Running nmap we see various open ports. Going through 8080 we see a website running "Exhibitor for ZooKeeper"
/┌──(kali㉿kali)-[~/PGP/Pelican]
└─$ sudo nmap -sC -p- pelican.offsec 130 ⨯
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-20 14:51 EST
Stats: 0:00:59 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 96.81% done; ETC: 14:52 (0:00:01 remaining)
Nmap scan report for pelican.offsec (192.168.111.98)
Host is up (0.060s latency).
Not shown: 65526 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
| ssh-hostkey:
| 2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
| 256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_ 256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
139/tcp open netbios-ssn
445/tcp open microsoft-ds
631/tcp open ipp
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=pelican/organizationName=pelican/stateOrProvinceName=Unknown/countryName=US
| Not valid before: 2021-12-20T19:49:21
|_Not valid after: 2031-12-18T19:49:21
|_http-title: Bad Request - CUPS v2.2.10
2181/tcp open eforward
2222/tcp open EtherNetIP-1
| ssh-hostkey:
| 2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
| 256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_ 256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
8080/tcp open http-proxy
|_http-title: Error 404 Not Found
8081/tcp open blackice-icecap
44091/tcp open unknown
Host script results:
|_clock-skew: mean: 1h40m00s, deviation: 2h53m13s, median: 0s
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2021-12-20T19:51:44
|_ start_date: N/A
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.9.5-Debian)
| Computer name: pelican
| NetBIOS computer name: PELICAN\x00
| Domain name: \x00
| FQDN: pelican
|_ System time: 2021-12-20T14:51:44-05:00
Nmap done: 1 IP address (1 host up) scanned in 70.03 seconds
Following the directions from the exploit we get local access through an netcat listerner. After downloading LSE and running it we see a couple of interesting findings.
Seems we can run /usr/bin/gcore without needing a password.
We also see that there's a binary (/usr/bin/password-store) that is being run by root and has the SETUID bit.
We see a lot of various things in the cronjob section that we may revisit later if needed.
Using gcore (/usr/bin/gcore 493) we crash the password store program and reading the crash through strings we can see the root password (ClogKingpinInning731).
We can easily su root with the password into super user and retrieve our root flag.
