Exploitation and POSTY
With root access I was able to change the password of default users. Doing so I was then able to access their email via thunderbird.
Accessing Mail
After changing passwords, I was able to successfully login on on thunderbird.
Quick Telnet tutorial
Checking mail via Terminal
SSH credentials
After logging into the account via thunderbird, I was able to find credentials for ssh.
username: mindy
password: P@55w0rd1!2@
Gaining a Reverse Shell
After trying to escape the shell it was to no avail, however, From the above exploit we can execute code to establish a reverse shell. This may escape us from the mindy shell to a better shell, im thinking a Ben Franklin kinda shell. Create an user with the following name and password on the James Remote Server
Send an email to this user with a reverse shell
That single quote above is so that the file is interpreted properly at the back end and our reverse shell returns
Logging in back into mindy will execute our reverse shell.
After getting our reverse shell and runnning pspy32, we are able to find the following python file.
It appears to be a cronjob that executes a python script that deletes the tmp directory. Further looking at this file and its permissions something stood out.
This file can be ran and executed as root and WRITTEN by ANY user!
adding python code to establish a reverse shell will give us a reverse connetion with root
Last updated
Was this helpful?