Jordak - Proving Grounds Practice
Enumeration
Nmap
Initial nmap scan revealed SSH and HTTP ports were open.
Web Enumeration
Website was Jorani 1.0.0.
I checked Jorani default credentials and found bbalet:bbalet.
Later, I tried it and it worked. I logged in.
Exploitation
CVE-2023-26469
In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
I then searched for Jorani 1.0.0 exploits and found this CVE which allows us to RCE. I also found this script https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/CVE_Jorani.py
Executed it and got user shell.
Then calling bash reverse shell while listening with nc, I obtained upgraded shell. Then I simply read user flag.
Privilege Escalation
NOPASSWD env
All I had to do was check sudo -l and found out NOPASSWD env. Later I executed sudo env /bin/bash to obtain root shell.