Scrutiny - Proving Grounds Practice
Enumeration
Nmap
Initial nmap scan revealed SSH, HTTP and SMTP ports were open.
WEB Enumeration
Website was static. However, login page redirected us to teams.onlyrands.com.
So I added teams.onlyrands.com to /etc/hosts file.
And visiting the page revealed that it was TeamCity 2023.05.4 site.
Exploitation
CVE-2024-27198
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible.
So I used searchsploit and found an exploit.
Then executed it and created a new administrator user.
Then simply logged in.
Git commits
While checking user commits I found a commit message Oops which seemed suspicious.
Then checked it and found that marco accidentally pushed his id_rsa file.
ssh2john (crack id_rsa)
Then I simply tried to login with it but it asked for a password.
So I used ssh2john and then john with rockyou.txt to crack the id_rsa.
Then simply logged in.
Local Flag
There were no user flags. Then I used hint and fount out we could obtain webshell with CVE-2024-27198 exploitation. So I found this exploitation https://github.com/passwa11/CVE-2024-27198-RCE
Then ran it but it gave error because it was not in debug mode. We could not execute commands.
However, we could open debug mode by applying below steps:
## GET TOKEN
curl -X POST http://teams.onlyrands.com/app/rest/users/id:24/tokens/RPC2 -u mzo3aj43:X8UypsbuXc
export TOKEN=<TOKEN>
curl -X POST 'http://teams.onlyrands.com/admin/dataDir.html?action=edit&fileName=config%2Finternal.properties&content=rest.debug.processes.enable=true' -H "Authorization: Bearer $TOKEN"
curl 'http://teams.onlyrands.com/admin/admin.html?item=diagnostics&tab=dataDir&file=config/internal.properties' -H "Authorization: Bearer $TOKEN"
And debug mode was enabled. We could execute commands.
I simply read local flag.
Privilege Escalation
Then I executed linpeas and found out there were readable mails on /var/mail folder. So I read it and found a cleartext password.
Hidden file
Then with matthewa user I executed ls -la on home directory and found a non usual file .~ which included a password.
However, I did not know Dach user so I checked /etc/passwd and found out it was briand.
sudo systemctl
Brian had NOPASSWD sudo privileges over systemctl.
I simply executed it and then used !sh method.