A penetration test for Kingsoft games

I just wanted to see if there is any injection in a backend of Kingsoft that can be bypassed. Who knows...
The next step is the Elevation of Privilege among various game servers. The server connects to the Intranet, but does not continue penetration. The games involved include the legend of the Moon and the second-class swordsman. Some games in Kingsoft are quite good>. <

Penetration starts here. Kingeyes game Operation System: https://keyes.xoyo.com/admin

 

Well, I just wanted to see if there is any injection in the background that can be bypassed. Who knows that commands can be remotely executed. 0.0

I scanned the artifacts with WVS to see if I could scan some injection points or sensitive directories. Many directories are scanned, but most of them are open blank.
For example, if you directly access https://keyes.xoyo.com/admin/view/machines/query.php, a blank area is displayed.

 

But what, don't know what's going on, accidentally put the https://keyes.xoyo.com/admin/view/machines/query.php
Changed to https://keyes.xoyo.com/admin/machines/queryand then miraculously appeared (with the view and php suffix removed), various game servers.

 

We can speculate that other links can also be modified in this way. Change https://keyes.xoyo.com/admin/view/shell/index.php
Https://keyes.xoyo.com/admin/shell

 

This interface can directly execute system commands or root permissions.
Enter the IP address and port number of the server as shown in the target and port fields. It may be more than 100 servers.

 

There are about 100 Lin servers. After reading it, port 22 is opened, but most of them cannot be accessed from the Internet. It should be blocked.
There are about seven or eight Win servers. Some servers are open to the outside, so I decided to Win the Win server first and then jump from Win to Lin.

Find a server with 3389 enabled, 59.37.172.45, and add an administrator account. After the Remote Desktop is logged on, the firewall is bypassed. Other Win servers can be obtained through this server.

 

After logging in, we found that the server has an intranet address (172.20.21.2) but no gateway.

 

Isn't Lin server having no gateway? So I looked at it and did not. It can be inferred that these server groups are placed in their respective VLANs without communication between them.

 

In this case, the root permission of the Lin server can only be obtained through that interface address.
Find a server that opens SSH to the outside world (Good luck) 118.26.237.113.
Directly execute useradd to report an error. It turns out to be an environment variable problem. You can use the absolute path for execution.
For example:/usr/sbin/useradd root0-p root0

 

It is found that ssh cannot be logged on. viewing user attributes allows logon, and pam is not enabled to restrict logon accounts. Are there other restrictions?
However, it's time to continue. I am sorry for the unauthorized penetration. >. <

Solution:

You should understand.