<h1>Metasploitable 3 Ubuntu Walkthrough: Part VII</h1>

Exploiting Port 6697 – Unreal IRCd

This service was already exploited in Metasploitable 2. But is it the same version?

It is not possible to determine the specific version running on Metasploitable3 but because there is only one exploit available in MSF, we better try it.

Like before, this is a very easy exploit:

This is a low privilege shell because boba_fett is not part of the sudo group. But he is also part of the docker group…

Exploiting Port 8181 – Ruby on Rails

The Ruby on Rails web application running on the system at port 8181 has a remote code execution vulnerability which can be exploited using the proper MSF module. However, this exploit requires knowledge of the secret used to sign the session cookie. How can we get that?

This is an important clue… cookies

Decoding cookie using Burp

Let’s capture the traffic with Burp Suite and see what we can find inside.

Fortunately, the web server conveniently sends us the secret in the Set-Cookie header.

Send everything to the decoder:

Now, use the smart decoder:

This will identify the breaks in the cookie code. Next, decode as Base64:

Andy you will have the cookie secret:

Now that we have the secret a7aebc287bba0ee4e64f947415a94e5f, we can use it to get our shell.

It is a root shell…!

Next post: