> For the complete documentation index, see [llms.txt](https://www.davila.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.davila.me/menu/walkthroughs/oscp-practice/pelican.md).

# Pelican

Running nmap we see various open ports. Going through 8080 we see a website running "Exhibitor for ZooKeeper"

```
/┌──(kali㉿kali)-[~/PGP/Pelican]
└─$ sudo nmap -sC -p- pelican.offsec                                                                                  130 ⨯
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-20 14:51 EST
Stats: 0:00:59 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 96.81% done; ETC: 14:52 (0:00:01 remaining)
Nmap scan report for pelican.offsec (192.168.111.98)
Host is up (0.060s latency).
Not shown: 65526 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
| ssh-hostkey: 
|   2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
|   256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_  256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
631/tcp   open  ipp
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=pelican/organizationName=pelican/stateOrProvinceName=Unknown/countryName=US
| Not valid before: 2021-12-20T19:49:21
|_Not valid after:  2031-12-18T19:49:21
|_http-title: Bad Request - CUPS v2.2.10
2181/tcp  open  eforward
2222/tcp  open  EtherNetIP-1
| ssh-hostkey: 
|   2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
|   256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_  256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
8080/tcp  open  http-proxy
|_http-title: Error 404 Not Found
8081/tcp  open  blackice-icecap
44091/tcp open  unknown

Host script results:
|_clock-skew: mean: 1h40m00s, deviation: 2h53m13s, median: 0s
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time: 
|   date: 2021-12-20T19:51:44
|_  start_date: N/A
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.9.5-Debian)
|   Computer name: pelican
|   NetBIOS computer name: PELICAN\x00
|   Domain name: \x00
|   FQDN: pelican
|_  System time: 2021-12-20T14:51:44-05:00

Nmap done: 1 IP address (1 host up) scanned in 70.03 seconds
                                                                
```

Doing a quick Google search we see that this service can be exploited by modifying the `java.env script` section. <https://www.exploit-db.com/exploits/48654>

![](https://3832797251-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb95OHkphv0JV8UiUHy4s%2Fuploads%2Fk9LJMXTiXxUgiLdDQIf8%2Fimage.png?alt=media\&token=2a85759a-364f-412c-8665-51d9dea95d32)

Following the directions from the exploit we get local access through an netcat listerner. After downloading LSE and running it we see a couple of interesting findings.

![](https://3832797251-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb95OHkphv0JV8UiUHy4s%2Fuploads%2FgViJk30aT2MLDl3zoiKB%2Fimage.png?alt=media\&token=86230f39-dbfd-4573-b59a-851ff936dbc4)

Seems we can run /usr/bin/gcore without needing a password.&#x20;

![](https://3832797251-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb95OHkphv0JV8UiUHy4s%2Fuploads%2FTlVU9b8BpaIUDuFI1xoT%2Fimage.png?alt=media\&token=324459b5-9af3-4fb0-8fe9-809a111c9031)

We also see that there's a binary (/usr/bin/password-store) that is being run by root and has the SETUID bit.&#x20;

![](https://3832797251-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb95OHkphv0JV8UiUHy4s%2Fuploads%2FJMJLRJ43g5nMlcHLxLdO%2Fimage.png?alt=media\&token=65e5c193-e867-48c5-af7f-201437d33a73)

We see a lot of various things in the cronjob section that we may revisit later if needed.

![](https://3832797251-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb95OHkphv0JV8UiUHy4s%2Fuploads%2Faja35jQ6PcfmFts2OMoa%2Fimage.png?alt=media\&token=ce74b9fd-6804-4f1d-ad0c-c0d9ed1aa32a)

Using gcore (/usr/bin/gcore 493) we crash the password store program and reading the crash through strings we can see the root password (ClogKingpinInning731).

![](https://3832797251-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb95OHkphv0JV8UiUHy4s%2Fuploads%2FoFgOQl311ZX0UfD2uiyH%2Fimage.png?alt=media\&token=4a1c4315-6351-4e79-9d1f-8ebaa98a9d9c)

We can easily su root with the password into super user and retrieve our root flag.

![](https://3832797251-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb95OHkphv0JV8UiUHy4s%2Fuploads%2Fo6P6iPHuaxVemOcSxsiC%2Fimage.png?alt=media\&token=48775904-6491-4388-a7d2-cc8a34ababa5)