OpenAdmin

Hack The Box · Easy Linux Box · Retired

Enumeration

Nmap exposed SSH and Apache. Directory enumeration found /ona, which hosted OpenNetAdmin 18.1.1.

Initial Access

The OpenNetAdmin installation was vulnerable to unauthenticated remote command execution. The exploit returned a limited shell and exposed database configuration containing the clear-text password n1nj4W4rri0R!.

/etc/passwd identified the local users Jimmy and Joanna. Password reuse allowed SSH access as Jimmy.

Lateral Movement

Jimmy owned the internal web application files under /var/www/internal. Reviewing the application and accessing the locally hosted service exposed Joanna's encrypted private SSH key. Cracking the key passphrase allowed SSH access as Joanna.

Privilege Escalation

Joanna could run Nano as root through sudo. Using Nano's command-execution functionality produced a root shell.