Investigation

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.236.234
Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-24 10:42 EST
Warning: 10.129.236.234 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.236.234
Host is up (0.16s latency).
Not shown: 64782 closed tcp ports (conn-refused), 751 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Web Exploit based. We would have to add eforenzics.htb to our /etc/hosts file to access the web port.

Exiftool RCE

The website reveals some web application advertising Digital Forensic Services.

Clicking the big Go button reveals that we can upload a jpg file to the website for analysis.

When I uploada file, it would produce a link to a report.

The file would be a .txt file of output from exiftool being used on the file.

Very obviously, there is a JPG RCE vulnerability here. One possible parameter to inject commands in is the File Name. With the version, I found this vulnerability that allowed for RCE through the pipe character.

https://gist.github.com/ert-plus/1414276e4cb5d56dd431c2f0429e4429gist.github.com

From this, I attempted a few direct OS command injections but it didn't work out well. I then attempted some Base64 encoded stuff, and a simple ping command works!

We can then replace the Base64 encoded command with a simple bash reverse shell and it works!

Privilege Escalation

When viewing the /home directory, we see there's a smorton user that we cannot access.

We need to do some looking around. I ran LinPEAS and found an interesting cronjob that was running.

Some backups of the /home directory were being created, and also there was an unquoted service path for the date binary.

Windows Event Logs

Heading to the /usr/local/investigation/analysed_log file, we can find a Microsoft Outlook Message there.

I sent this back to my machine via nc and opened it using msfconvert. Afterwards, we can read the emails. There's a huge base64 encoded zip file attached.

I couldn't decode the base64 to get the file for some reason, so I ported the message to my Windows machine and downloaded the file there.

When unzipped, we would get this MS Windows Vista Event Log.

So the key here is to watch for logging and file transfers that are occurring. We can use this tool to dump the log file into a JSON file for easier reading.

LogoGitHub - omerbenamram/evtx: A Fast (and safe) parser for the Windows XML Event Log (EVTX) formatGitHub

After looking around the entire log file (for a while), I chanced upon this string when searching for the Authentication term.

Turns out that this was the password for smorton. We can now su and capture the user flag.

Sudo Binary

When checking sudo privileges as smorton, we can find one:

Attempting to run the binary just does this:

So I transferred this binary back to my machine and used ghidra to see what it does. Here's the decompiled main function:

We can use this to get these this information:

  1. It needs a total of 3 parameters

  2. A password of lDnxUysaQn is needed as one of the parameters

  3. It exeecutes curl and perl on the script we download

  4. Then it cleans up by removing the file.

Simple enough. We should just need to host a perl reverse shell on our machine via Python HTTP and let this binary download and execute it.

After a bit of testing about the ordering of the parameters, I found what works:

Definitely more on the CTF side of HTB.

PreviousInterfaceNextJeeves