Skip to main content
  1. CTF Writeups/

CVE-2023-6019

·220 words·2 mins
Muqaram Majid
Author
Muqaram Majid
Just jotting down my thoughts

CVE-2023-6019
#

Overview
#

  • OS: Linux
  • IP: 192.168.143.37
  • Difficulty: Intermediate
  • Platform: OffSec
  • OSCP: Yes
  • Lists: N/A

Summary
#

man this was literally the title and 1 click how is it intermediate.

Loot
#

Loot
CategoryDetails
Usernames
Passwords
Usernames+Passwords
Hashes
Service Versions

Enumeration
#

Nmap
#

22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 62:36:1a:5c:d3:e3:7b:e1:70:f8:a3:b3:1c:4c:24:38 (RSA)
|   256 ee:25:fc:23:66:05:c0:c1:ec:47:c6:bb:00:c7:4f:53 (ECDSA)
|_  256 83:5c:51:ac:32:e5:3a:21:7c:f6:c2:cd:93:68:58:d8 (ED25519)
9000/tcp  open  http    aiohttp 3.9.1 (Python 3.8)
|_http-title: Ray Dashboard
|_http-server-header: Python/3.8 aiohttp/3.9.1
36373/tcp open  grpc
36977/tcp open  grpc
37729/tcp open  grpc
38015/tcp open  unknown
38811/tcp open  grpc
41230/tcp open  http    WSGIServer 0.2 (Python 3.8.10)
|_http-server-header: WSGIServer/0.2 CPython/3.8.10
|_http-title: Site doesn't have a title (text/plain; version=0.0.4; charset=utf-8).
|_http-trane-info: Problem with XML parsing of /evox/about
44217/tcp open  http    WSGIServer 0.2 (Python 3.8.10)
|_http-server-header: WSGIServer/0.2 CPython/3.8.10
|_http-title: Site doesn't have a title (text/plain; version=0.0.4; charset=utf-8).
44227/tcp open  http    WSGIServer 0.2 (Python 3.8.10)
|_http-server-header: WSGIServer/0.2 CPython/3.8.10
|_http-title: Site doesn't have a title (text/plain; version=0.0.4; charset=utf-8).
|_http-trane-info: Problem with XML parsing of /evox/about
46711/tcp open  grpc
52365/tcp open  http    aiohttp 3.9.1 (Python 3.8)
|_http-server-header: Python/3.8 aiohttp/3.9.1
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
59137/tcp open  unknown
59484/tcp open  grpc

Dirbusting
#

Port 80
#

Exploitation
#

Once the primitive was confirmed, I converted it into a stable foothold and chained it forward.