BASE
10.10.10.48
Last updated
10.10.10.48
Last updated
nmap-auto 10.10.10.48 all
The only notable ports are ssh and http, and that the OS is confirmed to be Linux. OpenSSH 7.6p1 is rarely exploitable so the starting point should be examining the http service.
Another method to find available pages is to directory fuzz. Dirbuster, dirb, and dirsearch are great options. Using dirsearch and a big wordlist provided in the "/usr/share/wordlists", the following results were found:
python3 dirsearch.py -e txt,html,php,sh -w /home/z3r0/Resources/wordlists/dirb-big.txt -t 10 -u http://10.10.10.48/
http://10.10.10.48/_uploaded/
http://10.10.10.48/login/
http://10.10.10.48/static/
http://10.10.10.48/icons/
Okay, so there is an "_uploaded" page, this might come in handy later. With the files found in /login, maybe we can examine some of the code.
Doing the following strings command, strings login.php.swp gives a pretty good look at what is written. the 'excerpt' tab is the important text that is reordered for a better understanding:
At first glance, this seems like secure functionality, but the fault falls in the fact that the function strcmp is used and that there is inherent weaknesses in PHP's comparisons. If the statement $_POST['username'] is equal to a data type other than a string, then strcmp would return a NULL. Although this would cause the warning, "PHP warning: strcmp() expects parameter 2 to be string", it will still return the value 0 as if both parameters were equal. The next problem is the use of the soft operator == rather than the strict operator ===. The operator == is true if $a is equal to $b after type juggling. This means that the statement "" == [] would evaluate to true even though they are of different types. The operator === would only evaluate to true if $a is equal to $b AND they are both of the same type. Knowing this, the statement NULL == 0 would return true and bypass the comparison check in the above PHP script.
Changing the last line username=&password= to username[]=&password[]= will submit empty arrays to the PHP script. The result is that the statements $SESSION['userid'] = 1; and header("Location: upload.php"); will execute and the login will be bypassed.
Copy the file and change the ip and port to reflect a netcat listener and upload it. Once its uploaded set up a listener with the following command:
rlwrap nc -nvlp 9000
The first few things to do is try to get the user flag, escalate to an interactable shell, check the privileges of the user, and look at files of interest that are held by the current user.
User flag is owned by john, maybe there is a way to become that user
python -c 'import pty;pty.spawn("/bin/bash")' gives a better tty shell
/var/www/html/login/config.php has the credentials for the webpage
Users that have a shell are john and root
Credentials for admin user on webpage: username: admin password: thisisagoodpassword
user.txt: f54846c258f3b4612f78a819573d158e
The next step is privilege escalation. One of the first things to do is check the sudo privileges of a user if it's present. It can be checked using the command sudo -l.
sudo find . -exec /bin/sh \; -quit
Last step is to get the flag at /root/root.txt
root.txt: 51709519ea18ab37dd6fc58096bea949
Opening a browser and heading to shows us a website named "Base".
: Login page with username and password
: Contains 3 files: (1) config.php, (2) login.php, (3) login.php.swp
To get the bypass to trigger, both the first and second strcmp statements need to return true. This can be done by crafting a POST request with both the values $_POST['username'] and $_POST['password'] being equal to an empty array. Using [BurpSuite](), a tool used for checking web application security, the POST packet can be intercepted and modified to reflect this.
Great! Now there is both an upload page that can be accessed, "", and a possible page where things get uploaded to "". Sounds like reverse shell time - [pentestmonkey's php reverse shell]() is a solid choice for trying this.
Navigate to where the reverse shell is in the "_uploaded" folder and execute the script by going to the webpage, in my case "". The listener should catch a shell that's owned by www-data.
Whenever credentials are found, the rule of thumb is "try them everywhere". The two places where credentials can be applied are (1) and (2) the open ssh service on port 22. The original credentials can be used to login on the webpage. After a few combination attempts, the username john and the password thisisagoodpassword worked at logging in to john's shell on the BASE box. Time to get the flag at "/home/john/user.txt".
The line (root : root) /usr/bin/find shows that the command find can be used by the user john with root privilege. Since the binary is allowed to be run as superuser with the keyword sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access. A good place to reference well known binaries that can be used to bypass security restrictions is [GTFOBins](). Navigating to the [page]() about the find keyword will show the method to escalating to root:
