Frolic
Last updated
Last updated
Nmap scan:
Interesting stuff.
Port 9999 was running a typical nginx web application. I used gobuster to find some hidden directories.
Going to /backup reveals some credentials and another hidden directory.
There was nothing interesting in these files, but I found it rather odd that the /backup folder had the loop/ directory within it.
I proceeded to run feroxbuster on the website to recursively enumerate all directories present. This allowed me to find the /dev/backup folder which contained another directory.
Going to the directory that we just found, we can see another login page.
I viewed the page source, and found the password in the JS code within the page.
Then, when logged in, we find this cipher.
From here, the box evolved into a short series of puzzles involving decrypting stuff.
The cipher we just found was an Ook! cipher. When decoded, this is all it says:
Afterwards, we would get another cipher.
I recognised this as base64 and attempted to decode it, but it returned non-readable characters.
This was some type of zip folder, because it contained an index.php file within it, and also it had the PK file signature (which indicates ZIP folders). So I decoded this to find a password protected zip file, which could be cracked using zip2john.
Then, index.php was another cipher.
This time, this was in hex. When decoded from hex, we get another cipher:
Now, it's base64 (as from the double = at the back). When decoded, we get yet another cipher.
This is the Brainfuck cipher, which can be decoded to find idkwhatispass.
Now, we had another credential to try. I attempted logins using admin:idkwhatispass and logged in to the playSMS service yet again.
playSMS had a few RCE exploits, so I grabbed one from Github and tried it.
Worked! Now, we can get a reverse shell easily using a bash one-liner.
Then we would gain a reverse shell as www-data.
The user on this machine had an interesting .binary directory within their home directory.
In the /home/ayush/.binary directory, we can find this rop SUID binary.
I ran an ltrace on the binary and tested it with some random input. I found that this uses the strcpy function, which is vulnerable to a BOF exploit.
Ran a checksec on it too:
So ASLR is disabled, but NX is enabled. This means the stack is non-executable. As such, we can just do a Ret2Libc attack.
To execute this attack, we would need 3 addresses:
system() function
Address of /bin/sh
exit() function
Base address of library (via ldd)
To find these, we can search the /lib/i386-linux-gnu/libc.so.6 file for the respective addresses.
For each of these addresses, we would need to find the final address by adding the offset to the base address. This would give the following:
Afterwards, we need to fuzz the binary to find the number of junk characters required via pattern_offset.rb.
We can then create a quick script using Python.
Then, we can run the binary and use the output from this script as the input from stdin. This would drop us in a root shell.
