search

linuxClue

hashtag
Enumeration:

hashtag
Port Scanning:

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Clue]
└─$ sudo nmap -sCV -p- --min-rate 4000 -oA nmap/services -vv 192.168.209.240
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-09 11:37 EST
Nmap scan report for 192.168.209.240                                                                                                                                       
Host is up, received echo-reply ttl 61 (0.22s latency).                                                                                                                    
Scanned at 2025-11-09 11:37:01 EST for 102s                                          
Not shown: 65529 filtered tcp ports (no-response)                                    
PORT     STATE SERVICE          REASON         VERSION                               
22/tcp   open  ssh              syn-ack ttl 61 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)                                                                              
| ssh-hostkey:                            
|   2048 74:ba:20:23:89:92:62:02:9f:e7:3d:3b:83:d4:d9:6c (RSA)                       
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGGcX/x/M6J7Y0V8EeUt0FqceuxieEOe2fUH2RsY3XiSxByQWNQi+XSrFElrfjdR2sgnauIWWhWibfD+kTmSP5gkFcaoSsLtgfMP/2G8yuxPSev+9o1N18gZchJneakItNT
az1ltG1W//qJPZDHmkDneyv798f9ZdXBzidtR5/+2ArZd64bldUxx0irH0lNcf+ICuVlhOZyXGvSx/ceMCRozZrW2JQU+WLvs49gC78zZgvN+wrAZ/3s8gKPOIPobN3ObVSkZ+zngt0Xg/Zl11LLAbyWX7TupAt6lTYOvCSwNVZ
URyB1dDdjlMAXqT/Ncr4LbP+tvsiI1BKlqxx4I2r
|   256 54:8f:79:55:5a:b0:3a:69:5a:d5:72:39:64:fd:07:4e (ECDSA)                      
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCpAb2jUKovAahxmPX9l95Pq9YWgXfIgDJw0obIpOjOkdP3b0ukm/mrTNgX2lg1mQBMlS3lzmQmxeyHGg9+xuJA=
|   256 7f:5d:10:27:62:ba:75:e9:bc:c8:4f:e2:72:87:d4:e2 (ED25519)                    
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0omUJRIaMtPNYa4CKBC+XUzVyZsJ1QwsksjpA/6Ml+   
80/tcp   open  http             syn-ack ttl 61 Apache httpd 2.4.38                   
| http-methods:                           
|_  Supported Methods: POST OPTIONS HEAD GET                                         
|_http-title: 403 Forbidden                                                          
|_http-server-header: Apache/2.4.38 (Debian)                                         
139/tcp  open  netbios-ssn      syn-ack ttl 61 Samba smbd 3.X - 4.X (workgroup: WORKGROUP)                                               
445/tcp  open  netbios-ssn      syn-ack ttl 61 Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)                                                                              
3000/tcp open  http             syn-ack ttl 61 Thin httpd
|_http-title: Cassandra Web                                                          
|_http-favicon: Unknown favicon MD5: 68089FD7828CD453456756FE6E7C4FD8
| http-methods:                                                                      
|_  Supported Methods: GET HEAD                                                                                                                                            
|_http-server-header: thin
8021/tcp open  freeswitch-event syn-ack ttl 61 FreeSWITCH mod_event_socket
Service Info: Hosts: 127.0.0.1, CLUE; OS: Linux; CPE: cpe:/o:linux:linux_kernel

<snipped>

hashtag
HTTP (80):

If we browsed to this, we will get forbidden:

hashtag
SMB (445):

List the shares and permissions if we have one:

Lets skip this for not.

hashtag
HTTP (3000):

Here we have cassandra running on port 3000.

hashtag
HTTP (8021):

Nmap shows that we have freeswitch running on that port, lets search for public exploits:

We will have one:

Try to run it:

Try it manually.

First we will grab the default password for freeswitch from the script and connect to the port with nc:

Invalid credentials, so we need to get the correct password for us to be able to get code execution on the target.

hashtag
Exploitation:

Going back to cassandra, I searched online for CVEs, and found one:

We have path traversal vulnerability.

LogoCassandra Web 0.5.0 - Remote File ReadExploit Databasechevron-right

Pull this with searchsploit:

Run it:

This time I get stuck with that path traversal vulnerability, because I do not what exactly the files resides on that system, so skip this also for a moment.

Lets step back to our smb backup share, and connect to it:

We can get the files with mget, or by mounting the share in our kali:

From here I searched for passwords, and found only ClueCon which is the default password, so lets grep for that word, and put the files this word is in, then use our path traversal to check if we can get another result (we can also download the github repo of this project and do the same if we did not have access to the source code this way):

Now the second step:

Now lets test this password out again with our freeswitch application:

Run it:

We successfully authenticated, and we have remote command execution.

Get a reverse shell:

hashtag
Post Exploitation:

hashtag
Lateral Movement to Cassie:

I uploaded linpeas and found this:

We can get the same result with ps aux.

hashtag
Privilege Escalation to Root:

If we went back to our home directory we will find private key for anthony that is the second user on that system:

I copied it to my local kali, and tried to authenticate as anthony but could not.

From the output above, we can see .bash_history file that has some values, but only anthony and root can read it.

We can run another cassandra web service on a different port, but this time with sudo privileges, so if we exploited the same path traversal we previously did on port 3000, on our newly created port we can successfully for example view root files or that .bash_history file.

From another reverse shell, lets try to view some of the protected files:

I could not view the id_rsa of the root user, or the root flag.

Lets view the .bash_history file:

This shows that we were able the whole time to authenticate as root to the box with the id_rsa we found previsouly in cassie desktop.

Lets use it to ssh to the box:

Get the flags:

PreviousZenPhotoNextBitForge

Last updated