Brainfuck

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.17 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,25,110,143,443 10.10.10.17 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

There is an HTTPS website on port 443, and nmap reported that there are two subdomains called www.brainfuck.htb and sup3rs3cr3t.brainfuck.htb. Let's add both to the /etc/hosts file.

nano /etc/hosts

We can see with whatweb, that the website is a WordPress CMS.

whatweb https://brainfuck.htb

If we take a look at the website, we'll see a post made by the admin user, saying that the SMTP service is available, and the message include the orestis@brainfuck.htb email address.

The other domain name shows a forum page.

Let's run wpscan to enumerate the WordPress site.

wpscan --url https://brainfuck.htb -e vp --disable-tls-checks -o wpScan

  • --url URL of the WordPress site.

  • -e ap enumerate all plugins.

  • --disable-tls-checks disables SSL/TLS certificate verification.

  • -o save result to a file.

Exploitation

There is one plugin installed called wp-support-plus-responsive-ticket-system, in the 7.1.3 version. Let's search for any common vulnerabilities.

searchsploit wordpress plus responsive ticket 7.1.3

There is a way to escalate privileges. First, we'll have to make the index.html file with the following code.

nano index.html

Now, set an HTTP server on the current directory with PHP on port 1234.

php -S localhost:1234

  • -S run with built-in web server.

Now access the web server with the browser, and press the Login button.

If we access the /wp-admin directory, we'll be able to see the WordPress dashboard.

I tried ways to get remote command execution, like modifying the 404.php file, or uploading a custom plugin, but none of those worked. But if we go to the Plugins section, we'll see one called Easy WP SMTP.

In the Settings option, we'll see that the emails are sent by orestis@brainfuck.htb.

But we can also see the username orestis and the kHGuERB29DNiNE password.

Now that we have credentials for the SMTP server, let's see if there are any emails in the orestis user inbox.

nc 10.10.10.17 110

There are two emails. The first one just says that the WordPress site is available.

retr 1

But the second one have another credentials.

retr 2

These credentials are valid for login page of the forum website.

Now we can see three discussions.

The Key discussion looks to be encrypted.

It could be encrypted with the Vigenère cipher. There is one specific message where it looks like there is a URL.

Let's use dcode.fr to decode the message. Paste the message, and press on AUTOMATIC DECRYPTION.

In the results, we'll see a link to a private SSH key.

Download the id_rsa file from the link. If we take a look at the key, we'll see that it is encrypted. Let's try to break it with john. First, create a hash for the id_rsa file, and put it in the id_rsa.hash file.

ssh2john id_rsa > id_rsa.hash

Then, break it with john.

john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa.hash

Finally, give the id_rsa file the right permissions, and get a shell as the orestis user. Then we'll be able to grab the user flag.

chmod 600 id_rsa

ssh -i id_rsa orestis@10.10.10.17

Privilege Escalation

If we look in the current directory, we'll see a file called encrypt.sage with the following code.

cat encrypt.sage

There is also the debug.txt file with the values of the p, q and e variables.

cat debug.txt

And the output.txt file which contains the /root/root.txt file encrypted.

cat output.txt

We have all the values needed to calculate the root flag. Go to cryptool.org, and put the values of p and q.

Then, paste the value of e.

And the encrypted flag in the Ciphertext field. Make sure the arrow is pointing up.

Now, we'll have to convert the plaintext string to hexadecimal.

python3 -c "print(hex(24604052029401386049980296953784287079059245867880966944246662849341507003750))"

Finally, if we decode the string, all we have to do is reap the harvest and take the root flag.

echo "0x3665666331613564626238393034373531636536353636613330356262386566" | xxd -r -p

Last updated

Was this helpful?