Explore

#Android #Enumeration #Port-Forwarding #ESFileExplorer #ADB

Explore is an easy-rated Android machine from HackTheBox created by Bertolis. It was hard to find the exploit. I don't have previous experience with attacking Android machines. You can use Metasploit on this machine, but there are still alternatives to exploit the vulnerability. For privilege escalation, the only technique used is Port Forwarding. In the current post, my IP is 10.10.14.52, and the target IP is 10.129.188.159.

Gathering Information

First, we are going to start with checking if the machine is alive, then do the classic reconnaissance to get some general information about the target.

Local Terminal
ping -c 1 10.129.188.159


Pinging 10.129.188.159 with 32 bytes of data:
Reply from 10.129.188.159: bytes=32 time=152ms TTL=63
Reply from 10.129.188.159: bytes=32 time=162ms TTL=63
Reply from 10.129.188.159: bytes=32 time=161ms TTL=63
Reply from 10.129.188.159: bytes=32 time=168ms TTL=63

Ping statistics for 10.129.188.159:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 152ms, Maximum = 168ms, Average = 160ms

The machine is working, by the "Target Description" we know that is an Android device, but without that information we can think at first glance that is a Linux Machine (TTL <= 64)

Local Terminal
nmap -p- -sS --min-rate 5000 --open -vvv -n -Pn 10.129.188.159 -oN PortScan

Nmap scan report for 10.129.188.159
Host is up, received user-set (0.16s latency).
Scanned at 2023-05-08 18:34:29 Pacific SA Standard Time for 14s
Not shown: 65530 closed tcp ports (reset), 1 filtered tcp port (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE      REASON
2222/tcp  open  EtherNetIP-1 syn-ack ttl 63
42135/tcp open  unknown      syn-ack ttl 63
42239/tcp open  unknown      syn-ack ttl 63
59777/tcp open  unknown      syn-ack ttl 63

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 14.61 seconds
           Raw packets sent: 70480 (3.101MB) | Rcvd: 70426 (2.817MB)

That's a lot of information, we are going to explore every http port first.

  • Browser: http://10.129.188.159:2222

Nothing

  • Browser: http://10.129.188.159:42135/

Nothing

From the basic gathering, beside than the target being a phone, thanks to the second nmap scan, we don't have a lot of relevant information. Now we have to search information about: "Banana Studio" and "ES File Explorer" to learn about the target.

Output: "https://www.exploit-db.com/exploits/50070", we don't know if this version is vulnerable, but we doesn't lose anything by trying.

Exploitation

All right, let's try if it works!

It works! but there is nothing relevant here, let's try with another command.

Perfect, we find the path of a credential related file, and in the 50070.py there is a command to download files.

A weird way to get receive the password, now we can try to connect through ssh {kristi : Kr1sT!5h@Rp3xPl0r3!}

And we are in, now it's time to find the user flag.

Nothing, this means that the flag is inside the SSD.

Privilege Escalation

After exploring the whole machine, the way to solve it was by using "Port Forwarding"

If we compare with nmap, there is a new working port, the "5555", by default in android devices this port is ADB, and it's running, so we can try to use it, open a new local terminal.

After connecting, you want to connect to the target port 5555, to see if is working, open a new local terminal.

If this works, that means that you can use the port 5555 as if were yours.

PreviousCapNextForest

Last updated