Enumeration / Information Gathering
As always we’re going to start off with a nmap scan to map out the initial attack surface we’re going up against.
Looks like we only have two ports open, 22 (SSH) and 80 (HTTP Web Server).
Checking out the webpage first, it looks like we have a default apache page, which is usually a sign of poor cyber hygiene.
Anytime I see a default web page, my first instinct is to further enumerate for directories or subdirectories. For directory busting my go-to tool is gobuster.
Unfortunately, we don’t get any hits. For subdirectory enumeration, I always go for ffuf.
Similarly to gobuster, we don’t get any hits.
With the lack of progress here, I always revert back to my initial enumeration steps. Clearly, there is something here that we’re missing, we just need to double check all of our boxes before moving on.
Starting again with nmap, to uncover new secrets I tried scanning both TCP and UDP ports, which comes back successful!
We have port 161/udp (SNMP) open and a few other ports which we can work on later. For now, we have a new checklist of attack to work with.
Note: I like to follow the Hacktricks guides for ports I’m unfamiliar with, which was the case here.
A common tool for SNMP enumeration is smmpwalk, which queries a device’s Object Identifiers (OIDs) to retrieve data about the device.
Looks like we got some good intel! We have a hostname (UnDerPass.htb, with UDP cleverly highlighted), a username, steve, and the mention of a “daloradius” server.
Daloradius is a web management application for managing hotspots and general-purpose ISP deployments. Since it is web server, let’s check out if it exists on port 80.
Looks like it does, we just don’t have access. Remember there is always more enumeration to be done, as we can return to directory busting with the new discovery!
There are a lot of directories here to explore. In order to save some time, I switched to ffuf, which support a recursive directory scan.
After some waiting, it looks like it found something quite interesting! A users page?
Navigating to this users page, we finally are greeted with a login page.
Initial Foothold / Exploitation
daloRADIUS /users login page
Remember that we already have steve’s username, but with any login page I always like to check default credentials first.
Unfortunately no luck on the users login page.
Login error after attempting default credentials
However, this is just the users page. daloRADIUS also has an “operators” page, which is essentially just an admin page. This can be found at /daloRADIUS/app/operators.
Let’s try the same administrator:radius credentials at this page… and we’re able to successfully login!
From the admin panel, clicking on the “Go to users list” button in the green box, we are presented with a user svcMosh and their md5 password hash!
To crack this md5 password, you can use an online tool like crackstation, or I prefer to use a more dedicated tool, like hashcat.
Now that we have a password, let’s use it! We can successfully SSH in as svcMosh and grab the user flag.
Lateral Movement / Privilege Escalation
As always, a great first step when trying to escalate our privileges, is to check what privileges we have! This can be done throughsudo -l .
Looks like we have sudo access over the mobile shell (mosh) server, but not the mosh binary itself. Looking at the mosh binary, we get the following options:
I did some digging on these options, primarily into the--serverflag because that is what we have sudo privileges on — /usr/bin/mosh-server. I found an article detailing multiple PrivEsc techniques, including mosh!
We find the following payload:
- A client on your local machine.
- A server on the remote machine (runs mosh-server).
- It uses SSH to establish the session, but then communicates over UDP (which we got hinted at earlier in the box).
--server="sudo /usr/bin/mosh-server" flag, which tells mosh to use our custom server, which we can run as root. The localhost tag at the end says to make our current localhost session the SSH client, therefore spawning a root shell on our localhost session.
Running the exploit:
We pop into a root shell and can claim our flag!
Hope you enjoyed the box! It’s always fun learning about new technology and protocols, and then being able to break it!
Happy Hacking!