The "bot" is using sockets to communicate to backend. In our short chat we see that service is not available to users, but maybe internal users? From Contact Us using XSS we could probably leak the history of internal user!
Writeup-3.png
Leak Internal User History
To make XSS work we need to load our script and socker.io . script tag doesn't work, so we have to use img tag or others. Used https://minify-js.com to minify the code into one liner.
We have mongo database password which means we can explore it.
SSH (22)
Privilege Escalation (frank_dorky)
Crack the hash of ssh user frank:
Creds: frank_dorky:manchesterunited
User.txt
Privilege Escalation (librenms)
Enumerate the system with linpeas:
In the processes we see an interesting one, frank is running libreoffice as kai_relay and with sudo permissions.
Writeup-8.png
In the nginx module we see it's ran on port 3000:
Do a port forwarding via SSH:
LibreNMS
Writeup-9.png
The app lives on /opt/librenms, but we don't have permission to list files
Execute (x) permission on a directory allows a user to:
Enter the Directory: The user can change into the directory using the cd command.
Access Inodes: The user can access the metadata of the files within the directory, but not their content or names unless the file's specific permissions also grant read or execute rights.
Meaning:
No Listing (ls): The user cannot list the contents of the directory. Commands like ls will not work.
Access by Name: The user can access files and subdirectories within the directory if they know the exact names and have the appropriate permissions on those files or subdirectories.
No Creation or Deletion: The user cannot create or delete files in the directory, as write permissions (w) are required for these operations.
Looks like there's adduser.php script which can be used to add users src
Add user:
Writeup-10.png
There was some DNS problem, so update localhost to match domain.
It looks like in alert templates we can use blade syntax to write php/html file.
