Healthcare: 1 Walkthrough
reference | Healthcare: 1 |
target ip | 192.168.1.26 |
Scan with nmap
:
![nmap](/2020/09/06/healthcare-1-522/nmap.png)
Enumerate HTTP with gobuster
:
![gobuster](/2020/09/06/healthcare-1-522/gobuster.png)
Combine these two exploits together:
- CVE-2015-4453 - Authentication bypass in OpenEMR
- CVE-2014-5462 - Multiple Authenticated SQL Injections In OpenEMR
Save the request:
![sqli.req](/2020/09/06/healthcare-1-522/sqli.req.png)
SQLi with sqlmap
to extract table openemr.users:
![sqlmap](/2020/09/06/healthcare-1-522/sqlmap.png)
Crack with john
:
![users](/2020/09/06/healthcare-1-522/users.png)
Login into FTP to upload a reverse shell on /var/www/html/openemr
:
![rs.php](/2020/09/06/healthcare-1-522/rs.php.png)
Reverse shell:
![rs](/2020/09/06/healthcare-1-522/rs.png)
Escalate from user apache to user medical:
![medical](/2020/09/06/healthcare-1-522/medical.png)
Escalate from user medical to user almirant.
Download /var/backups/shadow
:
![ftp_shadow](/2020/09/06/healthcare-1-522/ftp_shadow.png)
Crack with john
:
![shadow](/2020/09/06/healthcare-1-522/shadow.png)
/home/almirant/user.txt
:
![user.txt](/2020/09/06/healthcare-1-522/user.txt.png)
Escalate from user almirant (or medical) to user root.
/usr/bin/healthcheck
:
![healthcheck](/2020/09/06/healthcare-1-522/healthcheck.png)
Privilege escalation:
![root](/2020/09/06/healthcare-1-522/root.png)
/root/root.txt
:
![root.txt](/2020/09/06/healthcare-1-522/root.txt.png)