag.
Privilege Escalation (Capabilities SetUID)
Python SetUID
I checked capabilities through both manual checking and with linpeas and found that python had setuid capabilities.
I simply obtained root by calling python -c 'import os; os.setuid(0); os.system("/bin/bash")' .
Privilege Escalation (Service Cleartext Credentials)
At first I checked all services in the machine and found that Gerapy was running as service (app.service)
Then I checked its status to find service path
Then checked that file and found cleartext crendentials