BadCorp

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 192.168.160.133
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-13 13:28 +08
Nmap scan report for 192.168.160.133
Host is up (0.17s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Web Enumeration

The website was a corporate website:

First thing I noticed was the phone numbers. Normally machines, I see numbers like +12 345 678. This was the first box I saw that included unique phone numbers. I took a look at their team:

Again, phone numbers are unique here. This made me think about every little detail in the website, including the names of the users.

There wasn't much more on the website, and we were just left with FTP and SSH.

FTP Brute Force -> SSH Key

I took a look at this tweet regarding BadCorp:

To me, the 'insignificant information' was probably from the website. As such, I constructed wordlists based on the names of users and their phone numbers like this.

I then brute forced the FTP using hydra for each user and phone number, and eventually found one set of credentials that worked:

We can then login to FTP:

This file was password encrypted:

We can crack this using ssh2john.py and john:

Privilege Escalation

Backup SUID -> Reverse Engineering

I searched for SUID binaries within the machine and found one that stood out:

I didn't recognise this backup binary, so I downloaded it back to my machine and opened it up in ghidra.

Ghidra + Ltrace -> Command Injection

I first ran the binary with ltrace:

So it first makes us root and then checks for characters present. Afterwards, a basic strcmp is used to verify the password. The check for special characters seems to be a check for the bad characters:

The bad characters don't include '$' and '()', opening up the possibility of command injection. Moving to ghidra, this binary prompts for a password before running the check() function to see if the password is correct, and then copy() if it is right:

The copy() function takes an encrypted password and XOR's it with 0xc:

We can first grab the pw global variable from the binary:

And then we can create a script in Python to decrypt this.

The first ~ character is not needed. We can then run the binary with the password:

We can move on to the copy() function now:

All the binaries use their full path values, so no path hijacks here. However, this seems to use directories within /var/logs and /home/FTP. I was already thinking of command injection using subshells, and it seems that this is the exploit needed.

We can use FTP to a few malicious files since we don't have write access over those directories:

This works!

I then placed a file named $(bash) within the FTP directory, and it gave me a shell:

This shell was pretty limited and couldn't give me any output. However, we can simply run chmod u+s /bin/bash. In another shell, we can then get a proper root shell easily:

PreviousApexNextBanzai

Last updated