search

Escape

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.157.113
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-14 16:01 +08
Nmap scan report for 192.168.157.113
Host is up (0.18s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8080/tcp open  http-proxy

hashtag
Web Enumeration -> File Upload

Visiting both the websites shows nothing. The page source just shows this:

<html>
<head>

<style type="text/css">
 <!--
 body {
  background-image: url(jail.jpg);
 }
 ->
</style>

<title>Escape</title>
</head>
<body>
</body>
</html>

I ran a feroxbuster on both, and found a /dev endpoint on port 8080.

This was a PHP page, so uploading PHP reverse shells is the priority, and there's a pretty good WAF. I tested loads of method of bypassing it, and this machine requires a combination of quite a few.

  • File Header Spoofing

  • Double File Extension

  • Content-Type Spoofing

We can get a reverse shell by loading the uploaded file:

hashtag
Privilege Escalation

hashtag
SNMP -> Docker Escape

We spawned in a Docker container. The /var/backups folder contained a .conf file for SNMP:

Here are the interesting bits:

Firstly, we have the password string required. Next, we have some sort of script execution within the machine. We can put a reverse shell there instead.

Then, transfer this using curl and chmod 777 it. To execute the shell, run this:

hashtag
LogRotate SUID -> PATH Hijack

I checked for SUID binaries present within this machine:

logconsole was the one I didn't recognise.

It seems like a custom binary. As such, I ran it through ltrace to see what it was executing with each option.

it's executing system calls for each option. When I checked the last option, it runs lscpu without the full path:

This means we can create our own lscpu binary to run.

Then, place this within /tmp and chmod 777 it. Afterwards, change the PATH variable and run the logconsole binary to check for CPU information.

hashtag
OpenSSL -> File Read

Within the /opt directory, there's an openssl binary that only tom can execute:

We are also given some certs and keys. I first checked this openssl binary using getcap, finding that it has all capabilities enabled, meaning that we can read any file:

We can then use this to read the private SSH key of root:

PreviousDibbleNextExfiltrated

Last updated