search

G00g

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.202.144
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-06 22:36 +08
Nmap scan report for 192.168.202.144
Host is up (0.17s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

hashtag
Web Enum -> Google Auth

Visiting port 80 requires credentials:

admin:admin works. Afterwards, we are just greeted by this:

In the comments, there's a hidden directory:

Googling this leads to some Apache 2FA thing using Google Authenticator:

LogoGitHub - itemir/apache_2fa: Apache two-factor (2FA) authentication with Google Authenticator based on Time-based One-Time Password (TOTP) or HMAC-based one-time password (HOTP) Algorithms.GitHubchevron-right

The repository included this interesting bit here:

So within Google Authenticaotr, we can click the Plus sign in the corner:

We can then enter this key:

After adding this, we would get a OTP every 30 seconds as with normal Google Authenticator:

Keying in this 2FA token would grant us access to the web page:

hashtag
LFI -> User Creds + Token

The website is obviously vulnerable to some form of exploit. When we run it and view the result, it shows us the results by reading from a file:

This is very obviously vulnerable to LFI, and we can use that to read other files.

There weren't any SSH keys to read for the fox user. However, the Github repo did mention that there is an apache_credentials file somewhere on this machine.

After some testing, I found in within the /opt directory:$ curl -H 'Cookie: 2FA_Auth=junH2NR79pTrLiI800JewoWsESYCry6Xbz4oaIJ71VlhUKEHPNcdHsq4I6uK1CZUMKBz1ZExSDC0OcpmcFEyojXc823DIB9PA6ExXs' -G --data-urlencode 'view=/opt/apache_2fa/apache_credentials' http://192.168.202.144/spool/viewresult.php

This can be cracked easily:

However, we cannot just SSH in:

The user has 2FA too! So we need to steal the tokens.json file as well.

Afterwards, we can do the same thing with Google Authenticator to get a 2FA code to ssh in:

hashtag
Privilege Escalation

I ran a linpeas.sh to find possible vectors, and it picked up on one SUID binary:

GTFOBins has an entry for this:

Logoarj | GTFOBinsgtfobins.github.iochevron-right

To exploit this, we can add a new root user. First, we can generate a new passwd file with our new user and hash, then overwrite it using arj.

Rooted!

PreviousKeyVaultNextMalbec

Last updated