Ransom
Mr Robot themed!
Mr Robot themed!
aining Access
Nmap scan:
Web exploitation time.
The website was some type of Incident Response site, from E Corp.
I tried logging in with some random password, and intercepted the response in Burpsuite to see how the login was handled. Found the /api endpoint.
I tried playing around with the website by sending JSON objects, and found that setting the password parameter to true would let us login.
Once we were in, we could view these files:
We can grab the user flag and also the homedirectory.zip file. Upon running an exiftool for it, we can see that the file name was .bash_logout. All of the files were encrypted with a password, and cracking it was not possible.
When attempting to unzip the file, we can find some SSH keys within it.
At this point, I began enumerating possible ZIP file exploits that were used. One command we could use was 7z l -slt which would list out the files and show the technical information for the files:
This was using ZipCrypto Deflate as the method of zipping.
Googling a little led me to this repository with instructions on how to recover the password:
This attack is made possible due to legacy encryption being used, and this form of encryption was vulnerable to the known plaintext attack. We would need to have at least 12 bytes of data, with 8 being contiguous to decrypt the password.
Because this was simply a home directory with common files like .bash_logout, we can easily create another zip file with our machine's .bash_logout file and then find the keys using bkcrack.
We can then retrieve the keys for the ZIP file:
Afterwards, the ZIP file and its contents can be copied to another ZIP file with a known password that we can decrypt.
Then we can SSH in as the htb user.
I ran a LinPEAS to find more information, and it enumerated out a potential password for a mysql instance:
However, the machine does not have any database running. However, the presence of the other APP related environment variables highlighted that the /srv/prod directory had the files for the website we exploited earlier.
We would be looking for some type of config files, or a method as to how the authentication mechanisms for the website works.
Within the /srv/prod/app/Http/Controllers/AuthController.php file, I found the root password:
