CarpeDiem
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.227.179
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-11 05:45 EDT
Nmap scan report for 10.129.227.179
Host is up (0.014s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open httpWeb Enum
Port 80 hosted a website that had a countdown to a domain being launched.
There was nothing interesting about this website. The search there is static. We can do a gobuster directory and wfuzz subdomain scan. gobuster only picked up on static site files, but wfuzz picked up on a portal endpoint:
Admin Bypass -> File Upload
This was running some motorcycle store portal:
We can create an account with the site. After registering, we can update our profile:
This is the request generated:
There's a login_type parameter set at 2, so let's change that to 1 and we might become an administrator. I tested this by visiting /admin and it worked:
When looking around, we can see there's a Quartely Sales Report part hwhere we can upload files:
The upload functions still being in development might mean this is vulnerable. I tried clicking on Add, but it did nothing. When inspecting the traffic, we can see it making POST requests to /classes/users.php?f=upload.
This accepts form-data and also is a PHP-based website (as from X-Powered-By), so let's try to upload a PHP webshell. I took some requests I had from other machines / scripts that also uploaded form-data.
The above request works and it will be uploaded:
Now we can try to upload a PHP webshell using an image in Content-Type because there's a check for that.
Then we can verify it works:
Then, we can get an easy reverse shell.
Docker Escape
MySQL Creds -> Chisel
When looking around the Docker container, we can find some MySQL Creds:
This a container with nothing in it, but there's bound to be others that are around somewhere. I started doing ping sweeps to see which hosts are alive.
I ran this for a while and found that we are on the 172.17.0.0/24 subnet. Afterwards, I did another ping sweep on 172.17.0.0/24.
I was lazy to cut the input, but basically 172.17.0.1 - 6 are alive. Now we can download nmap to the machine and scan these ports.
It appears that 172.17.0.3 has the MySQL instance, and 0.4 has the MongoDB instance. We can first pivot to the .0.3 instance using chisel.
Afterwards, we can access the database:
We can find the users table to see that Jeremy Hammond is the user with a hash:
This hash cannot be cracked, so that's a waste.
Docker Enum
Since we are still pivoting, we can enumerate the other services. We just need to change the chisel command to use R:socks to let us use proxychains to access the rest. Let's enumerate this sytematrically:
172.17.0.2
On 172.17.0.2, there's a backdrop.carpediem.htb site:
There's also a FTP server that accepts anonymous credentials, but we can't do much with it as it just hangs. Not much for this host in general.
172.17.0.4
This is the host that has MongoDB running. We can connect using proxychains mongo.
This was interesting, and we'll keep this in mind for now.
172.17.0.5
This host was running Trudesk on port 8118 (which is exactly what the MongoDB instance is for). We can directly add trudesk.carpediem.htb and access it on port 80 (without proxychains).
We don't have valid credentials (yet), so we can't login.
Reset Password -> Ticket Enum
Since we have access toe the MongoDB for Trudesk, we can just reset the password for the administrator.
This would reset the admin password to 'hello'. Then we can login to Trudesk. Here, we can read the tickets that are present:
Horace Flaccus is a new user present in the fictional company, and when we see the ticket, it hints that we have to use zoiper to call something to get the password.
Interesting! We can download Zoiper from here:
Zoiper -> SSH
We can download and install Zoiper via sudo dpkg -i <zoiper>.deb. Then, we can run zoiper5 to launch it:
We can continue as a free user, and enter these to 'login'.
We can skip the proxy part, and it seesms that both IAX UDP and SIP UDP works for this box:
Then, we can call *62 to get the voicemail.
When it asks for a Password, type 2022. Then press 1. The voicemail should play and here's the contents:
Using this, we can easily SSH in as hflaccus.
Privilege Escalation
Sniffing -> Weak TLS
I ran a LinPEAS scan on the machine, there's some interesting output:
For some reason, we can sniff all traffic on the host. Using this, I just sniffed traffic on the Docker subnet and left it for a few minutes. After a while, we can download the .pcap file back to our machine:
Then, we can take a look at this within wireshark. There's some traffic between the MongoDB and the Trudesk instance, but I have already exploited and viewed all the stuff within that, so there's no need to investigate that.
Instead, we can take a look at all the TLS traffic to the backdrop.carpediem.htb host. Within the Server Hello messages, TLS decides on the protocol that is to be used. In this case, the machine uses this:
A bit of Googling shows that this is a Weak Cipher Suite:
This cipher does not provide Perfect Forward Secrecy, meaning that we can decrypt all the past messages if we have the key. Googling about SSL keys and certificates tells us that it is located in the /etc/ssl file:
Within the /etc/ssl/certs file, we can find some keys that look out of place:
We can download this back to our machine. Then we can use wireshark to decrypt the TLS traffic.
We can dd the .key file here:
After that, save the changes and we would see some of the traffic become unencrypted HTTP:
We can foloow the HTTP stream to see this:
We have new credentials! We can use this to login to backdrop.carpediem.htb and enumerate.
Backdrop RCE
We can login using the credentials we found:
There is an RCE for this that involves CSRF, but since I'm the administrator, I don't need to do CSRF. I can directly do the RCE.
Head to Functionality > Install New Modules > Manual Installation > Upload the .tar file. Then, install it and we can check the RCE:
Then, we can get another reverse shell on this Docker container.
There's no Python on this, so we have to use script /dev/null -c bash to upgrade our shell.
Docker Root
There is a heartbeat.sh script within the /opt directory.
Here's its contents:
This script is being contunously run, and it seems to make run backdrop.sh using php. It also cehcks for the integrity of backdrop.sh, so we cannot change that script. Also, it seems to restore index.php file when something goes wrong.
The rest of the command executed seems to execute the root page in PHP, which is index.php, of which I have control of. We can drop a simple system('bash /tmp/shell'); into index.php to get another reverse shell as root.
First, drop a reverse shell as /tmp/shell.sh, then append the /var/www/html/backdrop/index.php page with system("bash /tmp/shell.sh"); and wait for execution.
CVE-2022-0492 -> Rooted!
Now that we are root on the Docker, let's try to find a way to escape this. When this box was published, there was a new Docker breakout technique related to cgroups. This is in-line with when the box was released.
There are some PoCs online to allow us to execute commands on the actual main machine:
We can download and run this:
Afterwards, we can ssh back into the main machine and get a root shell easily:
Fun machine, really long though!
Last updated