Pentest Writeup — Thirteen by Sublarge

simple network map scan:

Notes:

As usual Since the port 80 is open, we started with a simple look on the browser:

The Sync config button takes us to the URL:

The page gave us valuable information about the FTP server running such as the FTP using Default credential, and server contains a FTP log file (Could be our target file to find)

I also noticed the weird value of the parameter

Followed with the Manual Help button :

based on the :

we can tell that the application requires a specific encryption for files path in order to access their content.

ITCHY QUESTION : could weird the value of the of the param is following the same encryption? well lets find out …

the main page provided us with 3 different values for the param :

jrypbzr.gkg pbasvt.gkg ernqzr.gkg

a quick cipher identifier tool found a potential ROT13 encryption:

after decoding these values :

jrypbzr.gkg → welcome.txt pbasvt.gkg → config.txt ernqzr.gkg → readme.txt we can tell that the param requires a ROT13 encryption for path/to/file, POSSIBLE PATH TRAVERSAL? lets find out… in order to find whether the app is vulnerable to Path Traversal, we can rot13 encrypt the

with rot13.com file and pray for the best :

The content of popped on the screen proving the path traversal vulnerability… Key Finding :

Two users : welcome, max

Now our target is the FTP log file however, since we don't know the actual path to the .log file, we’ll relay on in order to find it :

The fuzzing reveals a directory with response code.

Now since we know the directory name we should for the file name with a specific

extension : log

For we can specify the argument :

The fuzzing was successful throwing the back to us with a

status code ​

The log file reveals to two different files on the server :

/opt/rev.sh → a bash script file

since both of the files under the we can use our previously found Path Traversal vulnerability with ROT13 encryption to access their content :

As predicted .. the ftp_server.py file contained the ftp server configuration with plain text credentials :

JACKPOT : FTP USER : ADMIN FTP PASSWORD : 12345

We can now access the ftp server with :

The FTP server contained both the ftp_server.py and rev.sh file which owned by root…

The rev.sh contained :

Based on the content of the bash file, it seems a good entry for a reverse shell … how ever we cannot execute it, we can only read its content with the Path traversal. On the other hand we have the ftp_server.py file…

the machine establish the ftp server on on boot up, with that being said : we can get the ftp_server.py file locally, inject or reverse shell then put in back on the target and finally restart the machine to get root access… we can achieve that with the following :

our injected reverse shell :

And that will be after importing the required libraries

this will be our final result :

Then we can simply put our crafted file on the machine with :

Finally, we can set up our listener :

And the restart the target. On boot we will achieve the reverse shell :

We successfully achieved root access on the server.

User flag : flag{user-a89162ba751904d59ebd8fed2fce8880}

Root flag : flag{root-aaa245a6e5a82937c985c50c86282892}