Hunit

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.183.125
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 13:03 +08
Nmap scan report for 192.168.183.125
Host is up (0.17s latency).
Not shown: 65483 filtered tcp ports (no-response), 48 closed tcp ports (conn-refused)
PORT      STATE SERVICE
8080/tcp  open  http-proxy
12445/tcp open  unknown
18030/tcp open  unknown
43022/tcp open  unknown

Did a detailed nmap scan as well:

$ sudo nmap -p 8080,12445,18030,43022 -sC -sV --min-rate 3000 -Pn 192.168.183.125      
[sudo] password for kali: 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 13:08 +08
Nmap scan report for 192.168.183.125
Host is up (0.17s latency).

PORT      STATE SERVICE     VERSION
8080/tcp  open  http-proxy
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 200 
|     Content-Type: text/html;charset=UTF-8
|     Content-Language: en-US
|     Content-Length: 3762
|     Date: Wed, 12 Jul 2023 05:08:20 GMT
|     Connection: close
|     <!DOCTYPE HTML>
|     <!--
|     Minimaxing by HTML5 UP
|     html5up.net | @ajlkn
|     Free for personal and commercial use under the CCA 3.0 license (html5up.net/license)
|     <html>
|     <head>
|     <title>My Haikus</title>
|     <meta charset="utf-8" />
|     <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no" />
|     <link rel="stylesheet" href="/css/main.css" />
|     </head>
|     <body>
|     <div id="page-wrapper">
|     <!-- Header -->
|     <div id="header-wrapper">
|     <div class="container">
|     <div class="row">
|     <div class="col-12">
|     <header id="header">
|     <h1><a href="/" id="logo">My Haikus</a></h1>
|     </header>
|     </div>
|     </div>
|     </div>
|     </div>
|     <div id="main">
|     <div clas
|   HTTPOptions: 
|     HTTP/1.1 200 
|     Allow: GET,HEAD,OPTIONS
|     Content-Length: 0
|     Date: Wed, 12 Jul 2023 05:08:20 GMT
|     Connection: close
|   RTSPRequest: 
|     HTTP/1.1 505 
|     Content-Type: text/html;charset=utf-8
|     Content-Language: en
|     Content-Length: 465
|     Date: Wed, 12 Jul 2023 05:08:20 GMT
|     <!doctype html><html lang="en"><head><title>HTTP Status 505 
|     HTTP Version Not Supported</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 505 
|_    HTTP Version Not Supported</h1></body></html>
|_http-title: My Haikus
12445/tcp open  netbios-ssn Samba smbd 4.6.2
18030/tcp open  http        Apache httpd 2.4.46 ((Unix))
|_http-title: Whack A Mole!
|_http-server-header: Apache/2.4.46 (Unix)
| http-methods: 
|_  Potentially risky methods: TRACE
43022/tcp open  ssh         OpenSSH 8.4 (protocol 2.0)
| ssh-hostkey: 
|   3072 7bfc37b4da6ec58ea98bb780f5cd09cb (RSA)
|   256 89cdea4725d98ff894c3d65cd405bad0 (ECDSA)
|_  256 c07c6f477e94cc8bf83da0a61fa92711 (ED25519)

Web Enum -> API SSH Creds

Port 8080 shows a Haiku page:

If we read go to the first Haiku's page and view the page source, we find this:

We can enumerate the API page using curl.

Using the /user/? endpoint gives us credentials for some users:

We can then login using the credentials for dademola:

Privilege Escalation

Exposed SSH Key -> Git User

There are other users present on this machine:

For some reason, the git user's .ssh file is readable by all:

There's also mention of git-shell-commands, meaning that we probably need to use this SSH key to perform some Git commands. Using this key, we can ssh in to get a Git shell:

Cronjob -> Git Hijack

I did some enumeration on the machine as dademola first, since there wasn't much I could do with a Git shell yet.

There was a git-server folder present in the / directory:

There was also some mention of a backups.sh file being executed periodically as part of a cronjob:

The backups.sh file is also in a git-server file of its own, and pull.sh is likely pulling changes from...somewhere. Since we have a Git shell, my guess is that we need to use it to submit a malicious PR that changes backups.sh to a reverse shell.

To exploit this, let's first clone the repository from the machine:

Here, we can see that backups.sh has nothing in it:

I echoed in a reverse shell and a chmod u+s /bin/bash, and then made it executable. Afterwards, I submitted a push request to add the edited backups.sh into the repository.

Then, we can just wait for the cronjob to execute our reverse shell as root:

PreviousHetemitNextIllusion

Last updated