┌──(zwique㉿kali)-[~/club/underpass]
└─$ nmap -A 10.10.11.48
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-05 09:16 EST
Nmap scan report for 10.10.11.48
Host is up (0.24s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 48:b0:d2:c7:29:26:ae:3d:fb:b7:6b:0f:f5:4d:2a:ea (ECDSA)
|_ 256 cb:61:64:b8:1b:1b:b5:ba:b8:45:86:c5:16:bb:e2:a2 (ED25519)
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 55.98 seconds
UDP Port Scan
┌──(root㉿kali)-[/home/zwique/club/underpass]
└─# nmap -sU --top-ports 100 10.10.11.48
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-05 09:21 EST
Nmap scan report for underpass.htb (10.10.11.48)
Host is up (0.28s latency).
Not shown: 97 closed udp ports (port-unreach)
PORT STATE SERVICE
161/udp open snmp
1812/udp open|filtered radius
1813/udp open|filtered radacct
Nmap done: 1 IP address (1 host up) scanned in 104.27 seconds
Open UDP port: 161, and you can see that there is a SNMPservice opened
SNMP Check
Simple Network Management Protocol (SNMP) uses User Datagram Protocol (UDP) to transport messages and manage network-connected devices.
┌──(zwique㉿kali)-[~/club/underpass]
└─$ snmpwalk -v 2c -c public underpass.htb
iso.3.6.1.2.1.1.1.0 = STRING: "Linux underpass 5.15.0-126-generic #136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (312269) 0:52:02.69
iso.3.6.1.2.1.1.4.0 = STRING: "steve@underpass.htb"
iso.3.6.1.2.1.1.5.0 = STRING: "UnDerPass.htb is the only daloradius server in the basin!"
iso.3.6.1.2.1.1.6.0 = STRING: "Nevada, U.S.A. but not Vegas"
Noting interesting things in the port 80. So, I tried to fuzz directories.
┌──(zwique㉿kali)-[~/club/underpass]
└─$ ssh svcMosh@10.10.11.48
svcMosh@10.10.11.48's password:
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-126-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Sun Jan 5 03:03:49 PM UTC 2025
System load: 0.7 Processes: 339
Usage of /: 88.5% of 3.75GB Users logged in: 1
Memory usage: 17% IPv4 address for eth0: 10.10.11.48
Swap usage: 0%
=> / is using 88.5% of 3.75GB
=> There is 1 zombie process.
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Sun Jan 5 15:03:50 2025 from 10.10.15.232
svcMosh@underpass:~$ ls
user.txt
Root Flag
If we seek the permissions of user
svcMosh@underpass:~$ sudo -l
Matching Defaults entries for svcMosh on localhost:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty
User svcMosh may run the following commands on localhost:
(ALL) NOPASSWD: /usr/bin/mosh-server
/usr/bin/mosh-server is the gate to get root access without any password.
First, let's define what is the Most Server.
Mosh (mobile shell) is a remote terminal application that supports intermittent connectivity, allows roaming, and speculatively and safely echoes user keystrokes for better interactive response over high-latency paths. We're given this server as an ELF 64-bit LSB pie executable file.
By accessing through the most server, we can login as a root.
The following command lets us to implement the plan.
It shows that our target, UnDerPass.htb, is a daloRADIUS server, which can be found in the . The default path for this web application is /daloradius. This will serve as the main directory used in further fuzz.
The default password of the dalo Radius can be found .
