Jarbas | EPICFS <> BLOG

Source

https://www.vulnhub.com/entry/jarbas-1,232/

Date

Mar 5, 2024 → Apr 1, 2024

Tag

Linux

Local privilege escalation

Nmap

Password Cracking

Scan

scan IP 192.168.56.102 that which port are opened.

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-31 23:17 CST
Nmap scan report for 192.168.56.102 Host is up (0.00018s latency). Not shown: 996 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) | ssh-hostkey:
| 2048 28:bc:49:3c:6c:43:29:57:3c:b8:85:9a:6d:3c:16:3f (RSA) | 256 a0:1b:90:2c:da:79:eb:8f:3b:14:de:bb:3f:d2:e7:3f (ECDSA) |_ 256 57:72:08:54:b7:56:ff:c3:e6:16:6f:97:cf:ae:7f:76 (ED25519) 80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/5.4.16) |_http-title: Jarbas - O Seu Mordomo Virtual! |http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16 | http-methods: | Potentially risky methods: TRACE 3306/tcp open mysql MariaDB (unauthorized) 8080/tcp open http Jetty 9.4.z-SNAPSHOT |_http-title: Site doesn't have a title (text/html;charset=utf-8). |http-server-header: Jetty(9.4.z-SNAPSHOT) | http-robots.txt: 1 disallowed entry |/ MAC Address: 08:00:27:4B:65:AA (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.48 seconds

22, 80, 3306, 8080

Any new information we can get form those ports?

scan 192.168.56.102

dirb

┌──(epicfs㉿localhost)-[~]
└─$ dirb http://192.168.56.102 /usr/share/wordlists/dirb/common.txt
DIRB v2.22 By The Dark Raver
START_TIME: Mon Apr 1 01:02:20 2024
URL_BASE: http://192.168.56.102/
WORDLIST_FILES: /usr/share/wordlists/dirb/common.txt
GENERATED WORDS: 4612
--- Scanning URL: http://192.168.56.102/ ----
http://192.168.56.102/cgi-bin/ (CODE:403|SIZE:210)
http://192.168.56.102/index.html (CODE:200|SIZE:32808)
END_TIME: Mon Apr 1 01:02:21 2024
DOWNLOADED: 4612 - FOUND: 2

dirsearch

find a path ./access.html

find out the credential:

eder

9b38e2b1e8b12f426b0d208a7ab6cb98(MD5)

vipsu

Login Jenkins

we can use this credential to login http://192.168.56.102:8080

Jenkins is a project management software, and it support a way that can run a shell command to build yourself app, so we can use this to create a reverse shell by this.