UpDown
Gaining Access
Nmap Scan:
$ nmap -sC -sV -Pn -oN nmap 10.10.11.177
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-15 09:06 +08
Nmap scan report for 10.10.11.177
Host is up (0.046s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 9e:1f:98:d7:c8:ba:61:db:f1:49:66:9d:70:17:02:e7 (RSA)
| 256 c2:1c:fe:11:52:e3:d7:e5:f7:59:18:6b:68:45:3f:62 (ECDSA)
|_ 256 5f:6e:12:67:0a:66:e8:e2:b7:61:be:c4:14:3a:d3:8e (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Is my Website up ?
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.84 secondsPort 80
There is a website running at port 80.
After enumerating the website, it is a website that test whether a website is up by sending a GET Request to the server. This is confirmed after trying with my own IP.
So the possible command that the server is running in the backend, it can be
curl <USER INPUT WEBSITE>
However, when I tried to inject some normal command injection payload to test it will generate any errors, it will return Hacking attempt was detected!. This means that it will detect any payload that contains $, ', ; , & | " \ { } ( )
However, after much enumeration, the website seems to be a dead end. So I tried to find if there is any subdirectories and sure enough there was a dev folder.
Further enumeration is done on the dev subdirectory, there is a .git subdirectory on the website
After seeing that there is a .git folder, we used git-dumper to dump out the git file
After looking through the logs, there was a weird looking comment mentioning about the dev vhost in the git commits.
So we went into the commit and see what is the changes being made using git diff bc4ba79e596e9fd98f1b2837b9bd3548d04fe7ab
We found out that there is a special header that is required to set in order to get into website in the dev vhost.
So I added this line into /etc/hosts
So we tested if we can reach the website and sure enough, we am able to reach but it returns me the forbidden HTTP error code.
So next, we try to insert the special header into it and see if there any difference.
Sure enough, we manage to return the website.
File Inclusion RCE
The code does not allow uploading of zip file, but the application will crash when the extension is not in ASCII format. This allows us to maintain the file in the program.
So what we did next was to try using this method to gain RCE.
So, we created info.php with phpinfo() inside to test if this will run.
Then, we zip the file and uploaded it.
Next, we used the phar wrapper to access the files in the zip file.
Finally, we can see phpinfo on the website which means this works.
Getting into www-data
After looking at the disabled functions in phpinfo, we can see proc_open is not disabled.
Since proc_open is not disabled, we can use it create a reverse shell. From the screenshot below, we only need the first 3 values.
So the reverse shell we have generated for the php file is this:
After rezipping and uploading the zip file as what we did just now for the phpinfo portion, it will return a reverse shell when we visit the php page using the phar wrapper.
Getting User
Exploiting the SUID executable
After enumerating the www-data user, there is a SUID file that looks very interesting.
After going to that folder, there is a .py file together with that executable. By viewing the content of the .py file, we can see that this is a python2 code that checks if the website is up or down.
However, there is an issue with python2's input function as it is very similar to eval function. Hence, we are able to exploit this by entering this as the payload to let us create a shell as develop.
After getting access as developer user, we can get the private key of the user
After getting the private key of the user, we can just login as the user itself using ssh
Getting root
Exploiting easy_install using sudo
After running linpeas.sh on the target machine, we can see that there is a binary we can use to exploit using sudo.
After checking the GTFOBins if the binary has a way to get root using sudo, there is a method to get root using sudo.
After running these commands, I am able to get a shell as root and get the root.txt flag out.
Last updated