Corrosion 2 Walkthrough
Corrosion - 2 Writeup#
This is a medium difficulty machine that involves exploiting a Tomcat server, escalating privileges through SUID binaries, and ultimately gaining root access.
Enumeration#
Initial Nmap Scan#
I started with an Nmap scan and found three open ports: SSH (22), HTTP (80), and HTTP (8080). The HTTP service on port 8080 was running Tomcat.
User Enumeration#
Manually checking the machine, I discovered that there are three users present: randy ,jaye and tomcat.
Site Enumeration and Brute-forcing#
Next, I enumerated the site and found a login prompt at /manager. The default credentials didn’t work, so I brute-forced the login and discovered some credentials, but none of them were successful.
Directory Brute-forcing#
Running gobuster revealed an interesting zip file that seemed unusual.
Cracking the Zip File#
I downloaded the file, but it was password protected. Using fcrackzip (or zip2john), I cracked it and found credentials for admin and manager. Logging in using these credentials was successful.
Gaining a Reverse Shell#
After logging in, I enumerated the site further and found a Manager Authenticated Upload feature. This allowed me to upload a shell and get a Meterpreter session.
Privilege Escalation#
I uploaded linpeas to the server to check for SUID binaries. After exploring a few of them, nothing seemed useful at first.
Switching Users#
After some time, I attempted to switch to the jaye user using the same password found earlier. It worked!
Exploring Jaye’s Home Directory#
In jaye’s home directory, I found a folder with an interesting SUID file. This file accepts a string and filename as input. By using a simple trick, I passed an empty string to it, which allowed me to read /etc/shadow.
Cracking the Hash#
It’s a SHA-512 with salt take some time to crack I tried to extract the randy hash and successfully cracked it. The password was 07051986randy. With this, I could escalate to root.
Final Privilege Escalation#
Using sudo -l, I noticed that I could run randombase64.py as root. Searching for more base64 file in the system, I found it to be a SUID perm. After some tinkering, I managed to spawn a root shell by executing os.system(’/bin/bash’) in file.
Root Shell#
Finally, I gained a root shell!
- Sagar Sehrawat
Adapted from sagar-sehrawat/VulnHub-Machine-Solutions under MIT.