Home

OverPass 3 - Hosting

Date: 20, May, 2021

Author: Dhilip Sanjay S

Click Here to go to the TryHackMe room.

Enumeration

Nmap

$ nmap -sC -sV -p- 10.10.213.153 -oN nmap-out
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-20 22:22 IST
Nmap scan report for 10.10.213.153
Host is up (0.19s latency).
Not shown: 65532 filtered ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 8.0 (protocol 2.0)
| ssh-hostkey: 
|   3072 de:5b:0e:b5:40:aa:43:4d:2a:83:31:14:20:77:9c:a1 (RSA)
|   256 f4:b5:a6:60:f4:d1:bf:e2:85:2e:2e:7e:5f:4c:ce:38 (ECDSA)
|_  256 29:e6:61:09:ed:8a:88:2b:55:74:f2:b7:33:ae:df:c8 (ED25519)
80/tcp open  http    Apache httpd 2.4.37 ((centos))
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.37 (centos)
|_http-title: Overpass Hosting
Service Info: OS: Unix

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 587.16 seconds

Gobuster

Overpass 3 - Hosting

Analysing backup.zip

  • Decrypting the CustomerDetails.xlsx.gpg file using the priv.key:

  • By opening the file using excel, we get the password of few accounts:

CustomerDetails.xlsx

Login into FTP

  • By using the passwords recently found, we can try to login into to ftp server.

  • P.S: The passwords didn't work for ssh.

Login as paradox

  • (Other two accounts didn't work.)

  • The files in this folder seems to be the web directory.

  • If we upload anything to this folder, then we can access it in the browser!

  • May be we should upload reverse-shell.php to this folder.

  • P.S: Make sure to change the IP address and port number.

Initial shell

  • Listen on the appropriate port using netcat.

  • Visit http://10.10.213.153/reverse-shell.php on the browser to get a reverse shell.

  • Upgrade the reverse shell:

Web Flag

Privilege Escalation (Apache to Paradox)

  • Try to switch to paradox user using the same password as that of ftp.

Running Linpeas

  • After running linpeas, we find the privilege escalation vector:

  • But the port 2049 is not open on the victim machine. We get the following errors:

  • Hence we must do port forwarding to exploit no_root_squash. (I didn't know how to proceed furher, so read a walkthrough to learn more about port forwarding.)

  • You can use SSH or Chisel for port forwarding.

SSH Port forwarding

  • Added ssh public key to the .ssh/authorized_keys file of paradox user.

  • Check if you can login using the private key:

  • Run port forwarding using ssh:

  • Don't close the ssh session with port forwarding, until you want to access the NFS.

User Flag

  • Mount the NFS to the attacker machine.

  • Now we have read, write permission inside that NFS.

Privilege Escalation (James to Root)

Private SSH key

  • We have the private key of James in the NFS.

  • We'll copy it to the attacker machine, so that we can login as james using ssh.

Bash binary with SUID

  • We need to find a way for privilege escalation.

  • Reading more about no_root_squash: This option basically gives authority to the root user on the client to access files on the NFS server as root. And this can lead to serious security implications.

  • So, we'll copy /bin/bash into the NFS and set SUID bit:

SSH login & Priv Esc

Root Flag

References

PreviousOverPass 2 - HackedNextMr Robot CTF

Last updated