Billing
Billing - TryHackMe

Billing

Eduardo Cochella Eduardo Cochella

Eduardo Cochella

MSc. Electrical engineering | Penetration tester | Ethical Hacker | Network engineer | Red Team | Cyber researcher | Top 1% TryHackMe | Top 1% Hack The Box | CTF Player

发布日期: 2025年3月10日
+ 关注

Enumeration: After running a simple service - version scan, we discovered three ports open.

Port 22-ssh, 80-http, 3306-mysql.

Nmap Scan

Visiting the Web Application, we noticed that is running MagnusBilling, an open-source billing system.

Visiting the Web page.

Googling a little bit, we found an Unauthenticated Remote Command Execution (CVE-2023-30258).

A Command Injection vulnerability in MagnusBilling application 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.

Reference:

Exploiting the vulnerability using the Metasploit Framework, we couldn't get a Meterpreter session on the first try, so we had to force the exploit with the command "set ForceExploit true".

Meterpreter Session.

We were able to read the User.txt flag under "Magnus" user directory.

User Flag.

Linux Enumeration

Our current user "asterisk" is able to run "fail2ban-client" with root privileges.

sudo -l

We found 8 active jails

Jails are basically configurations that define which logs to monitor.

To run commands as root using fail2ban, we can adjust one of the jail's actions, such as the command executed when an IP is banned.

fail2ban-client privilege escalation procedure. Getting the root flag.


要查看或添加评论，请登录

Eduardo Cochella的更多文章

  • You Got Mail
    2025年2月10日

    You Got Mail

    Enumeration Let's start this room by running Nmap. We can see the smtp, pop3 and imap are in the server.

  • Lookup - TryHackMe
    2024年11月26日

    Lookup - TryHackMe

    Basic Scan: SSH and HTTP are running. NMAP basic scan Analyzing the Web Application: We had to deal with a login page.

  • Cheese CTF
    2024年9月25日

    Cheese CTF

    NMAP enumeration It seems the all ports are running. Checking port 80, we found that a web application is running.

    1 条评论
  • Attacktive Directory
    2024年8月22日

    Attacktive Directory

    NMAP enumeration shows up an Active Directory environment - Kerberos Port 88 DNS_Domain_Name: spookysec.local User…

  • Injectics
    2024年7月30日

    Injectics

    Enumeration Ports 22 and 80 are open Web Application running on port 80 Checking the source code, we found an…

  • New York Flankees
    2024年7月15日

    New York Flankees

    Enumeration Port 22 and 8080-http are open Checking the request, we found a script function that leaks a token. Custom…

  • CyberLens
    2024年5月23日

    CyberLens

    Enumeration Don't forget to manually define the IP addresses associated with the specific hostname After a deep…

  • CREATIVE
    2024年4月16日

    CREATIVE

    Enumeration Ports 22 and 80 are open Web App Analysis - Nothing interesting Let's look for some subdomains -…

  • Hack Smarter Security
    2024年3月21日

    Hack Smarter Security

    Enumeration Ports 21, 22, 80, 1311, and 3389 are open Checking port 21 we found some Credit Cards and a Stolen Passport…

    1 条评论
  • Crocc Crew
    2024年2月14日

    Crocc Crew

    Enumeration Facing an Active Directory Checking for possible users utilizing xato-net-10-million-usernames.txt from…

社区洞察