BASE

10.10.10.48

Recon

nmap-auto 10.10.10.48 all

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 f6:5c:9b:38:ec:a7:5c:79:1c:1f:18:1c:52:46:f7:0b (RSA)
|   256 65:0c:f7:db:42:03:46:07:f2:12:89:fe:11:20:2c:53 (ECDSA)
|_  256 b8:65:cd:3f:34:d8:02:6a:e3:18:23:3e:77:dd:87:40 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

The only notable ports are ssh and http, and that the OS is confirmed to be Linux. OpenSSH 7.6p1 is rarely exploitable so the starting point should be examining the http service.

Enumeration

Opening a browser and heading to http://10.10.10.48/ shows us a website named "Base".

Another method to find available pages is to directory fuzz. Dirbuster, dirb, and dirsearch are great options. Using dirsearch and a big wordlist provided in the "/usr/share/wordlists", the following results were found:

python3 dirsearch.py -e txt,html,php,sh -w /home/z3r0/Resources/wordlists/dirb-big.txt -t 10 -u http://10.10.10.48/

  • http://10.10.10.48/_uploaded/

  • http://10.10.10.48/login/

  • http://10.10.10.48/static/

  • http://10.10.10.48/icons/

Okay, so there is an "_uploaded" page, this might come in handy later. With the files found in /login, maybe we can examine some of the code.

Exploitation

Doing the following strings command, strings login.php.swp gives a pretty good look at what is written. the 'excerpt' tab is the important text that is reordered for a better understanding:

if(!empty($_POST['username']) && !empty($_POST['password'])) {
    require('config.php');
    if (strcmp($username , $_POST['username']) == 0) {
        if (strcmp($password, $_POST['password']) == 0) {
            $_SESSION['user_id'] = 1;
            header("Location: upload.php");
        } else {
            print("<script>alert('Wrong Username or Password')</script>");
        }
    } else {
        print("<script>alert('Wrong Username or Password')</script>");
    }
}

At first glance, this seems like secure functionality, but the fault falls in the fact that the function strcmp is used and that there is inherent weaknesses in PHP's comparisons. If the statement $_POST['username'] is equal to a data type other than a string, then strcmp would return a NULL. Although this would cause the warning, "PHP warning: strcmp() expects parameter 2 to be string", it will still return the value 0 as if both parameters were equal. The next problem is the use of the soft operator == rather than the strict operator ===. The operator == is true if $a is equal to $b after type juggling. This means that the statement "" == [] would evaluate to true even though they are of different types. The operator === would only evaluate to true if $a is equal to $b AND they are both of the same type. Knowing this, the statement NULL == 0 would return true and bypass the comparison check in the above PHP script.

To get the bypass to trigger, both the first and second strcmp statements need to return true. This can be done by crafting a POST request with both the values $_POST['username'] and $_POST['password'] being equal to an empty array. Using [BurpSuite](https://portswigger.net/burp/communitydownload), a tool used for checking web application security, the POST packet can be intercepted and modified to reflect this.

Changing the last line username=&password= to username[]=&password[]= will submit empty arrays to the PHP script. The result is that the statements $SESSION['userid'] = 1; and header("Location: upload.php"); will execute and the login will be bypassed.

Great! Now there is both an upload page that can be accessed, "http://10.10.10.48/upload.php", and a possible page where things get uploaded to "http://10.10.10.48/_uploaded/". Sounds like reverse shell time - [pentestmonkey's php reverse shell](https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php) is a solid choice for trying this.

Copy the file and change the ip and port to reflect a netcat listener and upload it. Once its uploaded set up a listener with the following command:

rlwrap nc -nvlp 9000

Navigate to where the reverse shell is in the "_uploaded" folder and execute the script by going to the webpage, in my case "http://10.10.10.48/_uploaded/shell.php". The listener should catch a shell that's owned by www-data.

Lateral Movement

The first few things to do is try to get the user flag, escalate to an interactable shell, check the privileges of the user, and look at files of interest that are held by the current user.

  • User flag is owned by john, maybe there is a way to become that user

  • python -c 'import pty;pty.spawn("/bin/bash")' gives a better tty shell

  • /var/www/html/login/config.php has the credentials for the webpage

  • Users that have a shell are john and root

Credentials for admin user on webpage: username: admin password: thisisagoodpassword

Whenever credentials are found, the rule of thumb is "try them everywhere". The two places where credentials can be applied are (1) http://10.10.10.48/login/login.php and (2) the open ssh service on port 22. The original credentials can be used to login on the webpage. After a few combination attempts, the username john and the password thisisagoodpassword worked at logging in to john's shell on the BASE box. Time to get the flag at "/home/john/user.txt".

user.txt: f54846c258f3b4612f78a819573d158e

Privilege Escalation

The next step is privilege escalation. One of the first things to do is check the sudo privileges of a user if it's present. It can be checked using the command sudo -l.

Matching Defaults entries for john on base:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User john may run the following commands on base:
    (root : root) /usr/bin/find

The line (root : root) /usr/bin/find shows that the command find can be used by the user john with root privilege. Since the binary is allowed to be run as superuser with the keyword sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access. A good place to reference well known binaries that can be used to bypass security restrictions is [GTFOBins](https://gtfobins.github.io/). Navigating to the [page](https://gtfobins.github.io/gtfobins/find/) about the find keyword will show the method to escalating to root:

sudo find . -exec /bin/sh \; -quit

Last step is to get the flag at /root/root.txt

root.txt: 51709519ea18ab37dd6fc58096bea949

PreviousARCHETYPENextBASHED

Last updated