PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2 (FreeBSD 20161230; protocol 2.0)
| ssh-hostkey:
| 2048 e3:3b:7d:3c:8f:4b:8c:f9:cd:7f:d2:3a:ce:2d:ff:bb (RSA)
| 256 4c:e8:c6:02:bd:fc:83:ff:c9:80:01:54:7d:22:81:72 (ECDSA)
|_ 256 0b:8f:d5:71:85:90:13:85:61:8b:eb:34:13:5f:94:3b (ED25519)
80/tcp open http Apache httpd 2.4.29 ((FreeBSD) PHP/5.6.32)
|_http-server-header: Apache/2.4.29 (FreeBSD) PHP/5.6.32
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
Service Info: OS: FreeBSD; CPE: cpe:/o:freebsd:freebsd
form what we can see
we are dealing with a FreeBSD machine
we have a web server running Apache 2.4.29 utilising PHP 5.6.32
Okay Lets start at the web server
HTTP port 80
Looks like some kind of application where can can run local php scripts on the target machine
Lets start directory busting in the background and enumerate this further
Not much luck with our dir busting
Playing around with the application we can view te info.php which gives us the exact version of FreeBSD running on the target
Notice in the url we could have a potential LFI
Lets catch the request with burp and further test this
ctach the request and send it over to repeater
if we look at the following
meaning we need to go up 5 directories
we have the contents of the passwd file Lets gather some usernames
these seem like the only possible user accounts other then root
While we enumerate the LFI lets beginning a SSH password spray attack with these usernames
When we specify through the web application we want to open the file listfiles.php we can see a file names pwdbackup.txt
Lets see if we can open this file
when we look at it we can see the following
im assuming they mean they encoded the password 13 times using base64
Lets decode it
we can write a quick bash script to take the encoded string and specified number of times to decode it
when we run the script we can see the following
we have the password Charix!2#4%6&8(0
Lets top our hydra attack and specify this password and see if we can gain SSH access to the machine
we can see we have a hit
Lets SSH into the machine
Priv Esc via charix
Looking through charix home folder we do find a secret.zip file
Its protected with a password
Letys download this zip file to our local machine
Lets try the password we found for charix
it worked
it produces a file named secret
we use hexdump to see the file contents
What is this binary for?
Lets confirm the version of FreeBSD we are on
11.1-RELEASE
Givin the name of the machine and the version we can search for possible exploit using searchsploit
we find one interesting
Possible vector will look more into it later
Lets see if there is any ports open internally on the target
We can see the following two ports 5801, 5901 which are related to VNC, for remote desktop access
Worth investigating further
Let's see if there are any processes running related to VNC
#!/bin/bash
# Get the Base64 string and number of times to decode
base64_string="$1"
num_times="$2"
# Decode the Base64 string the specified number of times
for ((i=0; i<num_times; i++)); do
decoded_string=$(echo "$base64_string" | base64 --decode)
base64_string="$decoded_string"
done
# Print the final decoded string
echo "Final Decoded String: $decoded_string"
