search

DevOops

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.91 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,5000 10.10.10.91 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Website on port 5000 shows an Under construction! page.

Let's try to see if there are any subdirectories or hidden files.

gobuster dir -u http://10.10.10.91:5000/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 --no-error -x txt,php

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

hashtag
Exploitation

The /upload directory allow us to upload XML files with the Author, Subject and Content attributes.

Let's try to upload the test.xml file with the following XML code.

The file was uploaded successfully. As the values of the attributes are shown in the page, we could try to exploit an XXE to get an LFI. The following code will create an XML Entity which will load the /etc/passwd file, then show the content in the Author attribute.

There is one user called roosa. Let's try to get her id_rsa key.

Now, let's create an id_rsa file with that key, give it the right permissions, and log is as the roosa user. Then we could grab the user flag.

nano id_rsa

chmod 600 id_rsa

ssh -i is_rsa roosa@10.10.10.91

hashtag
Privilege Escalation

If we search for any git projects, we'll find one in /home/roosa/work/blogfeed/.

find / -name "*.git" 2>/dev/null

If we check the git log, we'll see one commit with the reverted accidental commit with proper key comment.

cd /home/roosa/work/blogfeed/

git log

If we check the content of the commit, we'll see two private SSH keys.

git show 33e87c312c08735a02fa9c796021a4a3023129ad

Let's try to log in as root with the first one.

nano /tmp/id_rsa

chmod 600 /tmp/id_rsa

We'll see that the key is valid, and then all we have to do is reap the harvest and take the root flag.

ssh -i /tmp/id_rsa root@localhost

Last updated