Couch
Hey guys welcome to my first blog post & hopefully I’m able to write & share more!!
Feedback’s accepted :)
Ok now we have the vm running we can kick off with an nmap scan….
nmap -sV -A -p- -T4 -Pn 10.10.10.241 --max-retries=1 -oA nmap
# Nmap 7.91 scan initiated Wed Jun 30 19:20:40 2021 as: nmap -sV -A -p- -T4 -Pn --max-retries=1 -oA nmap 10.10.200.74
Warning: 10.10.200.74 giving up on port because retransmission cap hit (1).
Nmap scan report for 10.10.200.74
Host is up (0.17s latency).
Not shown: 64093 closed ports, 1440 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 34:9d:39:09:34:30:4b:3d:a7:1e:df:eb:a3:b0:e5:aa (RSA)
| 256 a4:2e:ef:3a:84:5d:21:1b:b9:d4:26:13:a5:2d:df:19 (ECDSA)
|_ 256 e1:6d:4d:fd:c8:00:8e:86:c2:13:2d:c7:ad:85:13:9c (ED25519)
5984/tcp open http CouchDB httpd 1.6.1 (Erlang OTP/18)
|_http-server-header: CouchDB/1.6.1 (Erlang OTP/18)
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Jun 30 19:31:50 2021 -- 1 IP address (1 host up) scanned in 669.86 seconds
forging forward;
looking at the service at port 5984, we can get a list of the database;
we can access the couch web gui here,
ofc you’re thinking the same as me cus a file “secret” from the list in the database looks sus so we take a look at it.
apparently we just found some creds by being curious, now what are the creds for? (take a look at the nmap scan results which shows port 22 being ssh open) Did you just have the same thought as me again? Heccer!!
we can login ssh with those creds
Here we are!!
Let’s get Root now.
digging into the kernel of the machine shows it’s an old version
Now exploiting Cve-2021-3493 to get root
And we have content or root.txt at last & we can answer the rest of the task questions 🎏
External refrences;
https://tryhackme.com/room/couch
https://book.hacktricks.xyz/pentesting/5984-pentesting-couchdb
https://lzone.de/cheat-sheet/CouchDB
https://muzec0318.github.io/posts/overlayfs.html
https://github.com/briskets/CVE-2021-3493
Enjoy Reading This Article?
Here are some more articles you might like to read next: