# HackTheBox OpenAdmin

## 1. Info
* Name : OpenAdmin
* IP : 10.10.10.171
* OS : Linux
* Difficulty : Easy
## 2. Nmap
* Payload: `sudo nmap -sC -sV 10.10.10.171 -oA nmap/10.10.10.171`
* Port 22: OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
* Port 80: Apache httpd 2.4.29 ((Ubuntu))
* No CVE to use.
## 3. Web Server
* View:
* A very common Apache2 default paage
* Run on Ubuntu
* Gobuster
* mode: dir
* Payload:`gobuster dir -u "http://10.10.10.171/" -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -o gobuster.out -x html -b 403,404`
* Find Dir:
* http://10.10.10.171/music/
* http://10.10.10.171/artwork/
* http://10.10.10.171/sierra/
* Dir: /music
* View:
* Explore Web Page
* Most link direct us to same page
* There's interesting link: Login
* Direct us to http://10.10.10.171/ona/
* It's OpenNetAdmin v18.1.1
* Google it!
* There is RCE PoC on ExploitDB, we can try to use it.

## 4. Exploit OpenNetAdmin
* Exploit RCE: https://raw.githubusercontent.com/amriunix/ona-rce/master/ona-rce.py
* Payload:
* Use vuln checker:` python3 ona-rce.py check http://10.10.10.171/ona/ `
* Use Exploit: `python3 ona-rce.py exploit http://10.10.10.171/ona/`
* Get Shell!

## 5. Privilage Escalation To User Jimmy
* Enum User
* `cat /etc/passwd`
* There two user:
* jimmy
* Web Admin
* joanna
* Find open port
* Find 3306 Port(mysql)
* Explore File
* Interesting File:
* /opt/ona/www/local/config/database_settings.inc.php
* Find database username and passwd
* Mysql
* Login in with ona_sys
* `mysql -u ona_sys -p`
* Password: `n1nj4W4rri0R!`
* Explore Mysql
* Get Databases:`show databases;`
* Get Database ona_default's tables:`use ona_default;show tables;`
* Interesting Tables: users
* Dump Tables user:`select * from users;`\
* We get username and password hash
* Use hashcat to decode it
* admin:admin
* guest:test
* Not very useful...
* Try Login jimmy with su
* Jimmy is web page administrator, maybe he use same password with mysql server
* `su jimmy`
* Passwd: n1nj4W4rri0R!
* Success!
## 5. Privilage Escalation To User Joanna
* Enum
* sudo -l
* Nothing
* Run Linpeas.sh
* Interesting Port:
* Port 3306: Mysql server
* Nothing interesting in Mysql server
* Port 52846: Weird Port
* We can find in `/etc/apache2/sites-available/internal.conf`
* Seams like another website
* Web Server is ran by **Joanna**
* Interesting User's Group
* Jimmy:uid=1000(jimmy) gid=1000(jimmy) groups=1000(jimmy),**1002(internal)**
* Interesting File(Jimmy Writable)
* /var/www/internal
* Looks like we can write file which ran by internal server
* Privilage escalation with internal web server
* Explore file in /var/www/internal
* index.php
* Looks like a login page
* Send login request py POST req
* username = jimmy, auth with password hash(sha512)
* logout.php
* Logout, just logout(clean session).
* main.php
* There is a interesting php code
* It redirect us to index.php if wrong passwd, but no `die()` function
* PHP code will execute but we can't see on web page
* Use Burp Suite to get it
* The web server get joanna's ssh file and send it to internal web server!?
* add id command into main.php
* We can look deep into it
* Explore internal web page
* Forward 52846 port to our attacking machine:`ssh -L 52846:localhost:52846 jimmy@10.10.10.171`
* We can view web page: http://127.0.0.1:52846
* There is no `die()` function so we can view main.php with out auth by Burp Suite
* Burp Suite
* Use Burp repeater to get 302 response from web page
* The web server print the id command output that we add into main.php
* Also Joanna ssh key
* Web Server run on Joanna privilage
* We can crack Joanna's ssh key's passphrase by john
* Very 吃電腦效能==
* Or add reverse shell in main.php
* Add reverse shell in main.php
* **shell** is reverse shell
* Resend request by Burp Suite repeater
* We get joanna!
## 5.Privilage Escalation To Root
* Enum
* `sudo -l`
* We can run `/bin/nano /opt/priv` by root privilage
* We can privilage escalation to root
* Privilage escalation
* Go to [GTFOBins](https://gtfobins.github.io/)
* Search nano
* Run payload: `sudo /bin/nano /opt/priv`
* In nano:
* `^R^X` (ctrl+r ctrl+x)
* `reset;; sh 1>&0 2>&0`
* We get root!