Billing
Eduardo Cochella
MSc. Electrical engineering | Penetration tester | Ethical Hacker | Network engineer | Red Team | Cyber researcher | Top 1% TryHackMe | Top 1% Hack The Box | CTF Player
Enumeration: After running a simple service - version scan, we discovered three ports open.
Port 22-ssh, 80-http, 3306-mysql.
Visiting the Web Application, we noticed that is running MagnusBilling, an open-source billing system.
Googling a little bit, we found an Unauthenticated Remote Command Execution (CVE-2023-30258).
A Command Injection vulnerability in MagnusBilling application 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.
Exploiting the vulnerability using the Metasploit Framework, we couldn't get a Meterpreter session on the first try, so we had to force the exploit with the command "set ForceExploit true".
We were able to read the User.txt flag under "Magnus" user directory.
Linux Enumeration
Our current user "asterisk" is able to run "fail2ban-client" with root privileges.
We found 8 active jails
To run commands as root using fail2ban, we can adjust one of the jail's actions, such as the command executed when an IP is banned.