EXPLORE
10.10.10.247
Last updated
10.10.10.247
Last updated
nmap-auto 10.10.10.247 all
The only port is an ssh port open at 2222. It runs a independent service called "SSH-2.0-SSH Server - Banana Studio". Trying to access it requires entering a password, maybe there's something else. The full scan shows some other notable ports open, 5555 being a common port for android access using ADB. Then there's also an number of open ports such as 42135 and 59777 which are running interesting http like services on them. The service enumeration also confirms that the device is a phone.
As part of my nmap-auto scan, it also conducts gobuster and nikto scans on applicable services such as http or https. The gobuster scan for port 59777 shows that there are a number of directories that exist but have "FORBIDDEN: No directory listing" blocks when trying to access on a web browser. Even if a web browser can't access it, maybe a formatted curl command can get past it. It also gives a good description of the directory structure that exists.
Okay, there's a lot of information to look at. The three services that need to be looked at are the following:
2222: SSH-2.0-SSH Server - Banana Studio
42135: ES File Explorer Name Response httpd
59777: Bukkit JSONAPI httpd for Minecraft game server 3.6.0 or older
curl --header "Content-Type: application/json" --request POST --data '{"command":"<es-file-explorer-command>"}' http://<target-ip>:59777
curl --header "Content-Type: application/json" --request POST --data '{"command":"getDeviceInfo"}' http://10.10.10.247:59777
The script is really just a more user friendly option of the above that allows a more clear understanding of what is going on. The following is the downloaded poc script:
The script requires a few libraries, so make sure to pip install those i.e. requests, pylint, autopep8. Using the correct format to execute a command python3 poc.py --host [target] --cmd [cmd], it's now easy to enumerate the target. The following is a collection of the different command output:
python poc.py --host 10.10.10.247 --cmd <cmd>
There are quite a few notable things in the output:
the ftpRoot is "/sdcard"
the listFiles command shows a number of interesting folders: lib, vendor, system, sys, storage, sdcard, sbin, mnt, etc, dev, data, config, bin, acct, ...
the listPics command has a photo called "creds.jpg", this has got to be something
First, let's pull the file called "creds.png", maybe it has something useful like a password for the ssh port.
python3 poc.py --host 10.10.10.247 --get-file /storage/emulated/0/DCIM/creds.jpg
Viewing it with xdg-open creds.jpg shows what looks like a username/password combination written on notebook paper:
username: kristi password: Kr1sT!5h@Rp3xPl0r3!
Maybe now it's possible to ssh into the box.
ssh kristi@10.10.10.247 -p 2222
Password: Kr1sT!5h@Rp3xPl0r3!
Great! The credentials worked and now the shell can be accessed. Since I'm not too familiar with the file structure of an android, I spent a while enumerating the machines directories. Noticing that the ftpRoot was "/sdcard", I decided to go look there. In it was what looked like user data as well as the user.txt file.
user.txt: f32017174c7c7e8f50c6da52891ae250
After enumerating the shell obtained through ssh, it seems like there isn't a lot more to use. Since "Android Debug Bridge" (ADB) exists on port 5555 and is known as a privilege escalation method to get root, it's probably the route that needs to be taken. The biggest block in the beginning is that it's a filtered port so connecting from the localhost isn't possible. However, since ssh-ing into the box can be accomplished, port 5555 can now be accessed using port forwarding. Instead of doing a simple ssh command like the one used above, use ssh with local port forwarding to link the ports of the target and the localhost. This will make it so that when the user tries to access the target port, it can be accessed through the linked port on the localhost thus bypassing the filter.
ssh kristi@10.10.10.247 -p 2222 -L 5555:localhost:5555
adb connect localhost:5555
adb shell
Awesome, escalating to root on adb was allowed! Now all that's left is to find the root.txt and this box is pwned. Using the command find / -iname "root.txt" 2>/dev/null showed exactly where it is at "/data/root.txt".
root.txt: f04fc82b6d49b41c9b08982be59338c5
The first service I checked is the "ES File Explorer Name Response" on port 42135. Googling the service, I found a vulnerability known as CVE:2019-6447 or [ES File Explorer 4.1.9.7.4 - Arbitrary File Read](). The github page itself is pretty verbose on the exploit documentation. It seems like it works by starting an HTTP server on port 59777. It shows that the actual command that is used to exploit the server is the following curl command (the second is an example using the command "getDeviceInfo" on the actual target):
