Beep
Beep HTB walkthrough 2023 tested on Kali. Beep has a very large list of running services, which can make it a bit challenging to find the correct entry method.
Scanning
Scanning reveals a no of ports to be opened
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -sS -sC -sV -O -T4 10.10.10.7 -oX beep.nmap
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-19 08:28 EDT
Nmap scan report for 10.10.10.7
Host is up (0.17s latency).
Not shown: 988 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 4.3 (protocol 2.0)
| ssh-hostkey:
| 1024 adee5abb6937fb27afb83072a0f96f53 (DSA)
|_ 2048 bcc6735913a18a4b550750f6651d6d0d (RSA)
25/tcp open smtp Postfix smtpd
|_smtp-commands: beep.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, ENHANCEDSTATUSCODES, 8BITMIME, DSN
80/tcp open http Apache httpd 2.2.3
|_http-server-header: Apache/2.2.3 (CentOS)
|_http-title: Did not follow redirect to https://10.10.10.7/
110/tcp open pop3 Cyrus pop3d 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
|_pop3-capabilities: AUTH-RESP-CODE APOP UIDL PIPELINING TOP IMPLEMENTATION(Cyrus POP3 server v2) RESP-CODES LOGIN-DELAY(0) USER EXPIRE(NEVER) STLS
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 875/udp status
|_ 100024 1 878/tcp status
143/tcp open imap Cyrus imapd 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
|_imap-capabilities: Completed UIDPLUS STARTTLS X-NETSCAPE LITERAL+ BINARY ACL CHILDREN URLAUTHA0001 LISTEXT OK IMAP4 ANNOTATEMORE THREAD=REFERENCES NO RIGHTS=kxte MAILBOX-REFERRALS CONDSTORE CATENATE LIST-SUBSCRIBED ID THREAD=ORDEREDSUBJECT IMAP4rev1 IDLE QUOTA SORT MULTIAPPEND ATOMIC SORT=MODSEQ NAMESPACE UNSELECT RENAME
443/tcp open ssl/http Apache httpd 2.2.3 ((CentOS))
|_http-server-header: Apache/2.2.3 (CentOS)
|_ssl-date: 2023-07-19T12:32:31+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Not valid before: 2017-04-07T08:22:08
|_Not valid after: 2018-04-07T08:22:08
993/tcp open ssl/imap Cyrus imapd
|_imap-capabilities: CAPABILITY
995/tcp open pop3 Cyrus pop3d
3306/tcp open mysql MySQL (unauthorized)
4445/tcp open upnotifyp?
10000/tcp open http MiniServ 1.570 (Webmin httpd)
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.93%E=4%D=7/19%OT=22%CT=1%CU=35489%PV=Y%DS=2%DC=I%G=Y%TM=64B7D8A
OS:0%P=x86_64-pc-linux-gnu)SEQ(SP=C9%GCD=1%ISR=CE%TI=Z%CI=Z%II=I%TS=A)OPS(O
OS:1=M53CST11NW7%O2=M53CST11NW7%O3=M53CNNT11NW7%O4=M53CST11NW7%O5=M53CST11N
OS:W7%O6=M53CST11)WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)ECN(R
OS:=Y%DF=Y%T=40%W=16D0%O=M53CNNSNW7%CC=N%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%
OS:RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=16A0%S=O%A=S+%F=AS%O=M53CST11NW7%RD=0%
OS:Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%
OS:A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%
OS:DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIP
OS:L=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 2 hops
Service Info: Hosts: beep.localdomain, 127.0.0.1, example.com
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 443.44 seconds
Web Enumeration
Both port 80 and 443 are aval and apache is running on both ports. We, also got the domain name. so add it to /etc/hosts
Visiting the site on HTTP, we are redirected to https but the TLS version of the site is low and Firefox gives us an error
Now open the config settings and in new tab, enter the following
Search for security.tls.version.min and change it to 1.
Now browse again and we get the main Elastix page. Visiting robots.txt, sitemap and source code does not reveal anything. Lets try dirbusting.
ffuf didn't work for some reason. Gobuster saved the day and found a few directories
Now try login to the admin
We get an error page indicating the version of free PBX 2.8.1.4.
Web exploitation with LFI
Now lets search for vulnerability.
So, we will target first LFI
Opening it, we get the LFI address
/vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action
Now paste it in browser and see if we get the config file. And we get the file
Now press ctrl+u to see the source code. And we get a number of passwords.
Lets try enumerating users with reading etc/passwd file
We got a number of users. (Only users with bin/bash are important.
Getting Access with SSH
As ssh was open let's try ssh with found users and passwords. We will get the error due to old version of ssh. Add the following to /etc/ssh/ssh_config
Now use the following command to ssh
use the password " jEhdIekWmdjE" and we are in. We are already root.
We got the flags.
Method 2
Webmin is running on port 10000 which allows full access of the machine. Trying the username root with the passwords I collected from the LFI, I can login to webmin with root / jEhdIekWmdjE. This interface is designed to administer the machine and has full root access.
We can also change passwords
We can also schedule any command. Lets schedule a reverse shell command as local user
And we get the reverse shell
We could have got shell as root user as well if we want.
Method 3 - Exploiting Shell Shock
From Webmin login panel, initiate a login request and intercept it in burp. Forward it to the repeater.
Now change the user agent to shell shock and try following payloads.
Now check ping
And we get the ping. So lets try reverse shell.
And we got the shell.
Method 4 RCE Elastix
Searching with searchsploit had revealed a RCE vulnerability.
Download last script
We need to know a valid SIP extension, so use the following tool to scan for valid extensions.
So, we have a valid extension, make necessry changes in the script and open the listener on port 443.
Now, run the script and we get the shell.
Priv Escalation
Now run sudo -l to view commands that can be run as sudo
Use GTFO bins as a ref
Nmap priv esc
chmod on root directory
Run the following command to give everyone rwx permissions on the /root directory.
chmod /bin/bash add suid permissions
chmod jumps out right away. I’ll pick a file, like /bin/bash, and set it to SUID:
Now just run it (with -p to not drop privs) and get a root shell:
Last updated