Sense Writeup
Sense is an easy box from HackTheBox. Using directory fuzzing to find a text with user credentials can be used to log in to the pfSense admin panel. From there the outdated version of pfsense leads...
Vulnerability Exploited: Arbitrary Command Execution (CVE-2014-4688)
System Vulnerable: 10.10.10.60
Vulnerability Explanation: Sensitive information has been available publicly for everyone to enumerate and the use of default credentials lead the attacker to log in to the pfsense admin panel. Then, the outdated version of used pfsense leads to an OS command execution. pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via the hostname value to diag_dns.php in a Create Alias action, the smartmonemail value to diag_smart.php, or the database value to status_rrd_graph_img.php
Vulnerability Fix: Update and patch the system and install the most recent version of pfSense
Privilege Escalation Vulnerability: No need for Priv Esc
Vulnerability Fix: The developer should have conformed to the principle of least privilege and the concept of separation of privileges.
Severity: Critical
An initial nmap scan revealed the lighttpd 1.4.35 running on port 80 and 443.
The pfSense website initial page
Fuzzing the website find any existing directories or files.
Check the content of /system-users.txt file
Using the default documentation, the default admin credentials for the pfsense admin panel are admin:pfsense
https://docs.netgate.com/pfsense/en/latest/usermanager/defaults.html
Using the username rohit and the default password pfesnse, we can log in successfully to the admin panel
The pfsense version can be shown on the admin panel as: 2.1.3. Using searchsploit we can found the following exploit.
https://www.exploit-db.com/exploits/43560
Copy the exploit to the working directory
Launch a local listener using nc and execute the exploit
A reverse shell received as root
user.txt
root.txt
Lessons Learned
To gain an initial foothold on the box we exploited three vulnerabilities.
Information disclosure. The changelog.txt & system-users.txt files were publicly available to anyone that enumerates the directories on the webserver. Those files gave us information about the vulnerabilities in the web server and credential information for one of the accounts. Administrators should never publicly store sensitive information.
Use of default credentials. The user used the default password that is shipped with the application. Since default credentials are publicly available and can be easily obtained, the user should have instead used a sufficiently long password that is difficult to crack.
Command injection in the pfSense software allowed us to send a shell back to our attack server. This could have been avoided if the user had patched the system and installed the most recent version of pfSense.
As mentioned earlier, we didn’t have to escalate privileges for this box since pfSense runs with root privileges and therefore we got a shell with root privilege
Last updated