Undetected
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.136.44
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-08 12:00 EDT
Nmap scan report for 10.129.136.44
Host is up (0.010s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open httpDJewelry -> PHPUnit RCE
The website is a company page:
If we try to Visit Store, we get redirected to store.djewelry.htb. The store page is identical to the original, but it has more functionalities:
I tried adding products to the cart and maybe finding an exploit pertaining to that, but it was disabled.
Since there's no functionalities on this site, let's run a feroxbuster directory scan.
When we view the /vendor endpoint, we see a file system with different PHP libraries:
Searching for exploits for each of them leads me an RCE for PHPUnit:
This works:
Then, use a bash one-liner to get a reverse shell.
Privilege Escalation
Info RE
We can't access the user flag yet, and steven is the user of this machine. Within the /var/backups folder, there's a file that is not meant to be there:
This file was an ELF binary:
We can transfer this back to my machine for some reverse engineering via ghidra. There were loads of functions within the binary.
There are a lot of functions within this function:
Out of all the functions, exec_shell is the most unique because it actually executes something.
We can see the -c flag, and it is passed to execve, which means that some commands are being executed here. However, ghidra is unable to to see what is being executed. When we open it up in ida64, we can see a huge chunk of hex.
When converted to a string, it gives this:
We can tidy this up a bit:
There's a hash within this, which is crackable after removing all of the \$ characters and the rest of the random parts.
Reading the code, it seems to make the user $user"1", which means it is steven1 in this case. We can then ssh in as steven1 using this password:
Mod_Reader.o RE
Running LinPEAS reveals there is mail for the user:
Apache service is weird and there's a database basically. We can head to /etc/apache2 to enumerate more. I was looking through the files and found a particualrly large file in mods-available that had the latest edit date:
The rest of the files were about 500 bytes, meanwhile this thing was massive. We can bring this back to our machine for analysis via nc.
Then, using ida64, we see that there are base64 related functions for this:
We can locate the string and see that it is being passed into another bash -c command:
When decoded, it shows this:
sshd is in use here, so let's download that binary back to our machine since RE seems to be the path forward in this machine.
sshd RE -> Root Pwd
This was a much larger binary, so let's use ghidra to get some pseudocode. When looking through the functions, we can see that the auth_password function is a backdoor.
This might contain the credentials for root.
This takes some bytes and jumbles them up, then it would XOR with 0x96 before comparing with some variable and stop the function. The "some variable" probably refers to an index variable for a for loop that iterates over the entire string.
From running lscpu on the machine, we know this is a little endian machine, and we need to reverse this string. There are 31 bytes (indicated by backdoor[30] being the largest index I can see here) and they are all over the place. Let's first organise the string in order:
Afterwards, we just need to convert this to a string, XOR it with 0x96, then reverse it back. The last step is needed because after the XOR operation, the first byte becomes the last.
This would give us the string @=qfe5%2^k-aq@%k@%6k6b@$u#f*b?3, which is the root password:
Last updated