$ sudo nmap -sV -sC -PN -sU -p 53,69,161,162,10161,10162,623 10.10.11.48
[sudo] password for kali:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-10 16:41 CEST
Nmap scan report for 10.10.11.48
Host is up (0.029s latency).
PORT STATE SERVICE VERSION
53/udp closed domain
69/udp closed tftp
161/udp open snmp SNMPv1 server; net-snmp SNMPv3 server (public)
| snmp-info:
| enterprise: net-snmp
| engineIDFormat: unknown
| engineIDData: c7ad5c4856d1cf6600000000
| snmpEngineBoots: 31
|_ snmpEngineTime: 3m26s
| snmp-sysdescr: Linux underpass 5.15.0-126-generic #136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64
|_ System uptime: 3m26.53s (20653 timeticks)
162/udp closed snmptrap
623/udp closed asf-rmcp
10161/udp closed snmpdtls
10162/udp closed snmpdtls-trap
Service Info: Host: UnDerPass.htb is the only daloradius server in the basin!
The web server on port 80 doesn't appear to be configured and only presents the default Apache2 page:
Attempted to fuzz the site with FFuF to uncover any unexpected files or directories, but found none.
False positive
Any file ending in .phps is reported as a HTTP 403 error. For instance, the file wp-forum.phps appears in the web root:
Navigating to the URL in a web browser works and also returns a HTTP 403 error. However, with no other traces of WordPress, this is just a false positive.
The SNMP service can be enumerated using snmpwalk:
$ snmpwalk -v2c -c public underpass.htb
iso.3.6.1.2.1.1.1.0 = STRING: "Linux underpass 5.15.0-126-generic #136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (311329) 0:51:53.29
iso.3.6.1.2.1.1.4.0 = STRING: "steve@underpass.htb"
iso.3.6.1.2.1.1.5.0 = STRING: "UnDerPass.htb is the only daloradius server in the basin!"
iso.3.6.1.2.1.1.6.0 = STRING: "Nevada, U.S.A. but not Vegas"
iso.3.6.1.2.1.1.7.0 = INTEGER: 72
iso.3.6.1.2.1.1.8.0 = Timeticks: (1) 0:00:00.01
...
The SNMP tree on the host is pretty small. The lines above are more or less the only ones of interest. The highlighted line is somewhat cryptic, but it contains valuable details:
The capialized letters in the doman name make out the acronym UDP.
the only daloradius server hints at there being a daloRADIUS instance on the host.
RADIUS is an authentication protocol that runs on ports 1812/UDP and 1813/UDP:
$ curl -L underpass.htb/daloradius
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.52 (Ubuntu) Server at underpass.htb Port 80</address>
</body></html>
It's not non-existent, so there might be other files and directories hidden in the /daloradius subdirectory that could be useful.
Used FFuF to discover additional files and directories under /daloradius:
The .gitignore suggests that the /daloradius subdirectory is a cloned Git repository. Which repository it is, is clear by the contents of ChangeLog, which matches exactly with the ChangeLog file from the official daloRADIUS repository:
Using the daloRADIUS repository as a guide, there should be two separate login frontends for users and operators. Of course, the operator login is the more interesting one of the two:
Foothold
The default credentials (administrator:radius) from the daloRADIUS documentation are valid for logging in to the daloRADIUS web UI:
The dashboard lists a single user, svcMosh, with a corresponding MD5 hashed password:
svcMosh@underpass:~$ sudo -l
...
User svcMosh may run the following commands on localhost:
(ALL) NOPASSWD: /usr/bin/mosh-server
mosh-server is a server-side application for Mosh, a remote terminal application.
When executed, mosh-server starts listening on a high-numbered UDP port and provides a key for connecting. While this normally doesn't require root privileges, the way it's set up on the host creates an opportunity for privilege escalation.
The method is described here. Essentially, it involves standing up a mosh-server instance as root and then using mosh-client to connect to the instance on localhost:
