search
GitHubPsMapExec

Fish

hashtag
Nmap

nmap 192.168.213.168 -sS -sV -p- -Pn

PORT     STATE SERVICE              VERSION
3389/tcp open  ms-wbt-server?
3700/tcp open  giop                 CORBA naming service
4848/tcp open  http                 Sun GlassFish Open Source Edition  4.1
6060/tcp open  x11?
7676/tcp open  java-message-service Java Message Service 301
7680/tcp open  pando-pub?
8080/tcp open  http                 Sun GlassFish Open Source Edition  4.1
8181/tcp open  ssl/http             Sun GlassFish Open Source Edition  4.1
8686/tcp open  sun-as-jmxrmi?

Starting out we begin using searchsploit to discover know vulnerabilities against the services.

searchsploit -w "GlassFish 4.1"

Looks like the of GlassFish running is vulnerable to Directory Traversal. The following exploit examples can be used to read known system files.

ExploitDB: https://www.exploit-db.com/exploits/39441arrow-up-right

Using one of the examples in the link with the correct IP and port we are able to build a curl GET request to confirm the directory traversal.

After this I looked up configuration files for GlassFish to see if we can read any sensitive credential files. This StackOverflow linkarrow-up-right proved to be informative and I was able to read the admin hash for GlassFish with a little bit of guesswork.

Unfortunately however, I was unable to crack the hash and proceed with anything meaningful for now.

Looking through the rest of the open ports manually we come across the page "SynaMan" which we observe is running version 4.0.

Again, with searchsploit we are able to see if the version running is vulnerable.

The SMTP disclosure is interesting to us:

ExploitDB: https://www.exploit-db.com/exploits/45387arrow-up-right

We see from the description that as we already have a directory traversal exploit on the system we can likely read the desired AppConfig.xml

From the output we are able to tie together the following credentials:

Being as RDP is open a quick check with Hydra confirms the credentials are valid.

We can then connect via RDP to the target system.

We see on the desktop a shortcut for the AV application TotalAV. Checking appwiz.cpl we see that the installed version is 4.14.31.

searchsploit again shows a vulnerability with the installed version.

This version of TotalAV appears to be vulnerable to Privilege Escalation.

ExploitDB: https://www.exploit-db.com/exploits/47897arrow-up-right

Youtube: https://www.youtube.com/watch?v=88qeaLq98Gcarrow-up-right

Last updated