dynstr

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.71.147
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-09 11:14 EDT
Nmap scan report for 10.129.71.147
Host is up (0.10s latency).
Not shown: 65327 filtered tcp ports (no-response), 205 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
53/tcp open  domain
80/tcp open  http

HTTP + DNS Enum

This was a corporate page for a DNS service:

At the bottom, it appears we have to add dyna.htb to the /etc/hosts file:

Also, there is some information on the page:

Since DNS is open, we can use dig:

There is a hostmaster subdomain present, but it loads the same page. I ran a gobusterscan on the hostmaster subdomain in case it was different.

/nic? Loading it shows nothing, so let's do another gobuster scan.

Weird. Googling "badauth DNS" shows us ths is an error caused by a DNS software called DynDns:

Googling /nic/update reveals that this is actually an API that we can access:

LogoPerform Update (RA-API) Dyn Help Centerhelp.dyn.com

This requires credentials, which we had found earlier, so let's try to use this API.

Since this is taking our input and sending it somewhere, I tried some basic RCE injection.

For some reaosn, it's having trouble displaying our IP address. It seems limited to 8 characters, so let's try to change our IP address to decimal mode. After some testing involving the different subdomains, we can find one that works:

Privilege Escalation

We can't grab the user flag yet. There are 2 other users on the machine:

Bindmgr Shell

Within the bindmgr directory, there is a support case folder:

Within it, there are some folders for a script:

When we read the debug script, we can find a SSH private key within it:

I tried to use this to ssh in as the user, but it seems that we are being blocked. On enumeration of the authorized_keys file, we cansee that it only accepts requests from *.infra.dyna.htb.

The next step here would be to update the DNS records using nsupdate such that a new domain would point to our machine and allow us to ssh in using the key we found. The hint here is to use bind, and this would require a key file from /etc/bind.

The infra.key file is readable by us, so let's use that with the -k flag using nsupdate. For this particular case, since we are using ssh, we want the IP address to be resolvable from the domain name and vice versa. This means that we need to add both a PTR and an A type DNS record within the server. I had to use a writeup for this since I wasn't too familiar with DNS records.

Afterwards, we can ssh in as the user:

Sudo

When checking sudo privileges, this is what we see:

Here's the contents of the script:

The vulnerability is in the usage of the wildcard.

Because this specified a wildcard and we can run it as root, this means we can preserve or copy file permissions (like SUID) over to other binaries using the --preserve=mode flag.

First, we need to create a .version file with 42 within it because the script checks for the version run. Then, we can create a folder named --preserve=mode which abuses the wildcard and makes the file we created a flag.

Then, we need to do cp /bin/bash to our file, and run the script using sudo:

PreviousDevoopsNextEncoding

Last updated