> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/get-to-work/linux/chatty.md).

# Chatty

Writeup for Chatty from offsec Proving Grounds

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.184.164 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FPCPITxQxHyM8N1mtk5pC%2Fimage.png?alt=media\&token=3ea5c0da-5f3d-4736-b141-4be88572fa1e)

### Service Enumeration

### HTTP (Port 3000)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fr2Phg3Oigr29hHqVYdDF%2Fimage.png?alt=media\&token=3241d508-c446-4388-9617-3dab0daaa164)

Seems like this is running Rocket.Chat web app.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FHHuYMYyf4x8Ew79eKFKc%2Fimage.png?alt=media\&token=8ffc94b2-43f1-4c93-ae87-b06e78b61583)

When we go to `/api/info`, we can see that this rocket chat is running version 3.12.1 which is vulnerable to NoSQL Injection vulnerabilities. 

These can allow attackers to escalate their privileges, execute arbitrary system commands on the host server, and steal admin user data and chat messages.

{% embed url="<https://www.exploit-db.com/exploits/49960>" %}

{% embed url="<https://blog.sonarsource.com/nosql-injections-in-rocket-chat>" %}

## Exploit

{% embed url="<https://github.com/jayngng/CVE-2021-22911>" %}

We first create a low privilege with the name`kali`, the email`kali@local.local`, and the password from the exploit `Kali123!`.

Then we must change the default password `Test123@` in the script to our password which is `Kali123!`.&#x20;

Note the changes on lines 63,73,96.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FVBm0IvsTfTGMA0vbuLJp%2Fimage.png?alt=media\&token=efa45a10-c7e9-40fc-bb64-b1781c5b3daf)

We run the script and we get RCE.

Payload: `python3 cve-2021-22911.py -u "kali@local.local" -a "admin@chatty.offsec" -t "http://192.168.184.164:3000"`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FlErceldxfsaollXNiDYf%2Fimage.png?alt=media\&token=edcee1bf-87d5-46f3-9756-aff5374200a2)

However, when we try any commands, we can't see the output. So let's try to get a reverse shell.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FISlunE5NpEuwpPk0VYq8%2Fimage.png?alt=media\&token=62a29a17-bdf5-4d3f-bb9a-4ebbae9e2ba9)

We first create a bash reverse shell payload `shell.sh`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F9CDzJmqgw1M63Azakuve%2Fimage.png?alt=media\&token=321d63f4-5abd-4187-983f-f6dbed068de4)

Next, we start our listener and host this file on a python webserver.

Then, we send the command through our exploit to instruct the server to download ou&#x72;**`shell.sh`** and pipe it into `bash`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FjSlgtNdY6jKsIoXDnW5v%2Fimage.png?alt=media\&token=be80ef4b-9907-4f45-8f03-8c5249ec407f)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fr5IETM2HunoKxrIWv5EH%2Fimage.png?alt=media\&token=e51b96fd-6c9c-4762-bbb6-a762b2d4a79c)

## Privesc

Running LinPeas on the target machine, we find that there is an unknown SUID binary.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F4ppgC8z2PK72OpV5OSmG%2Fimage.png?alt=media\&token=fbecaf2e-88c8-4d13-8209-5ccd87d62663)

`maidag`is a mail delivery agent and a part of GNU mailutils.

We can add the `--version` flag to find its version.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FY226qoKCwAFzfP5FVUmw%2Fimage.png?alt=media\&token=4fbb0331-999a-43ca-ab90-ac293ee3da40)

Turns out, `maidag 3.7` is vulnerable and can be abused to write to arbitrary files on the host operating system.

{% embed url="<https://www.exploit-db.com/exploits/47703>" %}

{% embed url="<https://github.com/bcoles/local-exploits/blob/master/CVE-2019-18862/exploit.ldpreload.sh>" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FIDjHqkIketbyuHdv27Bl%2Fimage.png?alt=media\&token=7743f774-fadc-432f-8c05-ada0bf5c8e98)

When we run the script, it seems to run into a few errors.

However, if we check `/var/tmp` , we realize that there is a new sh binary.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FeqipAVnVq4UMvMOXULZj%2Fimage.png?alt=media\&token=33b1aa46-7658-496b-b1b4-cd4859a2739f)

However, this sh binary is not owned by us but by `rocketchat`.

We can try to privilege escalate by trying to SSH to the target as `rocketchat`.

We don't know this user's password, and our authentication attempts will keep failing.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fh6FvbH5mKYLkhorwhdrB%2Fimage.png?alt=media\&token=172cc7fa-1f46-4672-be0e-cd3f9c638ba4)

However, when we check sh again, it is now owned by root and has the SUID bit set.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FIEblzC7Ri46NAXHg3K2r%2Fimage.png?alt=media\&token=feb2f880-8f86-47c6-9bfd-5ce9edcce2ab)

We execute it and we get root.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FrMYQVg6CjUW7XmqGKNzb%2Fimage.png?alt=media\&token=b70368fe-9eaa-4147-bf61-6fd5057bdfef)