search
Home

VulnNet

Date: 22, May, 2021

Author: Dhilip Sanjay S

Click Herearrow-up-right to go to the TryHackMe room.

hashtag
Enumeration

  • Add vulnnet.thm to the /etc/hosts file.

hashtag
Nmap

nmap -sC -sV -p- 10.10.215.172 -oN nmap.out
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-22 18:47 IST
Stats: 0:12:23 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 81.65% done; ETC: 19:02 (0:02:47 remaining)
Nmap scan report for 10.10.215.172
Host is up (0.15s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ea:c9:e8:67:76:0a:3f:97:09:a7:d7:a6:63:ad:c1:2c (RSA)
|   256 0f:c8:f6:d3:8e:4c:ea:67:47:68:84:dc:1c:2b:2e:34 (ECDSA)
|_  256 05:53:99:fc:98:10:b5:c3:68:00:6c:29:41:da:a5:c9 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: VulnNet
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 908.61 seconds

hashtag
Gobuster

VulnNet Home

hashtag
Other Vhosts

  • By analysing the javascript file:

  • So, there must be another virtual host. So, added broadcast.vulnnet.thm to /etc/hosts file.

  • But it requires authentication to access the page:

VulnNet - Broadcast

  • By running gobuster vhost:

  • Add gc._msdcs.vulnnet.thm to /etc/hosts file.

  • But, we get 400 error on that page too:

VulnNet - gc._msdcs.vulnnet.thm

hashtag
Analysing JS files in vulnnet.thm

  • By analysing JS files, we see that there is a referer parameter in the request.

  • So, I tried to include a remote url ?referer=http://broadcast.vulnnet.thm in the referer parameter, which gave the same index.php as the output.

  • By setting ?referer=login.html, we get the login.html source code inside index.php:

referer=login.html

hashtag
Fetch /etc/passwd

  • May be we can try to read local files by setting ?referer=/etc/passwd, we get the passwd file inside index.php:

Fetch /etc/passwd

hashtag
Locating .htpasswd

  • By setting ?referer=/etc/apache2/sites-enabled/000-default.conf (default config) file, we get the location of .htpasswd:

Locating .htpasswd

hashtag
Fetch /etc/apache2/.htpasswd

  • By setting ?referer=/etc/apache2/.htpasswd, we get the some username and password hash:

Locating .htpasswd

  • May be they are credentials for broadcast.vulnnet.thm.

hashtag
Cracking the hash

  • Use hashcat to crack the obtained hash:

  • Using developers:REDACTED, we are able to access broadcast.vulnnet.thm.

VulnNet - Clipbucket v4.0

hashtag
Gobuster on broadcast.vulnnet.thm

  • Oof! Too many php files to check! And none of them were promising.

  • P.S: I spent almost an hour looking through those php files :-(

  • Once a wise man told me to check for service exploits. We'll check for clipbucket exploits in searchsploit:

  • Mmmmm, Unauthenticated Arbitrary file Upload. That's exactly what we want to upload reverse shell code!

hashtag
Initial Shell

hashtag
Upload Reverse Shell

  • Copy the php-reverse-shell.php and change the IP address and Port.

  • Now upload using the exploit code (just change the file name and Authorization header)

  • P.S: This authorization header is for accessing http://broadcast.vulnnet.thm. It's not the authorization for clipbucket.

hashtag
Capture & Upgrade the shell

  • Listen on the appropriate port using netcat.

  • Now visit http://broadcast.vulnnet.thm/files/photos/2021/05/22/16217114086733f6.php to get the reverse shell:

  • Upgrade the shell:

hashtag
Running Linpeas

  • Download linpeas.sh on the target machine & execute it

  • Linpeas gave away two things:

  1. Cron job running a script /var/opt/backupsrv.sh:

  1. SSH backup of server-management user is inside /var/backups/ directory:

hashtag
Privilege Escalation (www-data to server-management)

hashtag
Obtaining the Private SSH Key

  • Copying and extracting ssh-backup.tar.gz:

  • Now we can SSH login using the private key.

  • But unfortunately it's encrypted.

hashtag
Bruteforcing the passphrase

  • Bruteforce the passphrase using ssh2john and john:

hashtag
User.txt

  • Now we have the SSH Private Key and the passphrase.

  • Login into the target machine as server-management user:

  • Cat the user.txt file:

VulnNet - User

hashtag
Privilege Escalation (server-management to root)

hashtag
Cron Job - script

  • Cat the script file /var/opt/backupsrv.sh executed as root user in the crontab.

  • It's copying the files inside /home/server-management/Documents directory (with a wildcard match) and saving it as .tgz file in the /var/backups directory.

  • Initially I tried to do path hijacking and was fumbling around!

  • Finally got this: Tar - Execute arbitrary commandsarrow-up-right

hashtag
Exploiting tar

  • Insert malicious code into exploit.sh and also the arbitrary command execution payload!

  • Malicious code:

    • chmod +s /bin/bash (or)

    • echo "server-management ALL=(root) NOPASSWD: ALL" > /etc/sudoers

  • Wait for 2 mins for the cron job to execute the script!

hashtag
Root.txt

  • Check if the permissions on /bin/bash have changed.

  • Once the SUID bit is set, you can run /bin/bash -p to become root!

  • Cat the root.txt file:

VulnNet - Root

hashtag
References

PreviousMr Robot CTFNextLinux PrivEsc

Last updated