HacktheBox - Kotarak - Retried
Recon
Let's use threader3000 for our recon scan. It's a threaded scanner written in python that does a super quick up/down scan on all TCP ports, then suggests a nmap scan based on the results. It will automatically save the nmap scan results as XML, then we can convert it to HTML
Looks like we have a few ports open
Let's check out port 8080 first.
Just a 404, let's see if we can find anything else with dirb
We didn't find a lot here.
---- Scanning URL: http://kotarak.htb:8080/ ----
+ http://kotarak.htb:8080/docs (CODE:302|SIZE:0)
+ http://kotarak.htb:8080/examples (CODE:302|SIZE:0)
+ http://kotarak.htb:8080/favicon.ico (CODE:200|SIZE:21630)
+ http://kotarak.htb:8080/host-manager (CODE:302|SIZE:0)
+ http://kotarak.htb:8080/manager (CODE:302|SIZE:0)
GENERATED WORDS: 4612
What about the port 60000 that we found what do we see there?
This looks promising, there is an Admin section too……
Unfortunately it's not a live link and doesn't take us anywhere.
Let's try dirb on this port.
We have the same index.php that we landed on when we went to port 60000 and then also an apache info.php configuration page.
Let's try to plug google into the input box and see what happens.
We can see it in the path but nothing shows on the page.
But do you see the URL bar……
Whenever I see some thing like this my mind immediately jumps to Local File Inclusion or Remote File Inclusion.
If we try to get to /etc/passwd there are a lot of tricks to try
Something like this, adjusting the relative depth to read the /etc/passwd
We can try to add a null byte to the end to see if that does anything %00
Trying about 3 dozen different modifications of this we still don't see the etc/passwd file.
What about RFI (Remote FIle Inclusion)
How can we test this?
The easiest thing to do is to run a webserver and enter our URL and see if the server will reach out and grab the file.
For this test let's use updog.
If you don't have it installed just do
Then just start it from a directory that has files in it, so we can serve the files up to kotark.
If we start it from the kotarak directory we should have the HTML output of our nmap scan in there to serve.
Once updog is running let's put in our URL for the nmap file we have
Now if we put that in we can see that the server did in fact reach out to us and did a get request on the html file we had
So that's cool, what can we do with that?
If we spend some time trying to upload webshells here or getting reverse shells here, we probably won't have much luck ( I didn't anyway)
What else might we be able to leverage this for?
What about getting access to things on the local machine that we don't have access to externally?
So basically turn the RFI into a LFI
Let's test with the one thing we go get access to on port 80 the favicon.icon file.
Let's try
Well we got something back… I can only assume this is the contents of the icon file
We can test this by adding some random characters to the end of the file name and see if we get back something like this or a 404 page.
A 404 like we expected…..
Now what?
Now, lets try other ports to see if there is anything we can get to using this tool.
We can write a little python script to try every TCP ports and if curl receives any response to write those port numbers out to a txt file that we can then use to check out those new findings.
Hey it's ugly…. But it works, so that makes it beautiful right?
Here is a sample of what it looks like while running.
This takes a little while to go through all TCP ports
After the script completes let's take a look at the output file curlresults.txt
Now let's put these back into the URL they let us
We get a under construction page on 90, similar things on 110, 200
However we get a login screen on port 320
Interesting, what about the other ports?
Port 888
Looks like a file explorer, these ports keep getting better. What about the last one 3306?
Interesting… Let's go back to 888
If we click on backup, it strips out our rewrite to local host
http://kotarak.htb:60000/url.php?doc=backup
So let's use curl to put it all together.
Oooooooh looks like we got a user/pass in there
cool
Didn't we see a tomcat manager page on port 8080 in our dirb results?
http://kotarak.htb:8080/manager
When we try to put it up it tells us to use /html
http://kotarak.htb:8080/manager/html
We got a login screen, let's try our newly found user/password.
Exploit
Now if you have read my other writeup for Jerry we know that we can make a malicious war file upload it here and probably get our shell.
Let's user msfvenom to create our war file
Set Up our listener on our kali box
Then use the upload feature to load up our war file
Then if we click on our application we will hopefully get our shell
And we do
We got our shell as tomcat let's upgrade it
Cool
Poking around in the /home directory we can see a folder for tomcat here is what it contains.
If we follow that to_archive directory we find it leads to another directory named pentest_data
Which contains two files.
This sounds like it could be interesting let's copy the files to our kali box using netcat
On our kalibox let's setup a listener to accept the file
Then on Kotarak we can send the file using netcat as well
And we will use the same method to grab the other .bin file after this transfer completes.
Then on Kotarak.
Now we have the files locally and can see if we can figure out what they are.
Let's use file to see if we can get any info about this .dit file
Windows? .dit ??? could this be a copy of an ntds.dit file?
Let's check out file2
A registry file?
The folder said pentest… is the SYSTEM registry hive and the ntds.dit file that a penetration tester was able to get off a windows system on this network? If so maybe we can get the passwords out of here and maybe they re-used them on this box.
Password re-use FTW
Ok so now that we think they are these files let's use impacket's secretsdump.py to get the hashes out of these files.
Let's rename these files we downloaded
Now we can dump out this hashes to a file name /hashes
Since we told it to output to a file named hashes it created hashes.ntds file for us
The only two users here are Administrator and atanas.
Let's delete out all the other hashes so we just have the two we are interested in.
So we are left with in a file named user.txt
Now we can feed this into hashcat to see if we can get a password.
Ok it says it got 1 of two passwords, let's see what is in our cracked file
That was the administrator hash
Let's try to su to root on this box using that password
Nope
Ok what about atanas?
Great that worked let's get a user.txt
Great let's try to escalate to root
We can access the /root folder
And we can read flag.txt
There is another file here call app.log
It looks like a GET request to download a file named archive.tar.gz from an IP address of 10.0.3.133 every two minutes.
So we can guess this is a cron job that is making this request, since it happens exactly two minutes apart.
Ifconfig shows a interface that is on the same subnet as the computer that is making the request
A quick google search on wget exploit and we come across this POC
https://www.exploit-db.com/exploits/40824
Let's start up a netcat on port 80 to see if we can still see the GET request coming in.
Well it turns out that regular users are not allowed to bind to ports under 1024, only root can bind to those ports….
Let's google for nc bind port 80, to see if we can figure out a way around this.
We would come across this posting.
https://serverfault.com/questions/112795/how-to-run-a-server-on-port-80-as-a-normal-user-on-linux
Which mentions with the use of authbind we should be able to do this
And luckily for us, it's installed on Kotarak.
It worked and we can see the same request here that was in the log we found.
So with this combined with the POC we found, we hopefully can escalate to root.
So let's grab a copy of the poc and save it on our computer and name it wgetexploit.py
And changed these values,
Our FTP which we will host on our kali box
The web server which we will use 0.0.0.0 for kotarak
And what we want the new cron job to do…. Which is give us a reverse shell
We need to make our .wgetrc file for our ftp to serve up.
We need to start new listener on our kali box to catch the shell
Start our FTP
Then use updog and wget to download the POC python on to Kotarak
In another terminal on kali we start the python FTP Server
On Kotarak
We download the python script for the exploit using wget
Then we need to start our netcat listener on our kali box
Then we just start the POC using authbind on Kotarak and wait.
And after a couple of minutes we should get our root shell back
Comments
Post a Comment