As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.
The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:
-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oNsave the scan result into a file, in this case the allports file.
# Nmap 7.93 scan initiated Fri Mar 31 09:55:44 2023 as: nmap -sS --min-rate 5000 -p- -n -Pn -oN allPorts 10.10.10.176
Nmap scan report for 10.10.10.176
Host is up (0.046s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
# Nmap done at Fri Mar 31 09:55:57 2023 -- 1 IP address (1 host up) scanned in 13.41 seconds
Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:
nmap -sC -sV -p22,80 10.10.10.176 -oN targeted
-sC performs the scan using the default set of scripts.
-sV enables version detection.
-oNsave the scan result into file, in this case the targeted file.
# Nmap 7.93 scan initiated Fri Mar 31 09:56:19 2023 as: nmap -sCV -p22,80 -Pn -n -oN targeted 10.10.10.176
Nmap scan report for 10.10.10.176
Host is up (0.038s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 f7fc5799f682e003d603bc09430155b7 (RSA)
| 256 a3e5d174c48ae8c852c717834a5431bd (ECDSA)
|_ 256 e3626872e2c0ae46673dcb46bf69b96a (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
|_http-title: LIBRARY - Read | Learn | Have Fun
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Mar 31 09:56:27 2023 -- 1 IP address (1 host up) scanned in 8.24 seconds
Let's start by enumerating subdirectories and pages with gobuster.
gobuster dir -u http://10.10.10.176 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200
dir enumerates directories or files.
-u the target URL.
-w path to the wordlist.
-t number of current threads, in this case 200 threads.
The index.php page shows a login page where we can register a user.
Let's create a user and log into the website.
Once logged in, we'll see different sections. In the Contact Us section, we'll see the email of the admin user.
We can also modify our profile from View Profile.
From here we can change our username. Note that if we try to change our username to something like 123456789101112131415, it will get chopt to 10 characters.
Exploitation
This feature could lead to a SQL Truncation vulnerability. The idea is to register a new user with the email admin@book.htb ., so when it gets trimmed, The email will be admin@book.htb, and we'll be able to log in as admin. Create a new account with the name admin, the email admin@book.htb, and the password admin123.
Intercept the request with BurpSuite. Add some + characters, which are spaces base64 encoded, and a character at the end of the email parameter. Note the . characters after the +.
As the email gets trimmed, we just registered the admin user with the admin123 password. Log in with those credentials.
Now we are logged in as the admin user.
And these credentials are also valid for the login page in the /admin directory.
In the /admin/collection.php we can see a link to a PDF.
This PDF file contains a list with all the available collections.
We could try to inject a malicious payload into the dynamic PDF file generated from the /collections.php page. As the title of the collection is represented in the dynamic PDF, we could inject some code into the title, which will show the content of a file. In this case, we could start by listing the content of the /etc/passwd file. Inject the following code in the Book Title field and submit it together with a sample PDF file.
Get a shell as reader, and then we'll be able to grab the user flag.
ssh -i id_rsa reader@10.10.10.176
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 5.4.1-050401-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Fri Mar 31 16:11:58 UTC 2023
System load: 0.01 Processes: 211
Usage of /: 52.5% of 5.77GB Users logged in: 0
Memory usage: 12% IP address for ens160: 10.10.10.176
Swap usage: 0%
* Canonical Livepatch is available for installation.
- Reduce system reboots and improve kernel security. Activate at:
https://ubuntu.com/livepatch
109 packages can be updated.
0 updates are security updates.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
Last login: Wed Jan 29 13:03:06 2020 from 10.10.14.3
reader@book:~$ whoami
reader
reader@book:~$ cat user.txt
1d5cdb229e4d55a9afab32881d8f6d63
Privilege Escalation
There is a directory called backups in the home directory of the reader user.
ls -l /home/reader
total 8
drwxr-xr-x 2 reader reader 4096 Jul 20 2021 backups
-r-------- 1 reader reader 33 Mar 31 15:13 user.txt
Which contains a few log files.
ls -la /home/reader/backups/
total 12
drwxr-xr-x 2 reader reader 4096 Jul 20 2021 .
drwxr-xr-x 6 reader reader 4096 Mar 31 16:11 ..
-rw-r--r-- 1 reader reader 0 Jan 29 2020 access.log
-rw-r--r-- 1 reader reader 91 Jan 29 2020 access.log.1
Maybe there is some kind of background jobs generating them. Let's upload pspy64 to the machine, and see the background processes. Set a simple HTTP server where the pspy64 binary is located.
As we can see, root is running the logrotate binary. As we can see, there is an exploit which allows . First, we need to create the payload file, with bash code that will give the /bin/bash binary SUID privileges.
