Introduction
This room has it’s own writeup by TryHackMe, which can be found here.
Since I usually blog here while I pop machines, let’s see where this one goes.
Scanning & Enumeration
Attacker IP: 10.4.9.255
Target IP: 10.10.107.116 | Note: This may change as I do not complete one machine in a single sitting.
Nmap Scan
From the results above, let us populate our Service Version Enumeration Table.
Enumeration
HTTP Enumeration
We check the source code, nothing there.
Let’s try Gobuster.
We see a couple of 301s, 301 stands for Permanently Moved, let us visit try to visit these URLs. ‘/admin’ looks the juiciest of all.
We get similar 403’s with the rest, except ‘/squirrelmail’
The first thing I do when I see a login page is trying to login using admin: admin. But this was not the right credential. We can google if there are any default passwords for SquirrelMail.
At this point, we have not observed any user yet, and thus trying to use hydra would be too tiresome. Let us look at other services.
Key Takeaways:
SquirrelMail Version — 1.4.23
SMB Enumeration
We use SMBMap to enumerate the samba shares on the server.
We see that we have READ ONLY access to the anonymous shares.
We also notice the share ‘milesdyson’, but we have no access to them.
We see a file called ‘attention.txt’, well you have all my attention :P
Let’s get the file and see what’s inside.
This suggests 2 things:
1. Passwords are changed by a lot of people who are using Skynet, we saw two more folders other than ‘attention.txt’, so next place to look at would be ‘logs’.
2. There is a person named Miles Dyson, whose username might be miles.
Since this is a machine intended to be vulnerable we see only 3 logs, had this been a real environment, there are a lot of logs!
We notice that the size of log2.txt and log3.txt is 0. Let’s see the contents of log1.txt.
It has a list of words, looks like something out of this can be our password since the Machine is based on Terminator, the user must be a fan of the movie.
We noticed the share on samba, let us try if we can brute force it as user ‘miles’.
https://redteamtutorials.com/2018/10/25/hydra-brute-force-techniques/
I found this website which has different hydra-brute-force techniques.
Since we need to brute-force on smb, let’s use this.
This did not work. So I thought of writing a script.
But we find that none of them is the password to access the samba shares.
Well, we can try to brute force the squirrel mail that we had found above.
SquirrelMail
We capture the request in Burp and try to brute-force using intruder.
After attacking, I couldn’t find a different output. Let us try to see if we find any online tools that might help us. I found https://github.com/04x/SquirrelMail-BruteForce
We see the usage information, and running it did not work as expected.
I am not sure why the intruder did not work. Maybe because I did not provide the correct username? Maybe… Well, what can be the username now? Maybe ‘milesdyson’, why? Because we saw a share with the same name.
After running the attack, in the responses tab, We find a 302, and a different length and a status of 302 instead of normal 200.
I was able to login using the credentials.
Once we log in, we see 3 different emails, out of which Samba Password reset obviously looks a lot more important that others having ‘no subject’.
We find the new password for our samba share.
Revisiting Samba
This time we have the password, use it to log in and I see notes.
The folder contains a lot of files, but the most important looks like - "important.txt"
Another URL is exposed.
Revisiting HTTP
With the newly found URL, we are back at enumerating the HTTP.
We see Miles Dyson’s personal page and viewing the source code doesn’t help. It’s gobuster time!!
We find ‘/administrator’.
This exposes Cupa CMS.
I tried to log in using different credentials. None worked. So I searched on Searchsploit if Cuppa CMS has any known vulnerabilities.
Vulnerability Analysis
The first step is to search if searchsploit has any entries for cuppa cms.
Let us copy this file to our working directory, read it's contents.
We see that it is vulnerable to PHP Code Injection and that the vulnerability exists because of the use of ‘include’ which is known as File Inclusion Vulnerability. A little later we see that this file inclusion can be local as well as remote.
Let us try and see if we can use the second one first.
Let us upload a PHP reverse shell remotely which once included will give us a full shell on the target machine.
Exploitation
Let us get the PHP reverse shell from Pentest Monkey, http://pentestmonkey.net/tools/web-shells/php-reverse-shell
Modify the script to include attacker ip and the port that our reverse shell will listen on.
Once that is done.
- Start the webserver on our local machine and the netcat listener
- On the target machine, add the URL to reverse shell
Now that we have our initial shell, let’s privesc :D
Privesc
Let us run ‘linpeas.sh’ on the target machine. ( Transfer the linpeas.sh over HTTP and download using wget)
While it ran, I saw the sudo version was ‘sudo 1.8.16’ which was vulnerable, there was a blog on this.
But it required that I knew the password for www-data, which I obviously did not know.
I thought of changing my user to ‘milesdyson’ using the password that we enumerated.
It worked, but the exploit still did not. So I continued to keep looking.
According to the LEGEND, this can be a PE vector with a probability of 99%. We will take a look at that in a minute.
backup.sh is owned by root, and can be executed by anyone. Inside that we see that command ‘tar’ is being used. Since it is the only command inside, I think we need to leverage that somehow. Let’s search on GTFO bins.
It surely gives some results, but not sure how I could use them, I looked at the solution provided by TryHackMe. I found this blog, which talks about exploiting wildcards on Linux.
Hmmmm… Interesting. This is something really new and the point where everyone thought of using * as a feature and not a bug is one of the classic bug/feature jokes ever!
Now that we know this, we are required to do the following:
1. Create these fake files
2. Execute some commands as root which can be written inside shell.sh.
Let’s do this.
We saw that the root folder was ‘/var/www/html/’
This gives us an error. Why? Because I had logged in as milesdyson. Running exit once will bring us back to ‘www-data’ who is the owner of the directory. Now we can go ahead and create the files.
Let us try adding this bash reverse shell inside the shell.sh
Just adding this did not work, but the one below, did!
And, we got root!
Summary | TL;DR
- Scan ports using nmap
- Enumerate Samba and get password list from the network share
- Enumerate HTTP, use the password list to brute force. Check email. Get authentication for Samba
- Find hidden URL from Samba, get the CMS
- CMS has a public vulnerability, exploit that to get a local shell
- Privesc using wild card vulnerability using tar.
Parting Thoughts
In this machine, we learned the following:
- How enumeration is key, that we might need to repeatedly enumerate services with new information that we receive during enumeration
- A crazy privesc vector.
Thank you for reading, please provide your feedback and share with people who are in need. :)