search

BountyHounter

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.11.100 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80,8065 10.10.11.100 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we take a look at the website, we'll see a basic website with irrelevant information.

Let's try to enumerate subdirectories with gobuster.

gobuster dir -u http://10.10.11.100 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 -x txt,php

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

If we take a look at the /portal.php directory, we'll see a message saying that the portal is under development, and it shows another page in /log_submit.php.

Let's take a look at the /log_submit.php page.

Let's try to fill of the input fields with the test word and hit on Submit.

hashtag
Exploitation

It looks like the input is being represented by the server in the server response. Let's take a look at how the requests are being made. Intercept the request with BurpSuite, and send it to the repeater.

The POST request is sending a URL and Base64 encoded message. We can decode the message in BurpSuite by selecting the entire message, and pressing Ctrl+Shift+U to URL decoded it, and then Ctrl+Shift+B to base64 decode it. We should see an XML message.

At this point, we could try to do an XXE attack.

circle-info

The XXE attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

In order to get the /etc/passwd file, we could create an external entity which will load a specific file.

If now we encode it to base64 with Ctrl+B and then encode it to URL with Ctrl+U, and then send the request, we should see the /etc/passwd file in the server response.

Now, we could see the content of the db.php file which we found on the subdirectories enumeration with gobuster. We'll have to use the wrapper php://filter/convert.base64-encode/resource=db.php so we get the content of the file base64 encoded.

If we decode the base64 string in the server response, we'll see some credentials.

Now, we could try to log in via SSH with the user development we found in the /etc/passwd file, and the password m19RoAU0hP41A1sTsq6K. Then, we could grab the user flag.

sshpass -p 'm19RoAU0hP41A1sTsq6K' ssh development@10.10.11.100

hashtag
Privilege Escalation

If we take a look at the sudo permissions, we'll see that we can execute a script with Python3.8 as the root user.

sudo -l

Let's see the script permissions.

ls -l /opt/skytrain_inc/ticketValidator.py

We can only read the script. Let's take a look at it.

Basically, the script is reading a file. That file should have the .md extensions, and it should start with the following lines.

The next line should be ** followed by a number that if divided by 7, the remainder should be 4, for example the 11. Then it should end with a + sign followed by a random number.

Then, the script uses the eval() function. We could exploit this function, so when we execute the script, we will get a shell as root. The final test.md file should look like this.

If we execute the script with sudo privileges, and indicate the test.md file, we should get a shell as the root user. And then all we have to do is reap the harvest and take the root flag.

sudo /usr/bin/python3.8 /opt/skytrain_inc/ticketValidator.py

Last updated

Was this helpful?