Routerspace

Attacking RouterSpace machine todayy.

Nmap scan

looking at the http port 80, we find a webpage with a link to download an apk file which we download back to local system, run it & proxy it through burpsuite

we download RouterSpace.apk

we can reverse or run through gui which we use here using anbox

we check the app & discover a check status button from the apk

so we setup proxy

adb shell settings put global http_proxy 192.168.31.208:8080

adb install RouterSpace.apk

observing the request with burpsuite;

tried some command injection & worked

i tried different ways to get shell but nothing cus “ip tables” then i looked in .ssh directory for any id_rsa key but nothing, i saw the directory is writeable,

so i generate & upload my public id_rsa key locally & upload to target .ssh directoy.

so generate ssh keys with ssh-keygen

save the content of id_rsa.pub as authorized_keys

give 700 permissions

now we can ssh with the keys

now we have shell access through ssh & here user.txt

now to get root, i noticed through linpeas result target is running vulnurable sudo version 1.8.31 / CVE-2021-3156

did some research & found some known public explot for it

now transfer exploit to target machine & run it and we are root!

TRANSFER FILE WITH SCP TO TARGET - sudo scp -i /Users/nerdy/.ssh/id_rsa exploit.py paul@10.10.11.148:.

###RESOURCES

https://app.hackthebox.com/machines/RouterSpace

https://github.com/worawit/CVE-2021-3156/blob/main/exploit_nss.py