HTB:Broker(Linux)

This is one of the machine which reminds one of the other ports present in the machines, so I did a simple nmap scan which resulted in very less findings. Then I did a full port scan which helped me see the bigger picture.

nmap scan

If we do a version scan on these we will find a Active MQ service running on port 61616

version info

Now there is an exploit available for the same which we can refer to for CVE-2023–46604 present in the ActiveMQ version 5.15.15. The one i used was from evkl1d.

Get Eagle Hacks’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

For this exploit to work we need to edit the poc.xml file to connect to our netcat listener.

poc.xml

Now to run the exploit there are two things we need to do, first host the file poc.xml, I am using port 443 cause port 80 is not available. Second, run a netcat listener on the port specified in the poc which is 9001 in my case. Then we run the exploit as follows:

exploit

This gives us a shell on our netcat listener as user activemq:

user shell

Now this user has sudo privileges to run nginx:

sudo privileges

For privilege escalation we need to explore further and there is an option in nginx which is -c that allows us to use a custom configuration file and hence we make a custom file:

custom nginx conf file

This file will provide us root access when we run nginx with it.

running nginx

Next we need to simply check the ports where we are listening cause this should run nginx and it should listen at 1338 :

listening ports

When i try 1338 i don’t get connected to nginx but 1337 helps me read the files as root which should help in simply reading the flag through this and we would be done with the machine, also we need to give some time for the specified port to start giving output cause after a few minutes I was able to fetch same details using 1338 but if we are to do privilege escalation we need to make use of the PUT request and we can simply edit our config file to enable PUTs, also i have changed the port for this run.

enabling PUT method

Now we can simply generate ssh key using ssh-keygen command on our attacking machine and transfer the public key we have to the root ssh folder:

public key upload

Now since our public key is uploaded we can use our private key to login as root user and gain the shell. Also we need to ensure to set the permission of the private key first before using it.

root access